通過原始套接字發送標記包

Question

我有以下通過原始套接字發送包的功能。

#include <unistd.h> 
#include <stdio.h> 
#include <sys/socket.h> 
#include <netinet/ip.h> 
#include <netinet/udp.h> 

#include "pkt-types.h" 
#include "pkt-log.h" 
#include "pkt-utils.h" 

int 
send_packet_raw (void *data, int size) 
{ 
    log_message (LOG_DEBUG, " inside send_packet_raw"); 
    int sd; 
    struct iphdr *iph = (struct iphdr *) data; 
    struct udphdr *udph = (struct udphdr *) (data + sizeof (struct ip)); 
    struct sockaddr_in sin; 
    // needed for notify kernel to not to build header for this 
    int one = 1; 
    const int *val = &one; 
    // creating a socket 
    if ((sd = socket (PF_INET, SOCK_RAW, IPPROTO_UDP)) < 0) 
    { 
     log_message (LOG_ERROR, " problem creating a socket"); 
     return EXITCODE_SOCK_CREATION_FAILED; 
    } 
    // setting address family 
    sin.sin_family = AF_INET; 
    // setting port 
    sin.sin_port = udph->dest; 
    // setting ip 
    sin.sin_addr.s_addr = iph->daddr; 
    // notifying kernel do not fill up the packet structure. 
    if (setsockopt (sd, IPPROTO_IP, IP_HDRINCL, val, sizeof (one)) < 0) 
    { 
     log_message (LOG_ERROR, "error notifying kernel about raw socket"); 
     return EXITCODE_SOCK_KERN_NOTIF_FAILED; 
    } 
    /* setting socket option to use MARK value */ 
    if (setsockopt (sd, SOL_SOCKET, SO_MARK, val, sizeof (one)) < 0) 
    { 
    log_message (LOG_ERROR, "error notifying kernel about MARK"); 
    return EXITCODE_SOCK_MARK_FAILED; 
    } 
    #ifdef CHECKSUM 
    /* compute checksum */ 
    udph->check = udp_checksum (data + IP_OFFSET, size - IP_OFFSET, iph->saddr, iph->daddr); 
    /* testing purposed */ 
    #else 
    udph->check = 0x00; 
    #endif 
    /* dscp 101000 means express forwarding */ 
    if (sendto (sd,    /* our socket */ 
       data,    /* data to send */ 
       size,  /* total length of our ip packet */ 
       0,    /* routing flag, normally always zero */ 
       (struct sockaddr *) &sin, /* socket addr */ 
       sizeof (sin)) < 0) 
    { 
     log_message (LOG_ERROR, "sending over raw socket failed"); 
     return EXITCODE_SOCK_SEND_FAILED; 
    } 
    else 
    { 
    /* shutdown the socket */ 
    if(shutdown (sd, 2)) /* shutdown ok */ 
     return EXITCODE_OK; 
    } 
} 

現在我從libnetfilter_queue設置從nfq_set_verdict2（）標誌：http://www.netfilter.org/projects/libnetfilter_queue/doxygen/group__Queue.html

int nfq_set_verdict2 ( struct nfq_q_handle * qh, 
u_int32_t id, 
u_int32_t verdict, 
u_int32_t mark, 
u_int32_t data_len, 
const unsigned char * buf 
)   
nfq_set_verdict2 - like nfq_set_verdict, but you can set the mark. 

Parameters: 
qh Netfilter queue handle obtained by call to nfq_create_queue(). 
id ID assigned to packet by netfilter. 
verdict  verdict to return to netfilter (NF_ACCEPT, NF_DROP) 
mark mark to put on packet 
data_len number of bytes of data pointed to by buf 
buf  the buffer that contains the packet data 

當我從netfilter_queue接收數據包我做了什麼以下：

nfq_set_verdict(..,NF_DROP,MARK,...); 
process_packet(); 

這process_packet（ ）調用send_packet_raw（）。

相關iptable的規則：

$iptables -t mangle -A PREROUTING -m mark --mark 0xa -j ACCEPT 
$iptables -t mangle -A PREROUTING -p udp --dport $PORT -j NFQUEUE 
$iptables -t mangle -A OUTPUT -m mark --mark 0xa -j ACCEPT 
$iptables -t mangle -A OUTPUT -p udp --sport $PORT -j NFQUEUE 

我也提出了一些-j LOG規則，看看分組在-實際上匹配。但是由於看起來沒有數據包發送或進入，因爲沒有顯示日誌條目。無法理解如何在這裏找到問題。

Answer 1

並不完全知道問題是什麼，但

nfq_set_verdict(..,NF_DROP,MARK,...); 
process_packet(); 

很糟糕。在處理數據包之前，我不會調用NF_DROP 。 我寫了幾個隧道程序，我首先處理這個數據包，把它放到我的緩衝區中，問題是一個NF_DROP。在此之後，我可以使用原始套接字從緩衝區重新發出數據包。所以：

process_packet();  
nfq_set_verdict(..,NF_DROP,MARK,...); 

會更好。至少在發佈判決前複製數據包數據。