netfilter_queue

1. 官方资源
官方网址是：http://netfilter.org/projects/libnetfilter_queue/
截止2017年2月16日，最新版本是1.0.2 , 这个版本的依赖libnfnetlink和libmnl并要求linux内核 2.6.14以上.
比较早的版本1.0.1多一个libmnl. 这些也体现在示例代码里。

2. 安装与设置
下载完源码后，先安装libnfnetlink和libmnl，再安装netfilter_queue

2.1 编译

configure, make ,make install (注意make install的时候需要sudo)

2.2 检查

在安装完所有库之后，我们可以到/usr/local/include查看这三个库的头文件是否存在，他们的目录分别是”libmnl”, “libnetfilter_queue”和”libnfnetlink”.

3. 样例代码

3.1 netfilter_queue 1.0.2版本的样例代码在 libnetfilter_queue-1.0.2/examples里”nf-queue.c”, 如下：

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <time.h>
#include <arpa/inet.h>

#include <libmnl/libmnl.h>
#include <linux/netfilter.h>
#include <linux/netfilter/nfnetlink.h>

#include <linux/types.h>
#include <linux/netfilter/nfnetlink_queue.h>

#include <libnetfilter_queue/libnetfilter_queue.h>

static struct mnl_socket *nl;

static struct nlmsghdr *
nfq_hdr_put(char *buf, int type, uint32_t queue_num)
{
    struct nlmsghdr *nlh = mnl_nlmsg_put_header(buf);
    nlh->nlmsg_type = (NFNL_SUBSYS_QUEUE << 8) | type;
    nlh->nlmsg_flags = NLM_F_REQUEST;

    struct nfgenmsg *nfg = mnl_nlmsg_put_extra_header(nlh, sizeof(*nfg));
    nfg->nfgen_family = AF_UNSPEC;
    nfg->version = NFNETLINK_V0;
    nfg->res_id = htons(queue_num);

    return nlh;
}

#处理后返回给netfilter对数据包的处理
static int
nfq_send_verdict(int queue_num, uint32_t id)
{
    char buf[MNL_SOCKET_BUFFER_SIZE];
    struct nlmsghdr *nlh;
    int ret;

    nlh = nfq_hdr_put(buf, NFQNL_MSG_VERDICT, queue_num);
    nfq_nlmsg_verdict_put(nlh, id, NF_ACCEPT);

    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
        perror("mnl_socket_send");
        exit(EXIT_FAILURE);
    }
    return ret;
}

static int queue_cb(const struct nlmsghdr *nlh, void *data)
{
    struct nfqnl_msg_packet_hdr *ph = NULL;
    struct nlattr *attr[NFQA_MAX+1];
    uint32_t id = 0;
    struct nfgenmsg *nfg;

    if (nfq_nlmsg_parse(nlh, attr) < 0) {
        perror("problems parsing");
        return MNL_CB_ERROR;
    }

    nfg = mnl_nlmsg_get_payload(nlh);

    ph = (struct nfqnl_msg_packet_hdr *)
        mnl_attr_get_payload(attr[NFQA_PACKET_HDR]);
    if (ph == NULL) {
        perror("problems retrieving metaheader");
        return MNL_CB_ERROR;
    }

    id = ntohl(ph->packet_id);

    printf("packet received (id=%u hw=0x%04x hook=%u)\n",
        id, ntohs(ph->hw_protocol), ph->hook);

    nfq_send_verdict(ntohs(nfg->res_id), id);

    return MNL_CB_OK;
}

int main(int argc, char *argv[])
{
    char buf[MNL_SOCKET_BUFFER_SIZE];
    struct nlmsghdr *nlh;
    int ret;
    unsigned int portid, queue_num;

    #这里的queue_num是从参数里读进来的，在iptables命令里可以设置
    if (argc != 2) {
        printf("Usage: %s [queue_num]\n", argv[0]);
        exit(EXIT_FAILURE);
    }
    queue_num = atoi(argv[1]);

    nl = mnl_socket_open(NETLINK_NETFILTER);
    if (nl == NULL) {
        perror("mnl_socket_open");
        exit(EXIT_FAILURE);
    }

    if (mnl_socket_bind(nl, 0, MNL_SOCKET_AUTOPID) < 0) {
        perror("mnl_socket_bind");
        exit(EXIT_FAILURE);
    }
    portid = mnl_socket_get_portid(nl);

    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0);
    nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_UNBIND);

    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
        perror("mnl_socket_send");
        exit(EXIT_FAILURE);
    }

    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, 0);
    nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_PF_BIND);

    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
        perror("mnl_socket_send");
        exit(EXIT_FAILURE);
    }

    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, queue_num);
    nfq_nlmsg_cfg_put_cmd(nlh, AF_INET, NFQNL_CFG_CMD_BIND);

    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
        perror("mnl_socket_send");
        exit(EXIT_FAILURE);
    }

    nlh = nfq_hdr_put(buf, NFQNL_MSG_CONFIG, queue_num);
    nfq_nlmsg_cfg_put_params(nlh, NFQNL_COPY_PACKET, 0xffff);

    if (mnl_socket_sendto(nl, nlh, nlh->nlmsg_len) < 0) {
        perror("mnl_socket_send");
        exit(EXIT_FAILURE);
    }

    ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
    if (ret == -1) {
        perror("mnl_socket_recvfrom");
        exit(EXIT_FAILURE);
    }
    while (ret > 0) {
        ret = mnl_cb_run(buf, ret, 0, portid, queue_cb, NULL);
        if (ret < 0){
            perror("mnl_cb_run");
            exit(EXIT_FAILURE);
        }

        ret = mnl_socket_recvfrom(nl, buf, sizeof(buf));
        if (ret == -1) {
            perror("mnl_socket_recvfrom");
            exit(EXIT_FAILURE);
        }
    }

    mnl_socket_close(nl);

    return 0;
}

在该文件夹内运行

make nf-queue

得到 nf-queue

另外，还有一个示例代码在“libnetfilter_queue-1.0.2/utils/nfqnl_test.c”，这里不细谈，同样make之后可以测试。

3.2 设置iptables

iptables -A OUTPUT -j NFQUEUE --queue-num 111

这里把发出的数据包都转到queue-num为111的用户态程序。

3.3 运行 nf-queue

./nf-queue 111

得到

....
packet received (id=476 hw=0x0800 hook=3)
packet received (id=477 hw=0x0800 hook=3)
packet received (id=478 hw=0x0800 hook=3)
packet received (id=479 hw=0x0800 hook=3)
packet received (id=480 hw=0x0800 hook=3)
packet received (id=481 hw=0x0800 hook=3)
packet received (id=482 hw=0x0800 hook=3)
packet received (id=483 hw=0x0800 hook=3)
packet received (id=484 hw=0x0800 hook=3)

证明用户态的程序已经收到了数据包。

4. 性能相关
关于netfilter_queue的性能问题，http://www.netfilter.org/projects/libnetfilter_queue/doxygen/index.html 里提到了几个可以注意的点：

To improve your libnetfilter_queue application in terms of performance, you may consider the following tweaks:

increase the default socket buffer size by means of nfnl_rcvbufsiz().
set nice value of your process to -20 (maximum priority).
set the CPU affinity of your process to a spare core that is not used to handle NIC interruptions.
set NETLINK_NO_ENOBUFS socket option to avoid receiving ENOBUFS errors (requires Linux kernel >= 2.6.30).
see –queue-balance option in NFQUEUE target for multi-threaded apps (it requires Linux kernel >= 2.6.31).