1= nfnl_cthelper: User-space infrastructure for connection tracking helpers = 2 3Author: Pablo Neira Ayuso <pablo@netfilter.org> 4 5== Introduction == 6 7Connection tracking helpers allows you to filter multi-flow protocols 8that usually separate control and data traffic into different flows. 9This is the case of application protocols like FTP, SIP and H.323 that 10are already supported by Netfilter. These helpers are implemented in 11kernel-space. 12 13There are good reasons to implement helpers in user-space instead: 14 15* Rapid connection tracking helper development, as developing code 16 in user-space is usually faster. 17 18* Reliability: A buggy helper does not crash the kernel. Moreover, 19 we can monitor the helper process and restart it in case of problems. 20 21* Security: Avoid complex string matching and mangling in kernel-space 22 running in unprivileged mode. Going further, we can even think about 23 running user-space helpers as a non-root process. 24 25* It allows the development of very specific helpers (most likely 26 non-standard proprietary protocols) that are very likely to be rejected 27 for mainline inclusion in the form of kernel-space connection tracking 28 helpers. 29 30== Basic operation == 31 32In a few steps: 33 341) Register user-space helper 35 36# ./nfct-helper-add test 0 37 38This adds a helper `test' that uses the queue number 0. 39 402) Add rules to enable the `test' user-space helper 41 42For locally generated packets: 43# iptables -I OUTPUT -t raw -p tcp -j CT --helper test 44 45For non-locally generated packets: 46# iptables -I PREROUTING -t raw -p tcp -j CT --helper test 47 483) Run the test libnetfilter_queue program 49 50# ./nfqnl_test 51 524) Generate traffic, if everything is OK, then `nfqnl_test' program 53 displays lines like this: 54 55 pkt received 56 hw_protocol=0x0800 hook=4 id=4 outdev=3 payload_len=60 57 entering callback 58 [...] 59 60This means that the cthelper infrastructure is passing traffic to 61user-space. 62