# iptables -A OUTPUT -m owner --uid-owner 1000 -j CONNMARK --set-mark 1 # iptables -A INPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 # iptables -A OUTPUT -m connmark --mark 1 -j NFLOG --nflog-group 30 # dumpcap -i nflog:30 -w uid-1000.pcap
我还没有找到任何关于它如何工作的文档(特别是,netfilter.org有很多编写得很糟糕的库API文档,据我所知,在实际内核级别的语义上没有任何内容防火墙规则),所以我有几个问题：
>有没有该死的文件,它隐藏在哪里？
> CONNMARK真的有必要吗？那就是,这项工作也一样吗？
# iptables -A INPUT -m owner --uid-owner 1000 -j NFLOG --nflog-group 30 # iptables -A OUTPUT -m owner --uid-owner 1000 -j NFLOG --nflog-group 30
>是否有必要运行“ulogd”才能运行？
>有没有办法告诉内核为我选择一个未分配的组号并告诉我它是什么？
>有没有办法告诉内核,当进程X终止时,应该自动删除这些过滤规则？ (进程X不会作为uid 1000运行.)
>据推测,iptables命令可以进行一些特殊的ioctl调用或配置防火墙.是否有一个C库可用于在程序中执行相同的操作(即Q4中的“进程X”)？
解决方法
Is there any damn documentation and where is it hiding?
netfilter网站上有一些例子可以帮助解释这些功能.这是我在自己的代码中编写的一个函数,用于设置netfilter NFLOG.
以下是他们提供的示例：http://www.netfilter.org/projects/libnetfilter_log/doxygen/files.html
void setup_netlogger_loop(
int groupnum,queue_t queue)
{
int sz;
int fd = -1;
char buf[BUFSZ];
/* Setup handle */
struct nflog_handle *handle = NULL;
struct nflog_g_handle *group = NULL;
memset(buf,sizeof(buf));
/* This opens the relevent netlink socket of the relevent type */
if ((handle = nflog_open()) == NULL){
sd_journal_perror("Could not get netlink handle");
exit(EX_OSERR);
}
/* We tell the kernel that we want ipv4 tables not ipv6 */
if (nflog_bind_pf(handle,AF_INET) < 0) {
sd_journal_perror("Could not bind netlink handle");
exit(EX_OSERR);
}
/* Setup groups,this binds to the group specified */
if ((group = nflog_bind_group(handle,groupnum)) == NULL) {
sd_journal_perror("Could not bind to group");
exit(EX_OSERR);
}
if (nflog_set_mode(group,NFULNL_COPY_PACKET,0xffff) < 0) {
sd_journal_perror("Could not set group mode");
exit(EX_OSERR);
}
if (nflog_set_nlbufsiz(group,BUFSZ) < 0) {
sd_journal_perror("Could not set group buffer size");
exit(EX_OSERR);
}
if (nflog_set_timeout(group,1500) < 0) {
sd_journal_perror("Could not set the group timeout");
}
/* Register the callback */
nflog_callback_register(group,&queue_push,(void *)queue);
/* Get the actual FD for the netlogger entry */
fd = nflog_fd(handle);
/* We continually read from the loop and push the contents into
nflog_handle_packet (which seperates one entry from the other),which will eventually invoke our callback (queue_push) */
for (;;) {
sz = recv(fd,buf,BUFSZ,0);
if (sz < 0 && errno == EINTR)
continue;
else if (sz < 0)
break;
nflog_handle_packet(handle,sz);
}
}
Is the CONNMARK thing actually necessary? That is,would this work just as well?
这是不必要的.
Is it necessary to have “ulogd” running for this to work?
不 – 实际上我不在这个应用程序中使用它.
Is there a way to tell the kernel to pick an unallocated group number for me and tell me what it is?
不是我知道的.在任何情况下,如果您为HTTP设置了NFLOG目标,一个用于记录丢弃的FTP数据包,另一个用于扫描SMTP字符串,则无用.
在这种情况下,您无法确定哪个规则绑定到哪个组,从而应该监听哪个组.
Is there a way to tell the kernel that these filter rules should be automatically deleted when process X terminates? (Process X would not be running as uid 1000.)
不,但内核只填充最大大小的缓冲区然后将丢弃数据.在使用过多内存而没有收听规则方面,它不会对性能产生影响.
Presumably the iptables command makes some special ioctl calls or something to configure the firewall. Is there a C library that can be used to do the same from within a program (namely,“process X” from Q4)?
我所知道的netfilter库没有帮助你操纵规则.但是有一个内部驱动的库可供使用.
IPtables继承了一种与用户空间对话的相当陈旧的方法 – 你打开一个SOCK_RAW IP套接字与它进行通信.这完全将被删除(因为它没有意义)与nftables将通过netlink说话做同样的事情.
