nfq_verd(3)

📦
version 1.0.5 · 5 versions
, in ubuntu noble, ubuntu questing

💖 nfq_verd — Verdict helpers 💖

okay bestie, sit DOWN, because this is the page about handing verdicts back to the kernel, and it's genuinely iconic. the manual name is nfq_verd (it lives in section 3, the library functions one, iykyk), and it's all about three little helpers that stuff a verdict, a mark, or a whole new packet body into a netlink message. no cap.

✨ SYNOPSIS ✨

Functions 🫶

void nfq_nlmsg_verdict_put (struct nlmsghdr *nlh, int id, int verdict)
void nfq_nlmsg_verdict_put_mark (struct nlmsghdr *nlh, uint32_t mark)
void nfq_nlmsg_verdict_put_pkt (struct nlmsghdr *nlh, const void *pkt,
    uint32_t plen)

🌸 Detailed Description 🌸

that's it, that's the whole section, the vibes carry the rest. scroll down for the real tea 💅

👑 Function Documentation 👑

💫 void nfq_nlmsg_verdict_put (struct nlmsghdr * nlh, int id, int verdict)

nfq_nlmsg_verdict_put — put a verdict into a Netlink message. literally the moment of decision for a packet's whole life, slay.

Parameters 🎀

  • nlh — pointer to the netlink message
  • id — the ID that netfilter assigned to this packet
  • verdict — the verdict you're returning to netfilter (see Verdicts below, bestie, it's a whole menu)

🌈 Verdicts 🌈

  • NF_DROP — drop the packet. this one is final. no take-backs, no sequel, it's over 💀
  • NF_ACCEPT — accept the packet. processing of the current base chain and any called chains terminates, but heads up: the packet may still get processed by subsequently invoked base chains. so it's not a full goodbye, more like a "see you in the next chain" 🦋
  • NF_STOP — like NF_ACCEPT, but it skips any further base chains using the current hook. same energy, shorter guest list.
  • NF_REPEAT — like NF_ACCEPT, but it re-queues this packet to the current base chain. and girl, watch out for the loop: one way to prevent a re-queueing loop is to also set a packet mark using nfq_nlmsg_verdict_put_mark() and have the program test for this mark in attr[NFQA_MARK]; or have the nefilter rules do this test. pick your fighter.
  • NF_QUEUE_NR(new_queue) — like NF_ACCEPT, but queue this packet to queue number new_queue. as with the command-line queue num verdict, if no process is listening to that queue then the packet is discarded; but again like with the command-line, one may OR in a flag to bypass new_queue if there is no listener, as in this snippet:
nfq_nlmsg_verdict_put(nlh, id, NF_QUEUE_NR(new_queue) |
        NF_VERDICT_FLAG_QUEUE_BYPASS);
real talk: go look at examples/nf-queue.c, line 46 for an example of how to use this function in context. the calling sequence is main --> mnl_cb_run --> queue_cb --> nfq_send_verdict --> nfq_nlmsg_verdict_put (cb being short for callback). that's the whole relay race 💅

Definition at line 72 of file nlmsg.c.

💫 void nfq_nlmsg_verdict_put_mark (struct nlmsghdr * nlh, uint32_t mark)

nfq_nlmsg_verdict_put_mark — put a packet mark into a netlink message. tagging your packet so future-you can recognise it ✨

Parameters 🎀

  • nlh — pointer to netlink message
  • mark — value of mark to put

the mark becomes part of the packet's metadata, and may be tested by the nft primary expression meta mark. cute little sticky note on the packet, honestly 🍓

🦋 See also 🦋

  • nft(1)

Definition at line 91 of file nlmsg.c.

💫 void nfq_nlmsg_verdict_put_pkt (struct nlmsghdr * nlh, const void * pkt, uint32_t plen)

nfq_nlmsg_verdict_put_pkt — put replacement packet content into a netlink message. this is the glow-up function, we're sending a whole new packet body back 🔥

Parameters 🎀

  • nlh — pointer to netlink message
  • pkt — pointer to start of modified IP datagram
  • plen — length of modified IP datagram

there is only ever a need to return packet content if it has been modified. usually one of the nfq_*_mangle_* functions does the modifying. so if you didn't touch it, don't send it back, bestie 🙈

this code snippet uses nfq_udp_mangle_ipv4. see nf-queue.c for context:

// main calls queue_cb (line 64) to process an enqueued packet:
        // Extra variables
        uint8_t *payload, *rep_data;
        unsigned int match_offset, match_len, rep_len;

        // The next line was commented-out (with payload void*)
        payload = mnl_attr_get_payload(attr[NFQA_PAYLOAD]);
        // Copy data to a packet buffer (allow 255 bytes for mangling).
        pktb = pktb_alloc(AF_INET, payload, plen, 255);
        // (decide that this packet needs mangling)
        nfq_udp_mangle_ipv4(pktb, match_offset, match_len, rep_data, rep_len);
        // nfq_udp_mangle_ipv4 updates packet length, no need to track locally

        // Eventually nfq_send_verdict (line 39) gets called
        // The received packet may or may not have been modified.
        // Add this code before nfq_nlmsg_verdict_put call:
        if (pktb_mangled(pktb))
                nfq_nlmsg_verdict_put_pkt(nlh, pktb_data(pktb), pktb_len(pktb));

Definition at line 130 of file nlmsg.c.

🧚 Author 🧚

generated automatically by Doxygen for libnetfilter_queue from the source code. not a human, not a girlie, just a doc generator doing its best 💜

okay that's the whole page, you ate it, periodt 🎀 this was libnetfilter_queue Version 1.0.5, page nfq_verd(3), and it's giving "I read the manpage and now I understand verdicts" main character energy. go queue something 💖✨

📦 where this page comes from