libnetfilter_queue large packets problem
gregor at net.in.tum.de
Thu Feb 23 23:44:24 CET 2006
-----BEGIN PGP SIGNED MESSAGE-----
I think I encountered a problem when using libnetfilter_queue with
packets larger than the recv buffer specified when recv()-ing from the
socket of the queue.
The kernel truncates(*) the packet delivered to userspace an thus
nfnl_handle_packet() returns -1 (**), since there's a mismatch between
the length of the buffer and the recorded length in struct nlmsghdr.
This means that the callback function is never called an therefore we
are never able to issue a verdict for the packet and the packet is stuck
I think the best solution would be, if the callback would be called and
informed about the truncation, so that the callback can deside about the
fate of the packet.
A workaround is to make the buffer large enough for any possible packet
(i.e. 65535 + x for IP, with x being the number of bytes occupied by the
netlink data structures)
This is almost certainly the cause of bug
(*) when I use recvmsg then the MSG_TRUNC flag is set for such packets
and peek in the netlink code asserted this.
(**)if (nlh->nlmsg_len < sizeof(struct nlmsghdr)
|| len < nlh->nlmsg_len)
Gregor Maier Lehrstuhl Informatik 8
gregor at net.in.tum.de Tel: +49 89 289-18010
http://www.net.in.tum.de TU Muenchen
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (Darwin)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
-----END PGP SIGNATURE-----
More information about the netfilter-devel