bol-van/zapret
1
1
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2024-12-19 22:41:34 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

nfqws: fix nfq recv result and error handling

Browse Source
This commit is contained in:
bol-van 2024-12-07 20:51:29 +03:00
parent 4e5caf4087
commit c802069a11
1 changed files with 58 additions and 33 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

91
nfq/nfqws.c
View File

@ -152,50 +152,62 @@ static int nfq_cb(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg, struct nfq_da
DLOG("packet: id=%d pass unmodified\n", id); DLOG("packet: id=%d pass unmodified\n", id);
return nfq_set_verdict2(qh, id, NF_ACCEPT, mark, 0, NULL); return nfq_set_verdict2(qh, id, NF_ACCEPT, mark, 0, NULL);
} }
static int nfq_main(void) bool nfq_deinit(struct nfq_handle **h,struct nfq_q_handle **qh)
{ {
struct nfq_handle *h = NULL; if (*qh)
struct nfq_q_handle *qh = NULL; {
int fd,rv; DLOG_CONDUP("unbinding from queue %u\n", params.qnum);
uint8_t buf[16384] __attribute__((aligned)); nfq_destroy_queue(*qh);
*qh = NULL;
}
if (*h)
{
DLOG_CONDUP("closing library handle\n");
nfq_close(*h);
*h = NULL;
}
}
bool nfq_init(struct nfq_handle **h,struct nfq_q_handle **qh)
{
nfq_deinit(h,qh);
DLOG_CONDUP("opening library handle\n"); DLOG_CONDUP("opening library handle\n");
h = nfq_open(); *h = nfq_open();
if (!h) { if (!*h) {
DLOG_PERROR("nfq_open()"); DLOG_PERROR("nfq_open()");
goto exiterr; goto exiterr;
} }
DLOG_CONDUP("unbinding existing nf_queue handler for AF_INET (if any)\n"); DLOG_CONDUP("unbinding existing nf_queue handler for AF_INET (if any)\n");
if (nfq_unbind_pf(h, AF_INET) < 0) { if (nfq_unbind_pf(*h, AF_INET) < 0) {
DLOG_PERROR("nfq_unbind_pf()"); DLOG_PERROR("nfq_unbind_pf()");
goto exiterr; goto exiterr;
} }
DLOG_CONDUP("binding nfnetlink_queue as nf_queue handler for AF_INET\n"); DLOG_CONDUP("binding nfnetlink_queue as nf_queue handler for AF_INET\n");
if (nfq_bind_pf(h, AF_INET) < 0) { if (nfq_bind_pf(*h, AF_INET) < 0) {
DLOG_PERROR("nfq_bind_pf()"); DLOG_PERROR("nfq_bind_pf()");
goto exiterr; goto exiterr;
} }
DLOG_CONDUP("binding this socket to queue '%u'\n", params.qnum); DLOG_CONDUP("binding this socket to queue '%u'\n", params.qnum);
qh = nfq_create_queue(h, params.qnum, &nfq_cb, &params); *qh = nfq_create_queue(*h, params.qnum, &nfq_cb, &params);
if (!qh) { if (!qh) {
DLOG_PERROR("nfq_create_queue()"); DLOG_PERROR("nfq_create_queue()");
goto exiterr; goto exiterr;
} }
DLOG_CONDUP("setting copy_packet mode\n"); DLOG_CONDUP("setting copy_packet mode\n");
if (nfq_set_mode(qh, NFQNL_COPY_PACKET, 0xffff) < 0) { if (nfq_set_mode(*qh, NFQNL_COPY_PACKET, 0xffff) < 0) {
DLOG_PERROR("can't set packet_copy mode"); DLOG_PERROR("can't set packet_copy mode");
goto exiterr; goto exiterr;
} }
if (nfq_set_queue_maxlen(qh, Q_MAXLEN) < 0) { if (nfq_set_queue_maxlen(*qh, Q_MAXLEN) < 0) {
DLOG_PERROR("can't set queue maxlen"); DLOG_PERROR("can't set queue maxlen");
goto exiterr; goto exiterr;
} }
// accept packets if they cant be handled // accept packets if they cant be handled
if (nfq_set_queue_flags(qh, NFQA_CFG_F_FAIL_OPEN , NFQA_CFG_F_FAIL_OPEN)) if (nfq_set_queue_flags(*qh, NFQA_CFG_F_FAIL_OPEN , NFQA_CFG_F_FAIL_OPEN))
{ {
DLOG_ERR("can't set queue flags. its OK on linux <3.6\n"); DLOG_ERR("can't set queue flags. its OK on linux <3.6\n");
// dot not fail. not supported on old linuxes <3.6 // dot not fail. not supported on old linuxes <3.6
@ -205,6 +217,25 @@ static int nfq_main(void)
if (!rawsend_preinit(params.bind_fix4,params.bind_fix6)) if (!rawsend_preinit(params.bind_fix4,params.bind_fix6))
goto exiterr; goto exiterr;
// increase socket buffer size. on slow systems reloading hostlist can take a while.
// if too many unhandled packets are received its possible to get "no buffer space available" error
if (!set_socket_buffers(nfq_fd(*h),Q_RCVBUF/2,Q_SNDBUF/2))
goto exiterr;
return true;
exiterr:
nfq_deinit(h,qh);
return false;
}
static int nfq_main(void)
{
uint8_t buf[16384] __attribute__((aligned));
struct nfq_handle *h = NULL;
struct nfq_q_handle *qh = NULL;
int fd,e;
ssize_t rd;
#ifndef __CYGWIN__ #ifndef __CYGWIN__
sec_harden(); sec_harden();
@ -216,36 +247,30 @@ static int nfq_main(void)
pre_desync(); pre_desync();
fd = nfq_fd(h); nfq_init(&h,&qh);
// increase socket buffer size. on slow systems reloading hostlist can take a while. fd = nfq_fd(h);
// if too many unhandled packets are received its possible to get "no buffer space available" error
if (!set_socket_buffers(fd,Q_RCVBUF/2,Q_SNDBUF/2))
goto exiterr;
do do
{ {
while ((rv = recv(fd, buf, sizeof(buf), 0)) > 0) while ((rd = recv(fd, buf, sizeof(buf), 0)) >= 0)
{ {
int r = nfq_handle_packet(h, (char *)buf, rv); if (rd)
if (r) DLOG_ERR("nfq_handle_packet error %d\n", r); {
int r = nfq_handle_packet(h, (char *)buf, (int)rd);
if (r) DLOG_ERR("nfq_handle_packet error %d\n", r);
}
else
DLOG("recv from nfq returned 0 !\n");
} }
DLOG_ERR("recv: errno %d\n",errno); e=errno;
DLOG_ERR("recv: recv=%zd errno %d\n",rd,e);
errno=e;
DLOG_PERROR("recv"); DLOG_PERROR("recv");
// do not fail on ENOBUFS // do not fail on ENOBUFS
} while(errno==ENOBUFS); } while(errno==ENOBUFS);
DLOG_CONDUP("unbinding from queue %u\n", params.qnum); nfq_deinit(&h,&qh);
nfq_destroy_queue(qh);
#ifdef INSANE
/* normally, applications SHOULD NOT issue this command, since
* it detaches other programs/sockets from AF_INET, too ! */
DLOG_CONDUP("unbinding from AF_INET\n");
nfq_unbind_pf(h, AF_INET);
#endif
DLOG_CONDUP("closing library handle\n");
nfq_close(h);
return 0; return 0;
exiterr: exiterr: