Merge lp:~hipl-core/hipl/libnetfilter_queue into lp:hipl

[Pupu Toivonen]

hipl-firewall has been ported from using the deprecated and recently deleted ip_queue (libipq) packet queue into using netfilter_queue. This fixes bug #1154974.

This solution reuses much of the code that was used to handle libipq packets by collecting the used fields into an imitating packet type hip_ipq_packet_msg and passing that around to the functions.

The unit test for hipfw/rewrite.c was removed because the functions it tests now behave a bit differently and the packet format is now different from the sample packet that was written in the source file as a hex string.

I have tested the firewall in action between three nodes. I first tested the LSI support by starting the firewall at each node using 'hipfw -Alk', letting the hosts establish a HIP connection and testing IPv4 connectivity using 'nc -4' and 'ssh -4' toward the LSI:s. The connections seemed to work well. I also tested the access control features of the firewall. By introducing rules in the firewall config file I successfully blocked HIP traffic to and from selected hosts based on their HITs, while allowing non-HIP traffic and traffic to hosts with different HITs. Also the other way worked, introducing rules to allow packets to and from selected HITs and drop to/from everyone else allowed connections to only those selected HITs. For following the state of the connections I used 'watch hipconf daemon get ha all' over an out-of-band ssh connection.

I also found that having the kernel modules ip_queue or ip6_queue (modules for the legacy libipq queue) loaded, hipfw would fail to start because it could not claim netfilter hooks for itself. Upon starting up, hipfw would try to load these modules; there was no problem with kernel versions 3.5.0 and above because loading the modules would fail, but older kernels would happily load the modules and block netfilter from getting initialized. This has now been fixed also.

[Miika Komu (miika-iki)]

Minor comments:

* hipfw.c:396: perror -> HIP_PERROR
* hipfw.c:675 unnecessary line breaks
* test/mocks.c: get rid of the "if 0" code
(* In some cases, I am sure if variable declaration code was necessary to be aligned; I always try to minimize the size of the diff)

Please fix these and request a new merge proposal asap. When you give the new merge proposal, please give a test report and explain why the unit tests were removed.

I suggest to merge the code on Friday noon if there are no other comments. Please be prepared to fix some nits later on if somebody else comments about the coding style. I think we can do this directly on the trunk because this fix is kind of urgent and should have been dealt earlier.

Thanks Juhani for this contribution! Good work.

review: Needs Fixing

[Pupu Toivonen (scolphoy)]

Thank you for the feedback.

I made those minor changes. Aligning of the variable declarations was enforced by the commit hooks.
I'll write a report and resubmit the proposal soon.

[Miika Komu (miika-iki)]

Good! Please merge tomorrow if no further comments or requests for extended review time.

review: Approve

[Christof Mroz (christof-mroz)]

I didn't look at the changes in detail, but I like the careful approach.

This might render some ipq specific junk in rewrite.c obsolete: as I documented in the comment block near the start of the file, it helps deal with the fact that the ip_queue userspace buffer is managed by the library itself, without a documented maximum length (apart from the source code), so that appending data into this buffer is not safe (according to my understanding back then).
The midauth extension needs to enlarge captured packets.

If I understand nf_queue correctly, we read captured packets into our own userspace buffer now. If so, then it suffices to choose a big enough buffer (HIP_MAX_PACKET, IIRC). The support functions might still be handy for checking packet bounds, though.

[Pupu Toivonen (scolphoy)]

This is my understanding of the inner workings of nf_queue as well, that in NFQNL_COPY_PACKET mode, it feeds the whole packet along with the payload to the socket, and recv() reads it to our own buffer. Reading the underlying nfnetlink-code it looks like the metadata goes in the beginning of the buffer and the payload is placed after it. We can extract a pointer to the beginning of the payload using netfilter's message parsing functions. If we choose a convenient size (currently HIP_MAX_PACKET), we should be able to do whatever we like with it and pass it back to the kernel by giving the new length and this time the same buffer location to nfq_set_verdict.

I'll take a look at that rewrite.c if some of it in fact has gone obsolete / is doing unnecessary work but I think the current status is quite ready for merging as it does get hipfw at least working on the newer systems.

[Christof Mroz (christof-mroz)]

> I'll take a look at that rewrite.c if some of it in fact has gone obsolete /
> is doing unnecessary work but I think the current status is quite ready for
> merging as it does get hipfw at least working on the newer systems.

Absolutely; I did not mean to delay the merge.
A low-priority bug/feature request should suffice as a reminder.

