nflog学习

n1wer

已于 2023-03-16 14:40:48 修改

阅读量741

点赞数

文章标签：服务器 linux 运维

于 2023-03-16 14:40:24 首次发布

本文链接：https://blog.csdn.net/n1wer/article/details/129586091

版权

nflog 是一种类似client/server的架构，需要进行nflog通信时，需要先启server。然后客户端才能发送数据给server。

server的工作

创建nfulnl_instance实体

nfulnl_recv_config--NFULNL_CFG_CMD_BIND--》instance_create

主要关注group号，这个是通信的基础，client必须通过group号和server通信

对用libnetfilter_log库里面提供了nflog_bind_group来绑定group。其他参数可见下面示例程序所示。

server示例代码如下：

#include <stdio.h>

#include <sys/types.h> 

#include <string.h>
#include <errno.h>
#include <libnetfilter_log/libnetfilter_log.h>
#include <libnfnetlink/libnfnetlink.h>



void main()
{
   struct nflog_handle *h;
   struct nflog_g_handle *gh;


   h = nflog_open();
   if(h==NULL)
   {
       printf("open nflog failed\n");
       return;
   }

   if (nflog_bind_pf(h, AF_INET) < 0) 
   {
       printf("bind nflog failed\n");
       return;
   }

   gh = nflog_bind_group(h, 80);   // bind group 80

   if(gh==NULL)
   {
        printf("bind nflog group failed\n");
        return;
   }

   if(nflog_set_mode(gh, NFULNL_COPY_PACKET, 0xFFFF) < 0) 
   {
       printf("can't set packet_copy mode\n");
       return; 
   }

   

   if (nflog_set_qthresh(gh, 1) < 0)         // set threshold =1
   {
       printf("NFLOG netlink queue threshold can't be set to 1\n");
       return;
   }

   if (nflog_set_timeout(gh, 10) < 0)           //set timeout = 10S
   {
       printf("NFLOG netlink queue timeout can't be set to 10\n");
       return;
   }




   struct timeval timev;
   timev.tv_sec = 1;
   timev.tv_usec = 0;

 
   int fd = nflog_fd(h);
   if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, &timev, sizeof(timev)) == -1) {
       printf("can't set socket timeout: %s", strerror(errno));
       return;
   }

   char buf[1024]={0};
   int rv;

   
   while (1) {

       rv = recv(fd, buf, 1024, 0);
       if (rv < 0) {

           printf("recive data fail \n");
           continue;

           
       }
       printf("recive data :%c %c %c %c %c %c %c %c %c %c!\n",
               buf[0],buf[1],buf[2],buf[3],buf[4],
               buf[5],buf[6],buf[7],buf[8],buf[9]);
       memset(buf,0,1024);
   }

}