Netfilter NFQUEUE high-level bindings
C CMake C++ Makefile
Latest commit 43fba72 Jul 23, 2016 @chifflier Prepare release 0.6
Permalink
Failed to load latest commit information.
examples Remove the 'dummy' argument for the Perl bindings Jul 23, 2016
perl Remove the 'dummy' argument for the Perl bindings Jul 23, 2016
python Give ownership of created object to swig (related to #2) Jul 23, 2016
.travis.yml Tell Travis to use the default Makefile (and cmake instead of configure) Jul 23, 2016
AUTHORS Add License (GPLv3) and notes May 27, 2008
CMakeLists.txt Prepare release 0.6 Jul 23, 2016
COPYING Add License (GPLv3) and notes May 27, 2008
ChangeLog Prepare release 0.6 Jul 23, 2016
INSTALL Add notes on set_queue_maxlen requiring a kernel >= 2.6.20 Jan 24, 2009
Makefile Add a dummy test target Jul 23, 2016
README.md Add Travis status to README, and mentions the nfqueue-go project. Jul 23, 2016
config.h.cmake Detect function nfq_set_verdict2 and use it if available Jul 29, 2014
exception.c Add exception.c file Oct 14, 2009
exception.h Add exception.c file Oct 14, 2009
libnetfilter_queue.i Remove the default verdict (closes #2) Jul 23, 2016
nfq.c Initial commit May 25, 2008
nfq.h Include stdint.h before libnetfilter_queue, it uses uint32_t Oct 9, 2013
nfq_common.c Add new functions to get physical input and output devices. Original … Sep 13, 2012
nfq_common.h Add new functions to get physical input and output devices. Original … Sep 13, 2012
nfq_constants.h Move constants to nfq_constants.h Oct 15, 2009
nfq_utils.c Initial commit May 25, 2008
nfq_utils.h Initial commit May 25, 2008
nfq_version.h.cmake Set bindings version to 0.1 Jul 8, 2008

README.md

nfqueue-bindings

Build Status

Overview

nfqueue-bindings was written to provide an interface in high-level languages such as Perl or Python to libnetfilter_queue. The goal is to provide a library to gain access to packets queued by the kernel packet filter.

It is important to note that these bindings will not follow blindly libnetfilter_queue API. For ex., some higher-level wrappers will be provided for the open/bind/create mechanism (using one function call instead of three).

Since libraries to decode ip packets are already available, the bindings will use them.

Remember that an application connection to libnetfilter_queue must run as root to be able to create the queue. Some extra steps may be required to drop privileges after if you need more security.

iptables

You must add rules in netfilter to send packets to the userspace queue. The number of the queue (--queue-num option in netfilter) must match the number provided to create_queue().

Example of iptables rules::

iptables -A OUTPUT --destination 1.2.3.4 -j NFQUEUE

Of course, you should be more restrictive, depending on your needs.

Other languages

Bindings for the Go languages are available in the nfqueue-go project. They are not generated using Swig, so they are not part of this project.