What is the format of the packet header when using netfilter queues?

1
votes

I'm using netfilter queues on Ubuntu 14.10. Everything is working so far, I'm seeing packets and setting the verdict, but I'd like to get a better idea of what I'm reading from the queue.

Starting from this page.

This is the code in question:

fd = nfq_fd(h);
while ((rv = recv(fd, buf, sizeof(buf), 0)) >= 0)
{
    printf("pkt received\n");
    nfq_handle_packet(h, buf, rv);
}

At the point where they have a printf(), what exactly has been read from fd? I assume it is the packet preceeded by some kind of netfilter-specific header, but I have no idea what that header would be. I'm looking at a dump of the bytes I'm reading, but I'm not seeing a valid L2, L3, nor L4 anywhere in there.

Note that as per the documentation, I did setup the queue in copy mode with this line:

nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff);
1
linuxiptablesnetfilter

1 Answers

0
votes

Looks like netfilter queues returns L3+. There is no L2. When the callback is running -- called by nfq_handle_packet() -- what I'm seeing is 58 bytes of <something> (not L2) followed by L3.

The ethertype from the "missing" L2 can be obtained using:

struct nfqnl_msg_packet_hdr *ph = nfq_get_msg_packet_hdr(nfad);
const uint32_t id = ntohl(ph->packet_id);
const uint16_t ethertype = ntohs(ph->hw_protocol);

Then L3 is obtained with:

uint8_t *payload_data = nullptr;
const int payload_len = nfq_get_payload(nfad, &payload_data);

If needed, the source MAC address from L2 may be available with a call to nfq_get_packet_hw().