Add API to README.

This commit is contained in:
Matt 2011-05-13 09:23:17 -07:00
parent a3676c4394
commit f6ef533393
3 changed files with 70 additions and 17 deletions

View File

@ -10,18 +10,22 @@ Libnetfilter_queue (the netfilter library, not this module) is part of the `Netf
Example
=======
The following script prints a short description of each packet before accepting it::
The following script prints a short description of each packet before accepting it. ::
from netfilterqueue import NetfilterQueue
from netfilterqueue import QueueHandler
class PacketPrinter(NetfilterQueue):
class PacketPrinter(QueueHandler):
def handle(self, packet):
print packet
packet.accept()
p = PacketPrinter()
p.bind(1)
p.run()
try:
p.run()
except KeyboardInterrupt:
print
To send packets destined for your LAN to the script, type something like::
@ -38,7 +42,7 @@ NetfilterQueue is a C extention module that links against libnetfilter_queue. Be
3. Libnetfilter_queue development files and associated dependencies
On Debian or Ubuntu, these files are install with::
On Debian or Ubuntu, install these files with::
sudo apt-get install build-essential python-dev libnetfilter-queue-dev
@ -54,9 +58,9 @@ From source
To install from source::
wget http://pypi.python.org/packages/source/N/NetfilterQueue/NetfilterQueue-0.1.tar.gz
tar -xvzf NetfilterQueue-0.1.tar.gz
cd NetfilterQueue-0.1
wget http://pypi.python.org/packages/source/N/NetfilterQueue/NetfilterQueue-0.2.tar.gz
tar -xvzf NetfilterQueue-0.2.tar.gz
cd NetfilterQueue-0.2
python setup.py install
Setup will use Cython if it is installed, regenerating the .c source from the .pyx before compiling the .so.
@ -64,7 +68,57 @@ Setup will use Cython if it is installed, regenerating the .c source from the .p
API
===
Coming soon...
``NetfilterQueue.COPY_NONE``
``NetfilterQueue.COPY_META``
``NetfilterQueue.COPY_PACKET``
These constants specify how much of the packet should be given to the script- nothing, metadata, or the whole packet.
QueueHandler objects
--------------------
You should define a class that inherits from QueueHandler and implenents the
handle() method. Handle() is called for each packet that appears in the queue.
``QueueHandler.bind(queue_num[, max_len[, mode[, range]]])``
Create and bind to the queue. ``queue_num`` must match the number in your
iptables rule. ``max_len`` sets the largest number of packets that can be
in the queue; new packets are dropped if the size of the queue reaches this
number. ``mode`` determines how much of the packet data is provided to
your script. Use the constants above. ``range`` defines how many bytes of
the packet you want to get. For example, if you only want the source and
destination IPs of a IPv4 packet, ``range`` could be 20.
``QueueHandler.unbind()``
Remove the queue. Packets matched by your iptables rule will be dropped.
``QueueHandler.run()``
Begin accepting packets.
``QueueHandler.handle(packet)``
Handle a single packet from the queue. You must call either
``packet.accept()`` or ``packet.drop()``.
Packet objects
--------------
Objects of this type are passed to your handle() method.
``Packet.get_payload()``
Return the packet's payload as a string.
``Packet.get_payload_len()``
Return the size of the payload.
``Packet.set_mark(mark)``
Give the packet a kernel mark. ``mark`` is a 32-bit number.
``Packet.accept()``
Accept the packet.
``Packet.drop()``
Drop the packet.
Usage
=====
@ -107,11 +161,10 @@ The fields are:
9. Libnetfilter_queue internal use
Limitations
===========
TODO: fix this up
* compiled to max 2048-byte packets, so won't work on LO?
* full API not implemented: omits set_payload(), interface methods, and what else?
* full API not implemented: omits set_payload(), interface methods, and what else?

View File

@ -183,7 +183,7 @@ cdef class Packet:
cpdef accept(self)
cpdef drop(self)
cdef class NetfilterQueue:
cdef class QueueHandler:
cdef nfq_handle *h # Handle to NFQueue library
cdef nfq_q_handle *qh # A handle to the queue
cdef u_int16_t af # Address family

View File

@ -17,11 +17,11 @@ cdef int global_callback(nfq_q_handle *qh, nfgenmsg *nfmsg,
"""Create an Packet and pass it to appropriate Python/Cython callback."""
packet = Packet()
packet.set_nfq_data(qh, nfa)
(<NetfilterQueue>data).handle(packet)
(<QueueHandler>data).handle(packet)
return 1
cdef class Packet:
"""A packet received from NetfilterQueue."""
"""A packet received from QueueHandler."""
def __cinit__(self):
self._verdict_is_set = False
self._mark_is_set = False
@ -104,7 +104,7 @@ cdef class Packet:
"""Drop the packet."""
self.verdict(NF_DROP)
cdef class NetfilterQueue:
cdef class QueueHandler:
"""Handle a single numbered queue."""
def __cinit__(self, *args, **kwargs):
self.af = kwargs.get("af", PF_INET)
@ -124,7 +124,7 @@ cdef class NetfilterQueue:
# processes using this libnetfilter_queue on this protocol family!
nfq_close(self.h)
def bind(self, int queue_num, u_int32_t maxlen=DEFAULT_MAX_QUEUELEN, u_int8_t mode=NFQNL_COPY_PACKET, u_int32_t range=MaxPacketSize):
def bind(self, int queue_num, u_int32_t max_len=DEFAULT_MAX_QUEUELEN, u_int8_t mode=NFQNL_COPY_PACKET, u_int32_t range=MaxPacketSize):
"""Create and bind to a new queue."""
self.qh = nfq_create_queue(self.h, queue_num, <nfq_callback*>global_callback, <void*>self)
if self.qh == NULL:
@ -135,7 +135,7 @@ cdef class NetfilterQueue:
if nfq_set_mode(self.qh, mode, range) < 0:
raise OSError("Failed to set packet copy mode.")
nfq_set_queue_maxlen(self.qh, maxlen)
nfq_set_queue_maxlen(self.qh, max_len)
def unbind(self):
"""Destroy the queue."""