libipq 관련 질문입니다.

/*
 * ipq_client.c
 *
 * Simple ipq client for test & development.  If you set dump_payload
 * to 1, you'll probably want to run as ./ipq_client > dump.out
 *
 * At the moment, this code grabs queued packets, mangles the TOS field, 
 * then issues NF_ACCEPT verdicts.  This is to establish that modifying 
 * packets works.
 *
 * TODO: - Make more flexible, use getopts
 *       - Add differential csum
 *       - Add support for more protocols
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 */
#include <stdio.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <linux/netfilter.h>
#include <unistd.h>
 
#include "libipq.h"
 
#define BUFSIZE 2048 
 
static void die(struct ipq_handle *h);
static void dump_metadata(ipq_packet_msg_t *m);
static void dump_iphdr(unsigned char *buf);
static u_int16_t csum_partial(void *buffer,
                              unsigned int len, u_int16_t prevsum);
 
int main(int argc, char **argv)
{ 
	int status;
	unsigned char dump_payload = 0;
	unsigned char inbuf[BUFSIZE];
	struct ipq_handle *h;
	int verdict = NF_ACCEPT;
 
	h = ipq_create_handle(0, PF_INET);
	if (!h)
		die(h);
	status = ipq_set_mode(h, IPQ_COPY_PACKET, BUFSIZE);
	if (status < 0)
		die(h);
	do  {
		status = ipq_read(h, inbuf, BUFSIZE, 0);
		if (status < 0)
			die(h);
		switch (ipq_message_type(inbuf)) {
			case NLMSG_ERROR:
				fprintf(stderr, "Received error message %d\n",
					ipq_get_msgerr(inbuf));
				break;
			case IPQM_PACKET: {
				ipq_packet_msg_t *m = ipq_get_packet(inbuf);
				unsigned char *packet = NULL;
				struct iphdr *iph = NULL;
 
				if (!m)
					break;
				dump_metadata(m);
				if (m->data_len >= sizeof(struct iphdr)) {
					packet = (unsigned char *)m
					         + sizeof(*m);
					dump_iphdr(packet);
				}
				fprintf(stderr, "Sending verdict %d on "
				        "packet %lX\n", verdict, m->packet_id);
				iph = (struct iphdr *)packet;	        
				iph->tos = 0x55;
				iph->check = 0;
				iph->check = ~csum_partial(packet,
				                           sizeof(struct iphdr),
				                           0);
				status = ipq_set_verdict(h,
				                         m->packet_id,
				                         verdict,
				                         m->data_len,
				                         packet);
				if (status < 0)
					die(h);
				break;
			}
			default:
				fprintf(stderr, "Unknown message!\n");
				break;
		}
		if (dump_payload)
			write(1, inbuf, status);
	} while (1);
	ipq_destroy_handle(h);
	return 0;
} 
 
static void die(struct ipq_handle *h)
{
	ipq_perror("ERROR");
	ipq_destroy_handle(h);
	exit(1);
}
 
static void dump_metadata(ipq_packet_msg_t *m)
{
	if(!m)
		return;
	fprintf(stderr, "Dumping Metadata:\nID=0x%08lX MARK=0x%08lX TSEC=%ld "
	        "TUSEC=%ld HOOK=%u IN=%s OUT=%s DLEN=%d\n",
	        m->packet_id,
	        m->mark,
	        m->timestamp_sec,
	        m->timestamp_usec,
	        m->hook,
	        m->indev_name[0] ? m->indev_name : "[none]",
	        m->outdev_name[0] ? m->outdev_name : "[none]",
	        m->data_len);
}
 
/* 
 * This does not handle IP options yet, although it may at some point 
 * in the near future.  Some of this code was stolen from ipt_LOG.c.
 */
static void dump_iphdr(unsigned char *buf)
{
	struct iphdr *iph = (struct iphdr *)buf;
 
	fputs("Dumping IP Header:\n", stderr);
	fprintf(stderr, "VER=%u HLEN=%u TOS=0x%02hX TLEN=%u ID=%u ",
	        iph->version,
	        iph->ihl * 4,
	        iph->tos, 
	        ntohs(iph->tot_len),
	        ntohs(iph->id));
	if (ntohs(iph->frag_off) & IP_DF)
		fputs("DF ", stderr);
	if (ntohs(iph->frag_off) & IP_MF)
		fputs("MF ", stderr);
	if (ntohs(iph->frag_off) & 0x1FFF)
		fprintf(stderr, "FRAG=%u ",
		        (ntohs(iph->frag_off) & 0x1FFF) * 8);
	fprintf(stderr, "TTL=%u PROT=%u CSUM=0x%04X ",
	        iph->ttl,
	        iph->protocol,
	        ntohs(iph->check));
	fprintf(stderr, "SRC=%u.%u.%u.%u DST=%u.%u.%u.%u\n\n",
	        (ntohl(iph->saddr) >> 24) & 0xFF,
	        (ntohl(iph->saddr) >> 16) & 0xFF,
	        (ntohl(iph->saddr) >> 8) & 0xFF,
	        (ntohl(iph->saddr)) & 0xFF,
	        (ntohl(iph->daddr) >> 24) & 0xFF,
	        (ntohl(iph->daddr) >> 16) & 0xFF,
	        (ntohl(iph->daddr) >> 8) & 0xFF,
	        (ntohl(iph->daddr)) & 0xFF);
}
 
/* This is from gen_ip.c */
static u_int16_t csum_partial(void *buffer,
                              unsigned int len, u_int16_t prevsum)
{
	u_int32_t sum = 0;
	u_int16_t *ptr = buffer;
 
	while (len > 1)  {
		sum += *ptr++;
		len -= 2;
	}
	if (len) {
		union {
			u_int8_t byte;
			u_int16_t wyde;
		} odd;
 
		odd.wyde = 0;
		odd.byte = *((u_int8_t *)ptr);
		sum += odd.wyde;
	}
	sum = (sum >> 16) + (sum & 0xFFFF);
	sum += prevsum;
	return (sum + (sum >> 16));
}