rsmnl_linux/netfilter/
nfnetlink_queue.rs

1use errno::Errno;
2use mnl::{Attr, AttrTbl, MsgVec, Result};
3use netfilter::nfnetlink_conntrack;
4
5#[repr(u8)]
6#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
7pub enum NfqnlMsgTypes {
8    // NFQNL_MSG_
9    Packet = 0,   // packet from kernel to userspace
10    Verdict,      // verdict from userspace to kernel
11    Config,       // connect to a particular queue
12    VerdictBatch, // batchv from userspace to kernel
13    MAX,
14}
15pub const NFQNL_MSG_PACKET: u8 = NfqnlMsgTypes::Packet as u8;
16pub const NFQNL_MSG_VERDICT: u8 = NfqnlMsgTypes::Verdict as u8;
17pub const NFQNL_MSG_CONFIG: u8 = NfqnlMsgTypes::Config as u8;
18pub const NFQNL_MSG_VERDICT_BATCH: u8 = NfqnlMsgTypes::VerdictBatch as u8;
19pub const NFQNL_MSG_MAX: u8 = NfqnlMsgTypes::MAX as u8;
20
21#[repr(C, packed)]
22#[derive(Debug, Clone, Copy)]
23pub struct NfqnlMsgPacketHdr {
24    pub packet_id: u32,   // unique ID of packet in queue
25    pub hw_protocol: u16, // hw protocol (network order)
26    pub hook: u8,         // netfilter hook
27}
28
29#[repr(C)]
30#[derive(Debug, Clone, Copy)]
31pub struct NfqnlMsgPacketHw {
32    pub hw_addrlen: u16,
33    pub _pad: u16,
34    pub hw_addr: [u8; 8usize],
35}
36
37#[repr(C)]
38#[derive(Debug, Clone, Copy)]
39pub struct NfqnlMsgPacketTimestamp {
40    pub sec: u64,
41    pub usec: u64,
42}
43
44#[repr(u16)]
45#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, NlaType)]
46#[tbname = "NfqnlVlanAttrTbl"]
47pub enum NfqnlVlanAttr {
48    // NFQA_VLAN_
49    Unspec = 0,
50    #[nla_type(u16, proto)]
51    Proto, // __be16 skb vlan_proto
52
53    #[nla_type(u16, tci)]
54    Tci, // __be16 skb htons(vlan_tci)
55
56    _MAX,
57}
58
59#[repr(u16)]
60#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, NlaType)]
61#[tbname = "NfqnlAttrTypeTbl"]
62pub enum NfqnlAttrType {
63    // NFQA_
64    Unspec = 0,
65
66    #[nla_type(NfqnlMsgPacketHdr, packet_hdr)]
67    PacketHdr,
68
69    #[nla_type(NfqnlMsgVerdictHdr, verdict_hdr)]
70    VerdictHdr, // nfqnl_msg_verdict_hdr
71
72    #[nla_type(u32, mark)]
73    Mark, // __u32 nfmark
74
75    #[nla_type(NfqnlMsgPacketTimestamp, timestamp)]
76    Timestamp, // nfqnl_msg_packet_timestamp
77
78    #[nla_type(u32, ifindex_indev)]
79    IfindexIndev, // __u32 ifindex
80
81    #[nla_type(u32, ifindex_outdev)]
82    IfindexOutdev, // __u32 ifindex
83
84    #[nla_type(u32, ifindex_phyindev)]
85    IfindexPhyindev, // __u32 ifindex
86
87    #[nla_type(u32, ifindex_phyoutdev)]
88    IfindexPhyoutdev, // __u32 ifindex
89
90    #[nla_type(NfqnlMsgPacketHw, hwaddr)]
91    Hwaddr, // nfqnl_msg_packet_hw
92
93    #[nla_type(bytes, payload)]
94    Payload, // opaque data payload
95
96    #[nla_nest(nfnetlink_conntrack::CtattrTypeTbl, ct)]
97    Ct, // nf_conntrack_netlink.h
98
99    #[nla_type(u8, ct_info)]
100    CtInfo, // enum ip_conntrack_info
101
102    #[nla_type(u32, cap_len)]
103    CapLen, // __u32 length of captured packet
104
105    #[nla_type(u32, skb_info)]
106    SkbInfo, // __u32 skb meta information
107
108    #[nla_nest(nfnetlink_conntrack::CtattrExpectTbl, exp)]
109    Exp, // nf_conntrack_netlink.h
110
111    #[nla_type(u32, uid)]
112    Uid, // __u32 sk uid
113
114    #[nla_type(u32, gid)]
115    Gid, // __u32 sk gid
116
117    #[nla_type(bytes, secctx)]
118    Secctx, // security context string
119
120    #[nla_nest(NfqnlVlanAttrTbl, vlan)]
121    Vlan, // nested attribute: packet vlan info
122
123    #[nla_type(bytes, l2hdr)]
124    L2hdr, // full L2 header
125    _MAX,
126}
127
128#[repr(C)]
129#[derive(Debug, Clone, Copy)]
130pub struct NfqnlMsgVerdictHdr {
131    pub verdict: u32,
132    pub id: u32,
133}
134
135#[repr(u8)]
136#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
137pub enum NfqnlMsgConfigCmds {
138    // NFQNL_CFG_
139    None = 0,
140    Bind,
141    Unbind,
142    PfBind,
143    PfUnbind,
144}
145pub const NFQNL_CFG_CMD_NONE: u8 = NfqnlMsgConfigCmds::None as u8;
146pub const NFQNL_CFG_CMD_BIND: u8 = NfqnlMsgConfigCmds::Bind as u8;
147pub const NFQNL_CFG_CMD_UNBIND: u8 = NfqnlMsgConfigCmds::Unbind as u8;
148pub const NFQNL_CFG_CMD_PF_BIND: u8 = NfqnlMsgConfigCmds::PfBind as u8;
149pub const NFQNL_CFG_CMD_PF_UNBIND: u8 = NfqnlMsgConfigCmds::PfUnbind as u8;
150
151#[repr(C)]
152#[derive(Debug, Clone, Copy, Default)]
153pub struct NfqnlMsgConfigCmd {
154    pub command: u8, // nfqnl_msg_config_cmds
155    pub _pad: u8,
156    pub pf: u16, // AF_xxx for PF_[UN]BIND
157}
158
159#[repr(u8)]
160#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
161pub enum NfqnlConfigMode {
162    // NFQNL_COPY_
163    None = 0,
164    Meta,
165    Packet,
166}
167pub const NFQNL_COPY_NONE: u8 = NfqnlConfigMode::None as u8;
168pub const NFQNL_COPY_META: u8 = NfqnlConfigMode::Meta as u8;
169pub const NFQNL_COPY_PACKET: u8 = NfqnlConfigMode::Packet as u8;
170
171#[repr(C, packed)]
172#[derive(Debug, Clone, Copy)]
173pub struct NfqnlMsgConfigParams {
174    pub copy_range: u32,
175    pub copy_mode: u8, // enum nfqnl_config_mode
176}
177
178#[repr(u16)]
179#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, NlaType)]
180#[tbname = "NfqnlAttrConfigTbl"]
181pub enum NfqnlAttrConfig {
182    // NFQA_CFG_
183    Unspec = 0,
184    #[nla_type(NfqnlMsgConfigCmd, cmd)]
185    Cmd, // nfqnl_msg_config_cmd
186
187    #[nla_type(NfqnlMsgConfigParams, params)]
188    Params, // nfqnl_msg_config_params
189
190    #[nla_type(u32, queue_max_len)]
191    QueueMaxlen, // __u32
192
193    #[nla_type(u32, mask)]
194    Mask, // identify which flags to change
195
196    #[nla_type(u32, flags)]
197    Flags, // value of these flags (__u32)
198
199    _MAX,
200}
201
202// Flags for NFQA_CFG_FLAGS
203pub const NFQA_CFG_F_FAIL_OPEN: u32 = 1 << 0;
204pub const NFQA_CFG_F_CONNTRACK: u32 = 1 << 1;
205pub const NFQA_CFG_F_GSO: u32 = 1 << 2;
206pub const NFQA_CFG_F_UID_GID: u32 = 1 << 3;
207pub const NFQA_CFG_F_SECCTX: u32 = 1 << 4;
208pub const NFQA_CFG_F_MAX: u32 = 1 << 5;
209
210// flags for NFQA_SKB_INFO
211// packet appears to have wrong checksums, but they are ok
212pub const NFQA_SKB_CSUMNOTREADY: u32 = 1 << 0;
213// packet is GSO (i.e., exceeds device mtu)
214pub const NFQA_SKB_GSO: u32 = 1 << 1;
215// csum not validated (incoming device doesn't support hw checksum, etc.)
216pub const NFQA_SKB_CSUM_NOTVERIFIED: u32 = 1 << 2;
rsmnl_linux/netfilter/nfnetlink_queue.rs

rsmnl_linux/netfilter/
nfnetlink_queue.rs
