Mixing
![Remove the “X” letter from the column names of a new dataframe [duplicate]](https://lh6.googleusercontent.com/-zaeyTU-K2cQ/AAAAAAAAAAI/AAAAAAAAABM/olzvsf1Fh9g/s72-c/photo.jpg?sz=32)
Netlink notification for iptable modification are not received to application
0
I wrote a program to listen to iptables modification through netlink sockets, for this I used NETLINK_AUDIT family, when I execute the program and modify the iptables rule, program doesn't receive any message from kernel and it will be in blocking mode only. Could you help me to find what is wrong in this program or what else I need to do to receive iptables notification.
#include "libaudit.h"
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int main()
{
int rc;
struct audit_message rep;
int fd;
struct sockaddr_nl sa;
memset(&sa, 0, sizeof(sa));
sa.nl_family = AF_NETLINK;
sa.nl_groups = 0;
fd = audit_open();
bind(fd, (struct sockaddr *) &sa, sizeof(sa));
rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0);
if(rc < 0)
{
printf("Error");
}
else
{
printf("msg received %d n",rep.nlh.nlmsg_type );
break;
}
audit_close(fd);
return 0;
}
c linux linux-kernel iptables netlink
edited Nov 21 '18 at 12:02
red0ct
1,30531023
asked Nov 21 '18 at 5:52
avinashavinash
1
|
show 4 more comments
0
I wrote a program to listen to iptables modification through netlink sockets, for this I used NETLINK_AUDIT family, when I execute the program and modify the iptables rule, program doesn't receive any message from kernel and it will be in blocking mode only. Could you help me to find what is wrong in this program or what else I need to do to receive iptables notification.
#include "libaudit.h"
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int main()
{
int rc;
struct audit_message rep;
int fd;
struct sockaddr_nl sa;
memset(&sa, 0, sizeof(sa));
sa.nl_family = AF_NETLINK;
sa.nl_groups = 0;
fd = audit_open();
bind(fd, (struct sockaddr *) &sa, sizeof(sa));
rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0);
if(rc < 0)
{
printf("Error");
}
else
{
printf("msg received %d n",rep.nlh.nlmsg_type );
break;
}
audit_close(fd);
return 0;
}
c linux linux-kernel iptables netlink
edited Nov 21 '18 at 12:02
red0ct
1,30531023
asked Nov 21 '18 at 5:52
avinashavinash
1
are you running this program as a root / privileged user ?
– Devidas
Nov 21 '18 at 6:07
Yes,running as a root user.
– avinash
Nov 21 '18 at 6:08
do you have auditd running ?
– Devidas
Nov 21 '18 at 6:09
Yes. ps -eaf | grep -i auditd root 499 2 0 Nov16 ? 00:00:00 [kauditd] root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
– avinash
Nov 21 '18 at 6:15
can you check return value of bind and if it is less than zero use perror or check errno ?
– Devidas
Nov 21 '18 at 6:30
|
show 4 more comments
0
0
0
I wrote a program to listen to iptables modification through netlink sockets, for this I used NETLINK_AUDIT family, when I execute the program and modify the iptables rule, program doesn't receive any message from kernel and it will be in blocking mode only. Could you help me to find what is wrong in this program or what else I need to do to receive iptables notification.
#include "libaudit.h"
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int main()
{
int rc;
struct audit_message rep;
int fd;
struct sockaddr_nl sa;
memset(&sa, 0, sizeof(sa));
sa.nl_family = AF_NETLINK;
sa.nl_groups = 0;
fd = audit_open();
bind(fd, (struct sockaddr *) &sa, sizeof(sa));
rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0);
if(rc < 0)
{
printf("Error");
}
else
{
printf("msg received %d n",rep.nlh.nlmsg_type );
break;
}
audit_close(fd);
return 0;
}
c linux linux-kernel iptables netlink
edited Nov 21 '18 at 12:02
red0ct
1,30531023
asked Nov 21 '18 at 5:52
avinashavinash
1
I wrote a program to listen to iptables modification through netlink sockets, for this I used NETLINK_AUDIT family, when I execute the program and modify the iptables rule, program doesn't receive any message from kernel and it will be in blocking mode only. Could you help me to find what is wrong in this program or what else I need to do to receive iptables notification.
#include "libaudit.h"
#include <stdio.h>
#include <string.h>
#include <unistd.h>
int main()
{
int rc;
struct audit_message rep;
int fd;
struct sockaddr_nl sa;
memset(&sa, 0, sizeof(sa));
sa.nl_family = AF_NETLINK;
sa.nl_groups = 0;
fd = audit_open();
bind(fd, (struct sockaddr *) &sa, sizeof(sa));
rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0);
if(rc < 0)
{
printf("Error");
}
else
{
printf("msg received %d n",rep.nlh.nlmsg_type );
break;
}
audit_close(fd);
return 0;
}
c linux linux-kernel iptables netlink
c linux linux-kernel iptables netlink
edited Nov 21 '18 at 12:02
red0ct
1,30531023
asked Nov 21 '18 at 5:52
avinashavinash
1
edited Nov 21 '18 at 12:02
red0ct
1,30531023
asked Nov 21 '18 at 5:52
avinashavinash
1
edited Nov 21 '18 at 12:02
red0ct
1,30531023
edited Nov 21 '18 at 12:02
red0ct
1,30531023
edited Nov 21 '18 at 12:02
red0ct
1,30531023
1,30531023
asked Nov 21 '18 at 5:52
avinashavinash
1
asked Nov 21 '18 at 5:52
avinashavinash
1
asked Nov 21 '18 at 5:52
avinashavinash
1
1
are you running this program as a root / privileged user ?
