> -----Original Message----- > From: netfilter-devel-owner@xxxxxxxxxxxxxxx [mailto:netfilter-devel- > owner@xxxxxxxxxxxxxxx] On Behalf Of Jan Engelhardt > Sent: Saturday, September 24, 2011 1:24 AM > To: U.Mutlu > Cc: netfilter-devel@xxxxxxxxxxxxxxx > Subject: Re: [libnetfilter_queue] extra data after payload > > > On Saturday 2011-09-24 10:08, U.Mutlu wrote: > >>> for example: > >>> rv = recv(fd, buf, sizeof(buf), 0); // rv=84 > >>> ... > >>> ret = nfq_get_payload(tb,&data); // ret=40 (ie. ip + tcp pkt, both > >>> w/o > >>> options, and tcp w/o user data) > >>> > >>> So, here, what are the extra 44 bytes after the tcp data? > >> > >> I believe you will find there is a struct nlmsghdr at the beginning of the > >> data, before the IP header > > > > nlmsghdr has size 16, I've not figured out yet what comes after it before > the > > (optional) payload starts. > > (It's struct nlmsghdr, struct nfgenmsg, struct nfqnl_msg_packet_hdr.) > > Suffice to say that, what buf actually contains is implementation-defined, and > "uninteresting", since you chose to use a library to deal with it for you, > abstracting the whole thing. Well, not necessarily "uninteresting". Some people like to understand how something they are using works. Plus, if you don't know how big these headers are, you can you know how big a buffer you need to read the message off of the socket into without truncating the IP packet at the end? The sample code at http://www.netfilter.org/projects/libnetfilter_queue/doxygen/group__Queu e.html shows a call to recv() made into an undeclared variable named "buf" with the amount of data to be read specified as "sizeof(buf)". I don't see anything in the API to call to tell the user this and I haven't seen it in the documentation either, though perhaps I've missed it. Thanks, Jeff Haran -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