[Pupu Toivonen (scolphoy)]

Ok. Btw, I just verified that the packet payload indeed does get copied in our own buffer. The pointer to the payload seems to constantly point to 60 bytes after the beginning of the buffer, meaning that we need to make it bigger if we want to allow the payload to grow to that full HIP_MAX_PACKET length. I do not know yet if the 60 bytes is guaranteed, so at least for the time being the stuff in rewrite.c remains relevant.

=== modified file 'INSTALL'
--- INSTALL	2013-03-31 13:42:34 +0000
+++ INSTALL	2013-08-01 14:18:46 +0000
@@ -33,7 +33,7 @@
 -------------
 - required:
   apt-get install autoconf automake libtool make gcc libssl-dev iptables-dev \
-                  libnet-ip-perl libnet-dns-perl bzr
+                  libnet-ip-perl libnet-dns-perl bzr libnetfilter-queue-dev
 - optional:
   apt-get install xmlto doxygen check libconfig8-dev miredo
 - binary packages:
@@ -43,7 +43,7 @@
 -------------
 - required:
   yum install autoconf automake libtool make gcc openssl-devel iptables-devel \
-              perl-Net-IP perl-Net-DNS bzr
+              perl-Net-IP perl-Net-DNS bzr libnetfilter_queue-devel
 - optional:
   yum install xmlto doxygen check-devel libconfig-devel miredo
 - binary packages:
@@ -53,7 +53,7 @@
 --------
 - required:
   zypper install autoconf automake libtool make gcc libopenssl-devel iptables-devel \
-                 perl-Net-IP perl-Net-DNS bzr
+                 perl-Net-IP perl-Net-DNS bzr libnetfilter_queue-devel
 - optional:
   zypper install xmlto doxygen check-devel
 - binary packages:

=== modified file 'Makefile.am'
--- Makefile.am	2013-03-25 06:43:57 +0000
+++ Makefile.am	2013-08-01 14:18:46 +0000
@@ -223,7 +223,6 @@
                            test/hipfw/line_parser.c                     \
                            test/hipfw/midauth.c                         \
                            test/hipfw/port_bindings.c                   \
-                           test/hipfw/rewrite.c                         \
                            $(hipfw_hipfw_sources)
 
 test_check_libcore_SOURCES = test/check_libcore.c                       \

=== modified file 'configure.ac'
--- configure.ac	2013-01-29 11:37:45 +0000
+++ configure.ac	2013-08-01 14:18:46 +0000
@@ -137,7 +137,8 @@
                [ac_cv_use_firewall],
                [ac_cv_use_firewall=yes])
 if test x"$ac_cv_use_firewall" = x"yes"; then
-    AC_CHECK_LIB(ipq, ipq_create_handle,, [AC_MSG_ERROR([libipq not found])])
+    AC_CHECK_LIB(netfilter_queue, nfq_create_queue,, [AC_MSG_ERROR([libnetfilter_queue not found])])
+    AC_CHECK_LIB(nfnetlink, nlif_query,, [AC_MSG_ERROR([libnfnetlink not found])])
     AC_CHECK_LIB(config, config_setting_index,,
                  [AC_MSG_WARN([libconfig not found, using default config])])
     AC_DEFINE(CONFIG_HIP_FIREWALL)

=== modified file 'debian/control'
--- debian/control	2013-01-29 11:37:45 +0000
+++ debian/control	2013-08-01 14:18:46 +0000
@@ -2,7 +2,7 @@
 Section: net
 Priority: optional
 Maintainer: HIPL team <[e-mail]>
-Build-Depends: debhelper (>= 7), python, libconfig8-dev, libssl-dev, iptables-dev, autoconf, xmlto, w3m
+Build-Depends: debhelper (>= 7), python, libconfig8-dev, libssl-dev, iptables-dev, autoconf, xmlto, w3m, libnetfilter-queue-dev
 Standards-Version: 3.9.1
 Homepage: http://launchpad.net/hipl
 
@@ -28,7 +28,7 @@
 
 Package: hipl-firewall
 Architecture: any
-Depends: ${shlibs:Depends}, ${misc:Depends}, openssl, iptables
+Depends: ${shlibs:Depends}, ${misc:Depends}, openssl, iptables, libnetfilter-queue1
 Suggests: hipl-doc
 Description: HIP for Linux multi-purpose firewall daemon
  The Host Identity Protocol (HIP) and the related architecture form a proposal

