01-31-2006
extending netfilter...plz help
Hello friends i'm trying to extend iptables to include a target by which we can change the packet type field of a packet.
For this i created a kernel module and a userspace extension.
Now i face the problem that when i try to invoke iptable with the target i created i get an error message saying that "no match/target/chain by that name" but when i do lsmod to show the modules that are loaded my kernel module is shown (that means it is loaded) i also went through userspace extension in iptables made by me but could not locate any problem.
only thing that i could locate was that the error message was coming from libiptc.c (here strange thing was that in libiptc.c in the function that printed error there was a structure which stored the function name where error originally occured, the error no. and msg. Now in my case the function name was shown as NULL so I can't figure out where the error is actually coming from.)
One more related problem, to debug above, in kernel module i gave some kernel messages (which i obviously thought that would be printed out some where as they will b reached) but i'm not able to figure out where that message is going. I checked system log in /var/log/messages but there i could just find one system message that the module has been loaded but not the customized message that i gave. Can someone help me out with that where is my message going.
Oh sorry! I forgot to tell my system description. I'm running redhat 9.0 (kernel 2.4.20) and using iptables 1.2.7a.
9 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
i.e configuration of C compiler :confused: (4 Replies)
Discussion started by: atiato
4 Replies
2. Programming
Hi everybody,
I have to write a module for matching in netfilter , extending the netfilter but I'm facing some problems can somebody guide me in that. I know that I need to write matching module working in kernel space and a program in userspace. I went through the HOWTO on netfilter-hacking but... (0 Replies)
Discussion started by: Trusted Penguin
0 Replies
3. Programming
Friends I'm facing a big problem trying to extend the netfilter. Somone please help me with your quick reply (any hint) as I've to meet a deadline.
My problem is that I've written a new netfilter target module and its corresponding userspace program for iptables to change the packet type of a... (0 Replies)
Discussion started by: Rakesh Ranjan
0 Replies
4. IP Networking
hi,
i'm using tcpreplay to send a traffic trace to my wireless interface (the trace is been captured by the same interface). It seems as netfilter can't trace connections. Is it possible? (0 Replies)
Discussion started by: littleboyblu
0 Replies
5. Cybersecurity
Hi everyone, I would like to allow multi users to access P2P networks, so I wonder if there's a way to tracking these kind of protocols with netfilter, and also compatibility with nat, like the module conntrack_ftp seems to do with the FTP protocol.
Thanks guys. (0 Replies)
Discussion started by: nekkro-kvlt
0 Replies
6. Linux
HI,
Is the Netfilter and IPtables same?
Thanks & Regards
Arun (1 Reply)
Discussion started by: Arun.Kakarla
1 Replies
7. Linux
Hello,
Everyone knows that with PF_PACKET sockets one can "sniff" a determinated frame from the network device, but just that, see the frame without altering its action on the receiving host. What i want is to "intercept" the incoming frame and pass it through some rules, and if it doesn't pass... (9 Replies)
Discussion started by: Zykl0n-B
9 Replies
8. Cybersecurity
Hi all,
I would like to get some ideas and opinions on matter of libvirt netfilter application in KVM environment. I am looking for some easy way to control it with an API and possible experience with that and its performance in real life application.
Thanks for all ideas (0 Replies)
Discussion started by: smoofy
0 Replies
9. Cybersecurity
Hello,
on a PC with Debian 8 I try to use a Bash script with Netfilter rules so that only traffic goes in and out that is wanted. For that I set all 3 default policies to "drop". The machine uses DHCP to get its IP, gateway and DNS. And I never checked so I was quite surprised that my... (1 Reply)
Discussion started by: SInt
1 Replies
LEARN ABOUT LINUX
ipq_set_verdict
IPQ_SET_VERDICT(3) Linux Programmer's Manual IPQ_SET_VERDICT(3)
NAME
ipq_set_verdict -- issue verdict and optionally modified packet to kernel
SYNOPSIS
#include <linux/netfilter.h>
#include <libipq.h>
int ipq_set_verdict(const struct ipq_handle *h, ipq_id_t id, unsigned int verdict, size_t data_len, unsigned char *buf);
DESCRIPTION
The ipq_set_verdict function issues a verdict on a packet previously obtained with ipq_read, specifing the intended disposition of the
packet, and optionally supplying a modified version of the payload data.
The h parameter is a context handle which must previously have been returned successfully from a call to ipq_create_handle.
The id parameter is the packet identifier obtained via ipq_get_packet.
The verdict parameter must be one of:
NF_ACCEPT
Accept the packet and continue traversal within the kernel.
NF_DROP
Drop the packet.
NF_QUEUE
Requeue the packet.
NF_STOLEN and NF_REPEAT are kernel-internal constants and should not be used from userspace as their exact side effects have not been
investigated.
The data_len parameter is the length of the data pointed to by buf, the optional replacement payload data.
If simply setting a verdict without modifying the payload data, use zero for data_len and NULL for buf.
The application is responsible for recalculating any packet checksums when modifying packets.
RETURN VALUE
On failure, -1 is returned.
On success, a non-zero positive value is returned.
ERRORS
On error, a descriptive error message will be available via the ipq_errstr function.
BUGS
None known.
AUTHOR
James Morris <jmorris@intercode.com.au>
COPYRIGHT
Copyright (c) 2000-2001 Netfilter Core Team.
Distributed under the GNU General Public License.
SEE ALSO
iptables(8), libipq(3).
Linux iptables 1.2 16 October 2001 IPQ_SET_VERDICT(3)