Re: Implementation of Ebtables target similar to QUEUE

Op vr, 28-09-2007 te 21:21 +0100, schreef Abhinav Srivastava:
> Hi there,
> 
> I have questions regarding the extension of ebtables
> code to support target similar to QUEUE target. In my
> project, I have a requirement of intercepting packets
> inside ebtables and pass some information related to
> packet to userspace tool. Ebtables code should wait to
> receive reply from userspace tool and then drop or
> accept packet. Since, ebtables code run in the context
> of interrupt's bottom half, I cannot wait inside that
> code path.
> 
> To avoid that problem, I would like to create queues
> inside ebtables so that I could put that packet into
> the queue and start processing the next packet. I can
> have other design where I send packets to userspace
> and let userspace tool handle the packets. But, I do
> not want to cross the user-kernel boundary for each
> packet.
> 
> I need help in order to achieve my first design:
> 
> 1) Is my requirement very complex? Can it be achieved
> easily?
> 
> 2) What are the parts of ebtables code i should
> change?
> 
> 3) In case, userspace tool says accept the packet. How
> I would implement the fucntionality of getting old
> packets from queue and send them out of the network or
> for incoming packets send to higher level protocols?
> 
> 4) Is there any effective way for creating queues
> inside ebtables?
> 
> I would really appreciate any help or suggestions in
> this regard?

You need something similar to the QUEUE target in iptables.
In net/netfilter/core.c::nf_hook_slow() nf_queue() is called if the
target is queue.
That function is in net/netfilter/nf_queue.c and __nf_queue() will call
the family specific queue function. For IPv4 this is
net/ipv4/netfilter/ip_queue.c::ipq_enqueue_packet() which is registered
in net/ipv4/netfilter/ip_queue.c::ip_queue_init().
You will need to make code similar to that in
net/ipv4/netfilter/ip_queue.c for PF_BRIDGE instead of PF_INET (put it
in net/bridge/netfilter). Hope this helps...

Good luck,
Bart



-------------------------------------------------------------------------
This SF.net email is sponsored by: Splunk Inc.
Still grepping through log files to find problems?  Stop.
Now Search log events and configuration files using AJAX and a browser.
Download your FREE copy of Splunk now >> http://get.splunk.com/