=== modified file 'hipfw/cert.c'
--- hipfw/cert.c	2012-05-12 06:54:33 +0000
+++ hipfw/cert.c	2013-08-01 14:18:46 +0000
@@ -37,6 +37,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <errno.h>
 #include <netinet/in.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>

=== modified file 'hipfw/hipfw.c'
--- hipfw/hipfw.c	2012-07-19 12:00:32 +0000
+++ hipfw/hipfw.c	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2012 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010-2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -45,13 +45,13 @@
 
 #define _BSD_SOURCE
 
-#include <libipq.h>
 #include <limits.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
 #include <unistd.h>
+#include <errno.h>
 #include <arpa/inet.h>
 #include <netinet/in.h>
 #include <netinet/ip.h>
@@ -63,6 +63,7 @@
 #include <sys/utsname.h>
 #include <sys/wait.h>
 #include <linux/netfilter_ipv4.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
 
 #include "libcore/builder.h"
 #include "libcore/capability.h"
@@ -181,9 +182,9 @@
                  "failed to initialize userspace ipsec\n");
 
         // queue incoming ESP over IPv4 and IPv4 UDP encapsulated traffic
-        system_print("iptables -I HIPFW-INPUT -p 50 -j QUEUE");
-        system_print("iptables -I HIPFW-INPUT -p 17 --dport 10500 -j QUEUE");
-        system_print("iptables -I HIPFW-INPUT -p 17 --sport 10500 -j QUEUE");
+        system_print("iptables -I HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-INPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-INPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
 
         /* no need to queue outgoing ICMP, TCP and UDP sent to LSIs as
          * this is handled elsewhere */
@@ -191,13 +192,13 @@
         /* queue incoming ESP over IPv6
          *
          * @note this is where you would want to add IPv6 UDP encapsulation */
-        system_print("ip6tables -I HIPFW-INPUT -p 50 -j QUEUE");
+        system_print("ip6tables -I HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 1");
 
         // queue outgoing ICMP, TCP and UDP sent to HITs
-        system_print("ip6tables -I HIPFW-OUTPUT -p 58 -d 2001:0010::/28 -j QUEUE");
-        system_print("ip6tables -I HIPFW-OUTPUT -p 6 -d 2001:0010::/28 -j QUEUE");
-        system_print("ip6tables -I HIPFW-OUTPUT -p 1 -d 2001:0010::/28 -j QUEUE");
-        system_print("ip6tables -I HIPFW-OUTPUT -p 17 -d 2001:0010::/28 -j QUEUE");
+        system_print("ip6tables -I HIPFW-OUTPUT -p 58 -d 2001:0010::/28 -j NFQUEUE --queue-num 1");   // IPv6-ICMP
+        system_print("ip6tables -I HIPFW-OUTPUT -p 6  -d 2001:0010::/28 -j NFQUEUE --queue-num 1");   // TCP
+        system_print("ip6tables -I HIPFW-OUTPUT -p 1  -d 2001:0010::/28 -j NFQUEUE --queue-num 1");   // ICMP
+        system_print("ip6tables -I HIPFW-OUTPUT -p 17 -d 2001:0010::/28 -j NFQUEUE --queue-num 1");   // UDP
     } else if (ver_c < 27) {
         HIP_INFO("You are using kernel version %s. Userspace ipsec should"
                  " be used with versions below 2.6.27.\n", name.release);
@@ -223,15 +224,16 @@
         HIP_IFEL(userspace_ipsec_uninit(), -1, "failed to uninit user ipsec\n");
 
