//Create and bind to queue specified by queueId
func NewNFQueue(queueId uint16, maxPacketsInQueue uint32, packetSize uint32) (*NFQueue, error) {
var nfq = NFQueue{}
var err error
var ret C.int
if nfq.h, err = C.nfq_open(); err != nil {
return nil, fmt.Errorf("Error opening NFQueue handle: %v\n", err)
}
if ret, err = C.nfq_unbind_pf(nfq.h, AF_INET); err != nil || ret < 0 {
return nil, fmt.Errorf("Error unbinding existing NFQ handler from AF_INET protocol family: %v\n", err)
}
if ret, err := C.nfq_bind_pf(nfq.h, AF_INET); err != nil || ret < 0 {
return nil, fmt.Errorf("Error binding to AF_INET protocol family: %v\n", err)
}
nfq.packets = make(chan NFPacket)
if nfq.qh, err = C.CreateQueue(nfq.h, C.u_int16_t(queueId), unsafe.Pointer(&nfq.packets)); err != nil || nfq.qh == nil {
C.nfq_close(nfq.h)
return nil, fmt.Errorf("Error binding to queue: %v\n", err)
}
if ret, err = C.nfq_set_queue_maxlen(nfq.qh, C.u_int32_t(maxPacketsInQueue)); err != nil || ret < 0 {
C.nfq_destroy_queue(nfq.qh)
C.nfq_close(nfq.h)
return nil, fmt.Errorf("Unable to set max packets in queue: %v\n", err)
}
if C.nfq_set_mode(nfq.qh, C.u_int8_t(2), C.uint(packetSize)) < 0 {
C.nfq_destroy_queue(nfq.qh)
C.nfq_close(nfq.h)
return nil, fmt.Errorf("Unable to set packets copy mode: %v\n", err)
}
if nfq.fd, err = C.nfq_fd(nfq.h); err != nil {
C.nfq_destroy_queue(nfq.qh)
C.nfq_close(nfq.h)
return nil, fmt.Errorf("Unable to get queue file-descriptor. %v", err)
}
go nfq.run()
return &nfq, nil
}
func (a *OpenAnchor) Insert(r *Rule) error {
rule := C.struct_pfioc_rule{}
aname := C.CString(a.name)
C.strlcpy(&rule.anchor[0], aname, C.size_t(unsafe.Sizeof(rule.anchor)))
C.free(unsafe.Pointer(aname))
nr := &rule.rule
// defaults
nr.af = syscall.AF_INET
nr.rtableid = C.int(-1)
nr.onrdomain = C.int(-1)
nr.keep_state = PF_STATE_NORMAL
nr.flags = 0x2
nr.flagset = 0x12
nr.src.addr._type = PF_ADDR_ADDRMASK
nr.dst.addr._type = PF_ADDR_ADDRMASK
nr.nat.addr._type = PF_ADDR_NONE
nr.rdr.addr._type = PF_ADDR_ADDRMASK
switch r.Action {
case Block:
nr.action = PF_BLOCK
case Pass:
nr.action = PF_PASS
case Match:
nr.action = PF_MATCH
}
switch r.Direction {
case InOut:
nr.direction = PF_INOUT
case In:
nr.direction = PF_IN
case Out:
nr.direction = PF_OUT
}
if r.Log {
nr.log = C.u_int8_t(1)
}
if r.Quick {
nr.quick = C.u_int8_t(1)
}
ifname := C.CString(r.Interface)
defer C.free(unsafe.Pointer(ifname))
C.strlcpy(&nr.ifname[0], ifname, C.size_t(unsafe.Sizeof(nr.ifname)))
tagname := C.CString(r.Tag)
defer C.free(unsafe.Pointer(tagname))
C.strlcpy(&nr.tagname[0], tagname, C.size_t(unsafe.Sizeof(nr.tagname)))
if r.Src.Addr != nil {
goaddrtopfaddr(r.Src.Addr, &nr.src.addr)
}
if r.Src.Port != 0 {
nr.src.port_op = PF_OP_EQ
nr.src.port[0] = C.u_int16_t(C.chtons(C.uint16_t(r.Src.Port)))
}
if r.Dst.Addr != nil {
goaddrtopfaddr(r.Dst.Addr, &nr.dst.addr)
}
if r.Dst.Port != 0 {
nr.dst.port_op = PF_OP_EQ
nr.dst.port[0] = C.u_int16_t(C.chtons(C.uint16_t(r.Dst.Port)))
}
if r.Rdr != nil {
if r.Rdr.Addr != nil {
goaddrtopfaddr(r.Rdr.Addr, &nr.rdr.addr)
}
if r.Rdr.Port != 0 {
//nr.rdr.port_op = PF_OP_EQ
nr.rdr.proxy_port[0] = C.u_int16_t(r.Rdr.Port)
nr.rdr.proxy_port[1] = C.u_int16_t(r.Rdr.Port)
}
}
rule.action = PF_CHANGE_GET_TICKET
err := ioctl(a.pf.fd.Fd(), DIOCCHANGERULE, uintptr(unsafe.Pointer(&rule)))
if err != nil {
return err
}
rule.action = PF_CHANGE_ADD_TAIL
// insert rule into anchor
err = ioctl(a.pf.fd.Fd(), DIOCCHANGERULE, uintptr(unsafe.Pointer(&rule)))
if err != nil {
return err
}
return nil
}