Re: Firewall netlink question...

[Daniel Stone]

On 22 Jan 2001 10:26:00 +0000, Scaramanga wrote:
> Looking at the code it seemed to do the same thing as the old netlink, but
> with more complexity, to what end though, i couldnt tell, was only a brief
> skim.

So you can do whatever you want with it.

> > $ sed -n -e '1874,1876p' /usr/src/linux-2.4.0/Documentation/Configure.help
> > CONFIG_IP_NF_QUEUE
> >   Netfilter has the ability to queue packets to user space: the
> >   netlink device can be used to access them using this driver.
> > 
> > $ lynx /usr/share/doc/iptables/html/packet-filtering-HOWTO-7.html
> > 
> 
> Yeah, after some quick googling and freshmeating, i came accross a daemon
> that picked up these QUEUEd packets and multiplexed them to various child
> processes, which seemed very innefcient, the documentation said something
> about QUEUE not being multicast in nature, like the old firewall netlink.

This is true. This is called ipqmpd or something similar and written by
Harald Welte, yes?
Your best option is to either check out libipq (can be found in the
directory of the same name in the iptables sources), which provides
clean C interfaces, or the PERL interface, available from
http://www.intercode.com.au/jamesm/

> What was wrong with the firewall netlink? My re-implementation works great
> here. I can't see why anything else would be needed, QUEUE seems twice as
> complex. Unless with QUEUE the userspce applications can make decisions on
> what to do with the packet? In which case, it would be far too inefficient
> for an application like mine, where all i need is to be able to read the
> IP datagrams..

It can modify and then reinject the packet if it so wishes.

> Am I missing something totally obvious?

It just does more stuff. A plane is far more complex than a car, but
with an added feature - it also flies above the ground.

> Regards

-- 
Daniel Stone
Linux Kernel Developer
[e-mail]

-----BEGIN GEEK CODE BLOCK-----
Version: 3.1
G!>CS d s++:- a---- C++ ULS++++$>B P---- L+++>++++ E+(joe)>+++ W++ N->++ !o
K? w++(--) O---- M- V-- PS+++ PE- Y PGP>++ t--- 5-- X- R- tv-(!) b+++ DI+++ 
D+ G e->++ h!(+) r+(%) y? UF++
------END GEEK CODE BLOCK------