Sponsored Content
Top Forums Programming extending netfilter...plz help Post 97538 by Rakesh Ranjan on Tuesday 31st of January 2006 10:02:10 AM
Old 01-31-2006
extending netfilter...plz help

Hello friends i'm trying to extend iptables to include a target by which we can change the packet type field of a packet.
For this i created a kernel module and a userspace extension.
Now i face the problem that when i try to invoke iptable with the target i created i get an error message saying that "no match/target/chain by that name" but when i do lsmod to show the modules that are loaded my kernel module is shown (that means it is loaded) i also went through userspace extension in iptables made by me but could not locate any problem.
only thing that i could locate was that the error message was coming from libiptc.c (here strange thing was that in libiptc.c in the function that printed error there was a structure which stored the function name where error originally occured, the error no. and msg. Now in my case the function name was shown as NULL so I can't figure out where the error is actually coming from.)

One more related problem, to debug above, in kernel module i gave some kernel messages (which i obviously thought that would be printed out some where as they will b reached) but i'm not able to figure out where that message is going. I checked system log in /var/log/messages but there i could just find one system message that the module has been loaded but not the customized message that i gave. Can someone help me out with that where is my message going.

Oh sorry! I forgot to tell my system description. I'm running redhat 9.0 (kernel 2.4.20) and using iptables 1.2.7a.
 

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

plz Help How should I configure cc compiler output file plz help???

i.e configuration of C compiler :confused: (4 Replies)
Discussion started by: atiato
4 Replies

2. Programming

Help in extending netfilter

Hi everybody, I have to write a module for matching in netfilter , extending the netfilter but I'm facing some problems can somebody guide me in that. I know that I need to write matching module working in kernel space and a program in userspace. I went through the HOWTO on netfilter-hacking but... (0 Replies)
Discussion started by: Trusted Penguin
0 Replies

3. Programming

Problem in registering new netfilter target module

Friends I'm facing a big problem trying to extend the netfilter. Somone please help me with your quick reply (any hint) as I've to meet a deadline. My problem is that I've written a new netfilter target module and its corresponding userspace program for iptables to change the packet type of a... (0 Replies)
Discussion started by: Rakesh Ranjan
0 Replies

4. IP Networking

netfilter connection tracking

hi, i'm using tcpreplay to send a traffic trace to my wireless interface (the trace is been captured by the same interface). It seems as netfilter can't trace connections. Is it possible? (0 Replies)
Discussion started by: littleboyblu
0 Replies

5. Cybersecurity

Netfilter conntracking for P2P protocols (edonkey, bittorent...)

Hi everyone, I would like to allow multi users to access P2P networks, so I wonder if there's a way to tracking these kind of protocols with netfilter, and also compatibility with nat, like the module conntrack_ftp seems to do with the FTP protocol. Thanks guys. (0 Replies)
Discussion started by: nekkro-kvlt
0 Replies

6. Linux

netfilter / iptables

HI, Is the Netfilter and IPtables same? Thanks & Regards Arun (1 Reply)
Discussion started by: Arun.Kakarla
1 Replies

7. Linux

C, LKM, netfilter, PF_PACKET and ARP.

Hello, Everyone knows that with PF_PACKET sockets one can "sniff" a determinated frame from the network device, but just that, see the frame without altering its action on the receiving host. What i want is to "intercept" the incoming frame and pass it through some rules, and if it doesn't pass... (9 Replies)
Discussion started by: Zykl0n-B
9 Replies

8. Cybersecurity

Experience with libvirt netfilter API

Hi all, I would like to get some ideas and opinions on matter of libvirt netfilter application in KVM environment. I am looking for some easy way to control it with an API and possible experience with that and its performance in real life application. Thanks for all ideas (0 Replies)
Discussion started by: smoofy
0 Replies

9. Cybersecurity

How to use Netfilter properly with IPv6?

Hello, on a PC with Debian 8 I try to use a Bash script with Netfilter rules so that only traffic goes in and out that is wanted. For that I set all 3 default policies to "drop". The machine uses DHCP to get its IP, gateway and DNS. And I never checked so I was quite surprised that my... (1 Reply)
Discussion started by: SInt
1 Replies
IPQ_SET_VERDICT(3)					     Linux Programmer's Manual						IPQ_SET_VERDICT(3)

NAME
ipq_set_verdict -- issue verdict and optionally modified packet to kernel SYNOPSIS
#include <linux/netfilter.h> #include <libipq.h> int ipq_set_verdict(const struct ipq_handle *h, ipq_id_t id, unsigned int verdict, size_t data_len, unsigned char *buf); DESCRIPTION
The ipq_set_verdict function issues a verdict on a packet previously obtained with ipq_read, specifing the intended disposition of the packet, and optionally supplying a modified version of the payload data. The h parameter is a context handle which must previously have been returned successfully from a call to ipq_create_handle. The id parameter is the packet identifier obtained via ipq_get_packet. The verdict parameter must be one of: NF_ACCEPT Accept the packet and continue traversal within the kernel. NF_DROP Drop the packet. NF_QUEUE Requeue the packet. NF_STOLEN and NF_REPEAT are kernel-internal constants and should not be used from userspace as their exact side effects have not been investigated. The data_len parameter is the length of the data pointed to by buf, the optional replacement payload data. If simply setting a verdict without modifying the payload data, use zero for data_len and NULL for buf. The application is responsible for recalculating any packet checksums when modifying packets. RETURN VALUE
On failure, -1 is returned. On success, a non-zero positive value is returned. ERRORS
On error, a descriptive error message will be available via the ipq_errstr function. BUGS
None known. AUTHOR
James Morris <jmorris@intercode.com.au> COPYRIGHT
Copyright (c) 2000-2001 Netfilter Core Team. Distributed under the GNU General Public License. SEE ALSO
iptables(8), libipq(3). Linux iptables 1.2 16 October 2001 IPQ_SET_VERDICT(3)
All times are GMT -4. The time now is 10:49 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy