Hi,
I want to do some packet manipulation that seems beyond the scope of
what can be done directly by existing iptables modules (ipv4 options
mangling), so I'd like to queue the packets in question for userspace,
for easy experimentation and development.
After a fair bit of googling, it seems to me that the most common and
well-documented way to do this is via the QUEUE target and libipq. But
numerous references indicate that QUEUE and libipq are deprecated and
NFQUEUE/nfnetlink_queue is the preferred method. Setting up the
iptables looks straightforward, but then how to receive/return them on
the userspace side? Aside from libipq, it seems that there are 3
alternatives:
* libnetfilter_queue http://www.netfilter.org/projects/libnetfilter_queue/
* libnl and its "queue" group of functions
http://www.infradead.org/~tgr/libnl/doc/group__queue.html
<http://www.infradead.org/%7Etgr/libnl/doc/group__queue.html>
* Code your own using netlink sockets directly, and
<linux/netfilter/nfnetlink_queue.h>.
None of these seem to have great documentation or example programs,
although I have found a few resources. So I'm wondering if anyone can
give me a little direction as to what are the differences, which would
be the best option, and why there seems to be a duplication between
libnl and libnetfilter. Is libipq truly deprecated? I would prefer not
to code into a "dead end" and eventually end up re-coding for a
different library.
Thanks,
David F
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