– Devidas
Nov 21 '18 at 6:07
Yes,running as a root user.
– avinash
Nov 21 '18 at 6:08
do you have auditd running ?
– Devidas
Nov 21 '18 at 6:09
Yes. ps -eaf | grep -i auditd root 499 2 0 Nov16 ? 00:00:00 [kauditd] root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
– avinash
Nov 21 '18 at 6:15
can you check return value of bind and if it is less than zero use perror or check errno ?
– Devidas
Nov 21 '18 at 6:30
|
show 4 more comments
are you running this program as a root / privileged user ?
– Devidas
Nov 21 '18 at 6:07
Yes,running as a root user.
– avinash
Nov 21 '18 at 6:08
do you have auditd running ?
– Devidas
Nov 21 '18 at 6:09
Yes. ps -eaf | grep -i auditd root 499 2 0 Nov16 ? 00:00:00 [kauditd] root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
– avinash
Nov 21 '18 at 6:15
can you check return value of bind and if it is less than zero use perror or check errno ?
– Devidas
Nov 21 '18 at 6:30
are you running this program as a root / privileged user ?
– Devidas
Nov 21 '18 at 6:07
are you running this program as a root / privileged user ?
– Devidas
Nov 21 '18 at 6:07
Yes,running as a root user.
– avinash
Nov 21 '18 at 6:08
Yes,running as a root user.
– avinash
Nov 21 '18 at 6:08
do you have auditd running ?
– Devidas
Nov 21 '18 at 6:09
do you have auditd running ?
– Devidas
Nov 21 '18 at 6:09
Yes. ps -eaf | grep -i auditd root 499 2 0 Nov16 ? 00:00:00 [kauditd] root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
– avinash
Nov 21 '18 at 6:15
Yes. ps -eaf | grep -i auditd root 499 2 0 Nov16 ? 00:00:00 [kauditd] root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
– avinash
Nov 21 '18 at 6:15
can you check return value of bind and if it is less than zero use perror or check errno ?
– Devidas
Nov 21 '18 at 6:30
can you check return value of bind and if it is less than zero use perror or check errno ?
– Devidas
Nov 21 '18 at 6:30
|
show 4 more comments
1 Answer
1
active
oldest
votes
0
try this flag
https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.c#L383
from libaudit source code
rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
maybe you have to configure audit withauditctl? can you consult man page and try configuring it ?
– Devidas
Nov 22 '18 at 8:12
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
|
show 3 more comments
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405999%2fnetlink-notification-for-iptable-modification-are-not-received-to-application%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
try this flag
https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.c#L383
from libaudit source code
rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
maybe you have to configure audit withauditctl? can you consult man page and try configuring it ?
– Devidas
Nov 22 '18 at 8:12
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
|
show 3 more comments
0
try this flag
https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.c#L383
from libaudit source code
rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
maybe you have to configure audit withauditctl? can you consult man page and try configuring it ?
– Devidas
Nov 22 '18 at 8:12
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
|
show 3 more comments
0
0
0
try this flag
https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.c#L383
from libaudit source code
rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
try this flag
https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.c#L383
from libaudit source code
rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
answered Nov 21 '18 at 9:43
DevidasDevidas
534213
534213
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
maybe you have to configure audit withauditctl? can you consult man page and try configuring it ?
– Devidas
Nov 22 '18 at 8:12
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
|
show 3 more comments
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
maybe you have to configure audit withauditctl? can you consult man page and try configuring it ?
– Devidas
Nov 22 '18 at 8:12
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
I have tried this as well before ,since it's non blocking call,it will come out without waiting there(used the polling as well before thi call) but not received any data
– avinash
Nov 22 '18 at 1:23
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
Is there any other way as well to receive the iptable change notification ?
– avinash
Nov 22 '18 at 1:25
maybe you have to configure audit with
auditctl ? can you consult man page and try configuring it ?– Devidas
Nov 22 '18 at 8:12
maybe you have to configure audit with
auditctl ? can you consult man page and try configuring it ?– Devidas
Nov 22 '18 at 8:12
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
from your observation it is clear that there is less probablity of this code having problem. as it may have given some error. so I feel is audit is not configured to listem to netlink related or for that matter any call by default. I suggest you to go through this access.redhat.com/documentation/en-us/red_hat_enterprise_linux/… specifically example 7.2 and try simmilar thing with given example try it works and then do same/ related for netlink
– Devidas
Nov 22 '18 at 8:17
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
I tried configuring those setting earlier directly using auditctl command & can see the modifcation with "ausearch -k iptablesChange" command output..this time i configured more rules in /etc/audit/audit.rules file but still issue persist.
– avinash
Nov 23 '18 at 8:43
|
show 3 more comments
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53405999%2fnetlink-notification-for-iptable-modification-are-not-received-to-application%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
are you running this program as a root / privileged user ?
– Devidas
Nov 21 '18 at 6:07
Yes,running as a root user.
– avinash
Nov 21 '18 at 6:08
do you have auditd running ?
– Devidas
Nov 21 '18 at 6:09
Yes. ps -eaf | grep -i auditd root 499 2 0 Nov16 ? 00:00:00 [kauditd] root 926 1 0 Nov16 ? 00:00:00 /sbin/auditd -n
– avinash
Nov 21 '18 at 6:15
can you check return value of bind and if it is less than zero use perror or check errno ?
– Devidas
Nov 21 '18 at 6:30