netfilter

README

go-netfilter-queue

Go bindings for libnetfilter_queue

Forked from openshift/geard@be0423a for supporting recent environments.

This library provides access to packets in the IPTables netfilter queue (NFQUEUE). The libnetfilter_queue library is part of the Netfilter project.

Example

use IPTables to direct all outgoing Ping/ICMP requests to the queue 0:

iptables -A OUTPUT -p icmp -j NFQUEUE --queue-num 0

You can then use go-netfilter-queue to inspect the packets:

package main

import (
        "fmt"
        "github.com/AkihiroSuda/go-netfilter-queue"
        "os"
)

func main() {
        var err error

        nfq, err := netfilter.NewNFQueue(0, 100, netfilter.NF_DEFAULT_PACKET_SIZE)
        if err != nil {
                fmt.Println(err)
                os.Exit(1)
        }
        defer nfq.Close()
        packets := nfq.GetPackets()

        for true {
                select {
                case p := <-packets:
                        fmt.Println(p.Packet)
                        p.SetVerdict(netfilter.NF_ACCEPT)
                }
        }
}

To inject a new or modified packet in the place of the original packet, use:

p.SetVerdictWithPacket(netfilter.NF_ACCEPT, byte_slice)

Instead of:

p.SetVerdict(netfilter.NF_ACCEPT)

To undo the IPTables redirect. Run:

iptables -D OUTPUT -p icmp -j NFQUEUE --queue-num 0

Documentation

Overview

Go bindings for libnetfilter_queue

This library provides access to packets in the IPTables netfilter queue (NFQUEUE). The libnetfilter_queue library is part of the http://netfilter.org/projects/libnetfilter_queue/ project.

Index

• Constants
• type NFPacket
  • func (p *NFPacket) SetRequeueVerdict(newQueueId uint16)
  • func (p *NFPacket) SetVerdict(v Verdict)
  • func (p *NFPacket) SetVerdictMark(v Verdict, mark uint32)
  • func (p *NFPacket) SetVerdictWithPacket(v Verdict, packet []byte)
• type NFQueue
  • func NewNFQueue(queueId uint16, maxPacketsInQueue uint32, packetSize uint32, failOpen bool) (*NFQueue, error)
  • func (nfq *NFQueue) Close()
  • func (nfq *NFQueue) GetPackets() <-chan NFPacket
• type Verdict

Constants

const (
	AF_INET  = 2
	AF_INET6 = 10

	NF_DROP   Verdict = 0
	NF_ACCEPT Verdict = 1
	NF_STOLEN Verdict = 2
	NF_QUEUE  Verdict = 3
	NF_REPEAT Verdict = 4
	NF_STOP   Verdict = 5

	NF_DEFAULT_PACKET_SIZE uint32 = 0xffff
)

Types

type NFPacket

type NFPacket struct {
	Packet gopacket.Packet
	Mark   uint32
	// contains filtered or unexported fields
}

func (*NFPacket) SetRequeueVerdict

func (p *NFPacket) SetRequeueVerdict(newQueueId uint16)

Set the verdict for the packet (in the case of requeue)

func (*NFPacket) SetVerdict

func (p *NFPacket) SetVerdict(v Verdict)

Set the verdict for the packet

func (*NFPacket) SetVerdictMark

func (p *NFPacket) SetVerdictMark(v Verdict, mark uint32)

Set the verdict for the packet with a mark

func (*NFPacket) SetVerdictWithPacket

func (p *NFPacket) SetVerdictWithPacket(v Verdict, packet []byte)

Set the verdict for the packet AND provide new packet content for injection

type NFQueue

type NFQueue struct {
	// contains filtered or unexported fields
}

func NewNFQueue

func NewNFQueue(queueId uint16, maxPacketsInQueue uint32, packetSize uint32, failOpen bool) (*NFQueue, error)

Create and bind to queue specified by queueId

func (*NFQueue) Close

func (nfq *NFQueue) Close()

Unbind and close the queue

func (*NFQueue) GetPackets

func (nfq *NFQueue) GetPackets() <-chan NFPacket

Get the channel for packets

type Verdict

type Verdict C.uint

Verdict for a packet