netfilter_queue

1. 官方资源
官方网址是：http://netfilter.org/projects/libnetfilter_queue/
截止2017年2月16日，最新版本是1.0.2 , 这个版本的依赖libnfnetlink和libmnl并要求linux内核 2.6.14以上.
比较早的版本1.0.1多一个libmnl. 这些也体现在示例代码里。

2. 安装与设置
下载完源码后，先安装libnfnetlink和libmnl，再安装netfilter_queue

2.1 编译

configure, make ,make install (注意make install的时候需要sudo)

2.2 检查

在安装完所有库之后，我们可以到/usr/local/include查看这三个库的头文件是否存在，他们的目录分别是”libmnl”, “libnetfilter_queue”和”libnfnetlink”.

3. 样例代码

3.1 netfilter_queue 1.0.2版本的样例代码在 libnetfilter_queue-1.0.2/examples里”nf-queue.c”, 如下：

#include <stdio.h>#include <stdlib.h>#include <unistd.h>#include <string.h>#include <time.h>#include <arpa/inet.h>#include <libmnl/libmnl.h>#include <linux/netfilter.h>#include <linux/netfilter/nfnetlink.h>#include <linux/types.h>#include <linux/netfilter/nfnetlink_queue.h>#include <libnetfilter_queue/libnetfilter_queue.h>static struct mnl_socket *nl;static struct nlmsghdr *nfq_hdr_put(char *buf, int type, uint32_t queue_num){    struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);    nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | type;    nlh->nlmsg_flags = NLM_F_REQUEST;    struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));    nfg->nfgen_family = AF_UNSPEC;    nfg->version = NFNETLINK_V0;    nfg->res_id = htons(queue_num);    return nlh;}#处理后返回给netfilter对数据包的处理static intnfq_send_verdict(int queue_num, uint32_t id){    char buf[MNL_SOCKET_BUFFER_SIZE];    struct nlmsghdr *nlh;    int ret;    nlh = nfq_hdr_put(buf, NFQNL_MSG_VERDICT, queue_num);    nfq_nlmsg_verdict_put(nlh, id, NF_ACCEPT);    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {        perror("mnl_socket_send");        exit(EXIT_FAILURE);    }    return ret;}static int queue_cb(const struct nlmsghdr *nlh, void *data){    struct nfqnl_msg_packet_hdr *ph = NULL;    struct nlattr *attr[NFQA_MAX+1];    uint32_t id = 0;    struct nfgenmsg *nfg;    if (nfq_nlmsg_parse(nlh, attr) < 0) {        perror("problems parsing");        return MNL_CB_ERROR;    }    nfg = mnl_nlmsg_get_payload(nlh);    ph = (struct nfqnl_msg_packet_hdr *)        mnl_attr_get_payload(attr[NFQA_PACKET_HDR]);    if (ph == NULL) {        perror("problems retrieving metaheader");        return MNL_CB_ERROR;    }    id = ntohl(ph->packet_id);    printf("packet received (id=%u hw=0x%04x hook=%u)\n",        id, ntohs(ph->hw_protocol), ph->hook);    nfq_send_verdict(ntohs(nfg->res_id), id);    return MNL_CB_OK;}int main(int argc, char *argv[]){    char buf[MNL_SOCKET_BUFFER_SIZE];    struct nlmsghdr *nlh;    int ret;    unsigned int portid, queue_num;    #这里的queue_num是从参数里读进来的，在iptables命令里可以设置    if (argc != 2) {        printf("Usage: %s [queue_num]\n", argv[0]);        exit(EXIT_FAILURE);    }    queue_num = atoi(argv[1]);    nl = mnl_socket_open(NETLINK_NETFILTER);    if (nl == NULL) {        perror("mnl_socket_open");        exit(EXIT_FAILURE);    }    if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {        perror("mnl_socket_bind");        exit(EXIT_FAILURE);    }    portid = mnl_socket_get_portid(nl);    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0);    nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_UNBIND);    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {        perror("mnl_socket_send");        exit(EXIT_FAILURE);    }    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0);    nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_BIND);    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {        perror("mnl_socket_send");        exit(EXIT_FAILURE);    }    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, queue_num);    nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND);    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {        perror("mnl_socket_send");        exit(EXIT_FAILURE);    }    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, queue_num);    nfq_nlmsg_cfg_put_params(nlh, NFQNL_COPY_PACKET, 0xffff);    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {        perror("mnl_socket_send");        exit(EXIT_FAILURE);    }    ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));    if (ret == -1) {        perror("mnl_socket_recvfrom");        exit(EXIT_FAILURE);    }    while (ret > 0) {        ret = mnl_cb_run(buf, ret, 0, portid, queue_cb, NULL);        if (ret < 0){            perror("mnl_cb_run");            exit(EXIT_FAILURE);        }        ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));        if (ret == -1) {            perror("mnl_socket_recvfrom");            exit(EXIT_FAILURE);        }    }    mnl_socket_close(nl);    return 0;}

在该文件夹内运行

make nf-queue

得到 nf-queue

另外，还有一个示例代码在“libnetfilter_queue-1.0.2/utils/nfqnl_test.c”，这里不细谈，同样make之后可以测试。

3.2 设置iptables

iptables -A OUTPUT -j NFQUEUE --queue-num 111

这里把发出的数据包都转到queue-num为111的用户态程序。

3.3 运行 nf-queue

./nf-queue 111

得到

....packet received (id=476 hw=0x0800 hook=3)packet received (id=477 hw=0x0800 hook=3)packet received (id=478 hw=0x0800 hook=3)packet received (id=479 hw=0x0800 hook=3)packet received (id=480 hw=0x0800 hook=3)packet received (id=481 hw=0x0800 hook=3)packet received (id=482 hw=0x0800 hook=3)packet received (id=483 hw=0x0800 hook=3)packet received (id=484 hw=0x0800 hook=3)

证明用户态的程序已经收到了数据包。

4. 性能相关
关于netfilter_queue的性能问题，http://www.netfilter.org/projects/libnetfilter_queue/doxygen/index.html 里提到了几个可以注意的点：

To improve your libnetfilter_queue application in terms of performance, you may consider the following tweaks:

increase the default socket buffer size by means of nfnl_rcvbufsiz().
set nice value of your process to -20 (maximum priority).
set the CPU affinity of your process to a spare core that is not used to handle NIC interruptions.
set NETLINK_NO_ENOBUFS socket option to avoid receiving ENOBUFS errors (requires Linux kernel >= 2.6.30).
see –queue-balance option in NFQUEUE target for multi-threaded apps (it requires Linux kernel >= 2.6.31).