IPQ_MESSAGE_TYPE(3)

💅 ipq_message_type(3) — like, the whole query-queue-message situation

okay bestie, welcome to ipq_message_type(3), from the Linux Programmer's Manual ✨ this is the page that explains how you actually look at messages that come back out of the netfilter queue, and honestly it's not that deep once you see it. let's go 🫶

---

🌸 NAME 🌸

ipq_message_type, ipq_get_packet, ipq_getmsgerr — the three little functions that help you query queue messages 💌

---

✨ SYNOPSIS ✨

#include <linux/netfilter.h>
#include <libipq.h>

int ipq_message_type(const unsigned char *buf);
ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf);
int ipq_get_msgerr(const unsigned char *buf);

---

🦋 DESCRIPTION 🦋

so. the ipq_message_type function returns the type of queue message that got handed back to userspace via ipq_read. that's it, that's the whole job, iconic behavior fr 💅

you should always call ipq_message_type right after a successful call to ipq_read, because that's how you find out whether what you just got is a packet message or an error message. the buf parameter should be the same data you got from that previous ipq_read call — don't be out here passing random buffers, bestie 😭

ipq_message_type will return one of these values:

• NLMSG_ERROR — an error message that the Netlink transport generated. it's giving "something went wrong in the plumbing" energy 💀
• IPQM_PACKET — a packet message, containing packet metadata plus optional packet payload data. the main character of the two ngl 👑

---

🎀 ipq_get_packet — for when you got a packet 👑

call ipq_get_packet if ipq_message_type returned IPQM_PACKET. the buf parameter should point to the same data you used for the ipq_message_type call. the pointer it hands back points to a packet message, which is declared like this:

typedef struct ipq_packet_msg {
     unsigned long packet_id;        /* ID of queued packet */
     unsigned long mark;             /* Netfilter mark value */
     long timestamp_sec;             /* Packet arrival time (seconds) */
     long timestamp_usec;            /* Packet arrvial time (+useconds) */
     unsigned int hook;              /* Netfilter hook we rode in on */
     char indev_name[IFNAMSIZ];      /* Name of incoming interface */
     char outdev_name[IFNAMSIZ];     /* Name of outgoing interface */
     unsigned short hw_protocol;     /* Hardware protocol (network order) */
     unsigned short hw_type;         /* Hardware type */
     unsigned char hw_addrlen;       /* Hardware address length */
     unsigned char hw_addr[8];       /* Hardware address */
     size_t data_len;                /* Length of packet data */
     unsigned char payload[0];       /* Optional packet data */
} ipq_packet_msg_t;

(yes, the comment on timestamp_usec really does say "arrvial" in the original and I'm not fixing it, it's part of the lore 💀)

every single one of these fields may be read by the application — go off, read them all 🎀

if the queue mode is IPQ_COPY_PACKET and the data_len value is greater than zero, then the packet payload contents may be accessed in the memory that follows the ipq_packet_msg_t structure, out to a range of data_len. that's your sneaky peek at the actual payload data ✨

the packet_id field contains a packet identifier — the one you use when you call ipq_set_verdict. so like, do not lose it, it's your ticket to actually answering the kernel 🫶

---

🌈 ipq_get_msgerr — for when you got an error 😭

call ipq_get_msgerr if ipq_message_type returned NLMSG_ERROR. again, the buf parameter should point to the same data used for the call to ipq_message_type.

the value returned by ipq_get_msgerr is set by higher level kernel code, and it corresponds to standard errno values. so it's not a mystery number, it's just an errno wearing a little costume 🧚

---

💀 BUGS 💀

none known ✨ (yes, that's the whole section. we love a bug-free era. no cap.)

---

👑 AUTHOR 👑

James Morris <jmorris@intercode.com.au> — respect the icon 🫶

---

💖 COPYRIGHT 💖

Copyright (c) 2000-2001 Netfilter Core Team.

distributed under the GNU General Public License. periodt 💅

---

⭐ SEE ALSO ⭐

• iptables(8)
• libipq(3)

---

and that's the page, bestie 🌈 it's Linux iptables 1.2, dated 16 October 2001 — yeah she's a vintage, and she still slays 💅✨