@@ -989,17 +989,9 @@ static int __set_verdict(struct nfq_q_handle *qh, uint32_t id,
{
char buf[MNL_SOCKET_BUFFER_SIZE];
struct nlmsghdr *nlh;
+ static struct sockaddr_nl snl = {.nl_family = AF_NETLINK };
- struct iovec iov[3];
- int nvecs;
-
- /* This must be declared here (and not inside the data
- * handling block) because the iovec points to this. */
- struct nlattr data_attr;
-
- memset(iov, 0, sizeof(iov));
-
- nlh = nfq_nlmsg_put(buf, NFQNL_MSG_VERDICT, qh->id);
+ nlh = nfq_nlmsg_put(buf, type, qh->id);
/* add verdict header */
nfq_nlmsg_verdict_put(nlh, id, verdict);
@@ -1013,26 +1005,38 @@ static int __set_verdict(struct nfq_q_handle *qh, uint32_t id,
*/
if (!data_len)
return mnl_socket_sendto(qh->h->nl, nlh, nlh->nlmsg_len);
+ {
+ struct iovec iov[2];
+ struct nlattr *data_attr = mnl_nlmsg_get_payload_tail(nlh);
+ const struct msghdr msg = {
+ .msg_name = &snl,
+ .msg_namelen = sizeof(snl),
+ .msg_iov = iov,
+ .msg_iovlen = 2,
+ .msg_control = NULL,
+ .msg_controllen = 0,
+ .msg_flags = 0,
+ };
+
+ mnl_attr_put(nlh, NFQA_PAYLOAD, 0, NULL);
+
+ iov[0].iov_base = nlh;
+ iov[0].iov_len = nlh->nlmsg_len;
+ /* The typecast here is to cast away data's const-ness: */
+ iov[1].iov_base = (unsigned char *)data;
+ iov[1].iov_len = data_len;
- iov[0].iov_base = nlh;
- iov[0].iov_len = NLMSG_TAIL(nlh) - (void *)nlh;
- nvecs = 1;
-
- if (data_len) {
- /* Temporary cast until we get rid of nfnl_build_nfa_iovec() */
- nfnl_build_nfa_iovec(&iov[1], (struct nfattr *)&data_attr,
- //nfnl_build_nfa_iovec(&iov[1], &data_attr,
- NFQA_PAYLOAD, data_len,
- (unsigned char *) data);
- nvecs += 2;
/* Add the length of the appended data to the message
- * header. The size of the attribute is given in the
- * nla_len field and is set in the nfnl_build_nfa_iovec()
- * function. */
- nlh->nlmsg_len += data_attr.nla_len;
- }
+ * header and attribute length.
+ * No padding is needed: this is the end of the message.
+ */
+
+ nlh->nlmsg_len += data_len;
- return nfnl_sendiov(qh->h->nfnlh, iov, nvecs, 0);
+ data_attr->nla_len += data_len;
+
+ return sendmsg(qh->h->nfnlh->fd, &msg, 0);
+ }
}
/**
@@ -1121,7 +1125,7 @@ EXPORT_SYMBOL
int nfq_set_verdict_batch2(struct nfq_q_handle *qh, uint32_t id,
uint32_t verdict, uint32_t mark)
{
- return __set_verdict(qh, id, verdict, htonl(mark), 1, 0,
+ return __set_verdict(qh, id, verdict, mark, 1, 0,
NULL, NFQNL_MSG_VERDICT_BATCH);
}
@@ -1144,7 +1148,7 @@ int nfq_set_verdict_mark(struct nfq_q_handle *qh, uint32_t id,
uint32_t verdict, uint32_t mark,
uint32_t data_len, const unsigned char *buf)
{
- return __set_verdict(qh, id, verdict, mark, 1, data_len, buf,
+ return __set_verdict(qh, id, verdict, ntohl(mark), 1, data_len, buf,
NFQNL_MSG_VERDICT);
}
@@ -1212,7 +1216,6 @@ uint32_t nfq_get_nfmark(struct nfq_data *nfad)
return 0;
return ntohl(mnl_attr_get_u32(nfad->data[NFQA_MARK]));
- return ntohl(nfnl_get_data(nfad->data, NFQA_MARK, uint32_t));
}
/**
@@ -1476,10 +1479,10 @@ struct nfqnl_msg_packet_hw *nfq_get_packet_hw(struct nfq_data *nfad)
EXPORT_SYMBOL
uint32_t nfq_get_skbinfo(struct nfq_data *nfad)
{
- if (!nfnl_attr_present(nfad->data, NFQA_SKB_INFO))
+ if (!nfad->data[NFQA_SKB_INFO])
return 0;
- return ntohl(nfnl_get_data(nfad->data, NFQA_SKB_INFO, uint32_t));
+ return ntohl(mnl_attr_get_u32(nfad->data[NFQA_SKB_INFO]));
}
/**
Converted: nfq_set_verdict2(), nfq_set_verdict_batch2(), nfq_set_verdict_mark(), nfq_get_nfmark() [again] & nfq_get_skbinfo() We only use 2 iovecs instead of 3 by tacking the data attribute onto the end of the first iovec buffer. Signed-off-by: Duncan Roe <duncan_roe@optusnet.com.au> --- Changes in v2: - Move nfq_set_mode() conversion to patch 5 - Rebase to account for updated patches src/libnetfilter_queue.c | 67 +++++++++++++++++++++------------------- 1 file changed, 35 insertions(+), 32 deletions(-)