<div dir="ltr"><div><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline"><br>
</span></div><div><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">In examples of Twisted UDP clients they all do this:</span></div>
<div><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline"><br>
</span></div><div><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">reactor</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">.</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">listenUDP</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">(</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline;color:rgb(128,0,0)">3000</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">,</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline"> </span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline;color:rgb(43,145,175)">MyProtocol</span><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline">())<br>
</span></div><div><span class="" style="font-family:Consolas,Menlo,Monaco,'Lucida Console','Liberation Mono','DejaVu Sans Mono','Bitstream Vera Sans Mono','Courier New',monospace,serif;background-color:transparent;color:rgb(0,0,0);font-size:14px;line-height:18px;margin:0px;padding:0px;border:0px;vertical-align:baseline"><br>
</span></div><div>What would I do instead?</div><div>reactor.addReader makes sense to me since what I have is a file descriptor,</div><div>and the reactor loop and use select or epoll find out when there is data to read...</div>
<div>and call our doRead() method of the Reader.</div><div><br></div><div>I don't know about implementing this as a Protocol because I do not have any</div><div>equivalent to ReactorUDP. ReactorUDP's listenUDP returns a ListeningPort.</div>
<div>And I'm not sure how a Transport is related to my Reader... but it seems to me</div><div>that there is some abstraction which sets callbacks for io and also calls buildProtocol...</div><div><br></div><div>Would a NFLogProtocol and factory like this be usable?</div>
<div>Sorta like this?</div><div><a href="https://gist.github.com/david415/6790543">https://gist.github.com/david415/6790543</a><br></div><div><br></div><div>If I am going to be using a Twisted Service to drop privileges after gaining access to the fd...</div>
<div>How would I do this? Would I have startService() instantiate a Protocol instance?</div><br><div>I don't know about the nflog file descriptor... </div><div>but the nflog generator interface is non-blocking if used like this:</div>
<div class="gmail_extra"><div class="gmail_extra"><br></div><div class="gmail_extra"> def doRead(self):</div><div class="gmail_extra"> pkt = self.nflog.next()</div><div class="gmail_extra"> while True:</div>
<div class="gmail_extra"> self.handlePacket(pkt)</div><div class="gmail_extra"> pkt = self.nflog.send(True)</div><div class="gmail_extra"> if pkt is NFWouldBlock: break</div><div><br></div>
</div><div class="gmail_extra">My nflog reader seems to work great.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Oct 2, 2013 at 12:26 AM, Phil Mayers <span dir="ltr"><<a href="mailto:p.mayers@imperial.ac.uk" target="_blank">p.mayers@imperial.ac.uk</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div class="im">On 10/02/2013 07:14 AM, David Stainton wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Hi,<br>
<br>
I am wondering how I should combine various twisted interfaces<br>
in a way that makes sense. It probably shows here... that I'm new to<br>
twisted.<br>
<br>
The Linux iptables can log packets to the netfilter_log which can give<br>
access to user space.<br>
I wrote a simple twisted Reader (IReadDescriptor implementation) that is<br>
working functional code...<br>
<a href="https://gist.github.com/david415/6789612" target="_blank">https://gist.github.com/<u></u>david415/6789612</a><br>
<br>
But since these are packets it returns... should I implement a "read<br>
only Protocol"?<br>
</blockquote>
<br></div>
Well, if your transport is not writable, just don't implement that - Exceptions will be raised if you mistakenly try to write, so nothing bad will happen.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
The protocol's dataReceive() method could be called from the<br>
NFLogReader's doRead() method.<br>
</blockquote>
<br></div>
Since they're packets it should really be a DatagramProtocol and call datagramReceived.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Does this mean that NFLogReader would be responsible for calling<br>
buildProtocol to construct the NFLogProtocol?<br>
</blockquote>
<br></div>
Typically a factory is responsible for calling buildProtocol, but in most datagram uses, there is only one protocol instance per port, so you just instantiate it. See e.g.<br>
<br>
<a href="http://twistedmatrix.com/documents/current/core/howto/udp.html" target="_blank">http://twistedmatrix.com/<u></u>documents/current/core/howto/<u></u>udp.html</a><div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
In the normal Twisted examples the buildProtocol seems to be called from<br>
the react loop..<br>
Should I pass the protocol factory and the reader to the service?<br>
</blockquote>
<br></div>
Sorry I don't know what this means.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
If I want to drop privileges right after retrieving the filedescriptor<br>
for netfilter_log, shall I use a Twisted Service/Application to drop the<br>
root privs to a non-superuser?<br>
</blockquote>
<br></div>
That would be the "Twisted" way of doing it, yes.<div class="im"><br>
<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
Should the privileges be dropped by the privilegedStartService() method?<br>
The manual says that method is for preparing to drop services...<br>
<br>
What I want out of all of this is the most high performance and general<br>
solution to utilizing netfilter_log in twisted...<br>
</blockquote>
<br></div>
Couple of general points:<br>
<br>
The nflog_cffi code is... hard to read. But it's not obvious to me that it sets the FD to nonblocking anywhere, or that it's (frankly weird) generator construct will actually yield the "nonblock" marker object at the right times. You might want to test this.<br>
<br>
On a different note, a colleague wrote some code to process the IPQUEUE target of iptables a while back. This code did something similar to your example above, but it didn't bother integrating with the protocol/factory machinery, and you could consider whether it makes sense to do so - unlike a TCP or UDP port, you're unlikely to ever have >1 nflog "connection" per-process, so it's not obvious that using the full generality of the factory/protocol machinery is appropriate.<br>
<br>
However if you do that, I would just copy what Twisted does for UDP; don't model it on TCP.<br>
<br>
______________________________<u></u>_________________<br>
Twisted-Python mailing list<br>
<a href="mailto:Twisted-Python@twistedmatrix.com" target="_blank">Twisted-Python@twistedmatrix.<u></u>com</a><br>
<a href="http://twistedmatrix.com/cgi-bin/mailman/listinfo/twisted-python" target="_blank">http://twistedmatrix.com/cgi-<u></u>bin/mailman/listinfo/twisted-<u></u>python</a><br>
</blockquote></div><br></div></div>