         // delete all rules previously set up for this extension
-        system_print("iptables -D HIPFW-INPUT -p 50 -j QUEUE 2> /dev/null");
-        system_print("iptables -D HIPFW-INPUT -p 17 --dport 10500 -j QUEUE 2> /dev/null");
-        system_print("iptables -D HIPFW-INPUT -p 17 --sport 10500 -j QUEUE 2> /dev/null");
-
-        system_print("ip6tables -D HIPFW-INPUT -p 50 -j QUEUE 2> /dev/null");
-
-        system_print("ip6tables -D HIPFW-OUTPUT -p 58 -d 2001:0010::/28 -j QUEUE 2> /dev/null");
-        system_print("ip6tables -D HIPFW-OUTPUT -p 6 -d 2001:0010::/28 -j QUEUE 2> /dev/null");
-        system_print("ip6tables -D HIPFW-OUTPUT -p 17 -d 2001:0010::/28 -j QUEUE 2> /dev/null");
+        system_print("iptables -D HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 0 2> /dev/null");                // ESP
+        system_print("iptables -D HIPFW-INPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 0 2> /dev/null");  // UDP
+        system_print("iptables -D HIPFW-INPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 0 2> /dev/null");  // UDP
+
+        system_print("ip6tables -D HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 1 2> /dev/null");               // IPv6-crypt
+
+        system_print("ip6tables -D HIPFW-OUTPUT -p 58 -d 2001:0010::/28 -j NFQUEUE --queue-num 1 2> /dev/null");    // IPv6-ICMP
+        system_print("ip6tables -D HIPFW-OUTPUT -p 6  -d 2001:0010::/28 -j NFQUEUE --queue-num 1 2> /dev/null");    // TCP
+        system_print("ip6tables -D HIPFW-OUTPUT -p 1  -d 2001:0010::/28 -j NFQUEUE --queue-num 1 2> /dev/null");    // ICMP
+        system_print("ip6tables -D HIPFW-OUTPUT -p 17 -d 2001:0010::/28 -j NFQUEUE --queue-num 1 2> /dev/null");    // UDP
     }
 
 out_err:
@@ -327,7 +329,7 @@
 static int fw_init_lsi_support(void)
 {
     struct hip_common *msg = NULL;
-    int err = 0;
+    int                err = 0;
 
     if (hip_lsi_support) {
         if (!(msg = hip_msg_alloc())) {
@@ -343,11 +345,11 @@
         free(msg);
 
         // add the rule
-        system_print("iptables -I HIPFW-OUTPUT -d " HIP_FULL_LSI_STR " -j QUEUE");
+        system_print("iptables -I HIPFW-OUTPUT -d " HIP_FULL_LSI_STR " -j NFQUEUE --queue-num 0");
 
         /* LSI support: incoming HIT packets, captured to decide if
          * HITs may be mapped to LSIs */
-        system_print("ip6tables -I HIPFW-INPUT -d 2001:0010::/28 -j QUEUE");
+        system_print("ip6tables -I HIPFW-INPUT -d 2001:0010::/28 -j NFQUEUE --queue-num 1");
     }
 
     return err;
@@ -361,16 +363,16 @@
 static int fw_uninit_lsi_support(void)
 {
     struct hip_common *msg = NULL;
-    int err = 0;
+    int                err = 0;
 
     if (hip_lsi_support) {
         // set global variable to off
         hip_lsi_support = 0;
 
         // remove the rule
-        system_print("iptables -D HIPFW-OUTPUT -d " HIP_FULL_LSI_STR " -j QUEUE 2> /dev/null");
+        system_print("iptables -D HIPFW-OUTPUT -d " HIP_FULL_LSI_STR " -j NFQUEUE --queue-num 0 2> /dev/null");
 
-        system_print("ip6tables -D HIPFW-INPUT -d 2001:0010::/28 -j QUEUE 2> /dev/null");
+        system_print("ip6tables -D HIPFW-INPUT -d 2001:0010::/28 -j NFQUEUE --queue-num 1 2> /dev/null");
 
         if (!(msg = hip_msg_alloc())) {
             HIP_ERROR("failed to allocate memory\n");
@@ -396,37 +398,37 @@
     if (filter_traffic) {
         // this will allow the firewall to handle HIP traffic
         // HIP protocol
-        system_print("iptables -I HIPFW-FORWARD -p 139 -j QUEUE");
+        system_print("iptables -I HIPFW-FORWARD -p 139 -j NFQUEUE --queue-num 0");
         // ESP protocol
-        system_print("iptables -I HIPFW-FORWARD -p 50 -j QUEUE");
+        system_print("iptables -I HIPFW-FORWARD -p 50 -j NFQUEUE --queue-num 0");
         // UDP encapsulation for HIP
-        system_print("iptables -I HIPFW-FORWARD -p 17 --dport 10500 -j QUEUE");
-        system_print("iptables -I HIPFW-FORWARD -p 17 --sport 10500 -j QUEUE");
-
-        system_print("iptables -I HIPFW-INPUT -p 139 -j QUEUE");
-        system_print("iptables -I HIPFW-INPUT -p 50 -j QUEUE");
-        system_print("iptables -I HIPFW-INPUT -p 17 --dport 10500 -j QUEUE");
-        system_print("iptables -I HIPFW-INPUT -p 17 --sport 10500 -j QUEUE");
-
-        system_print("iptables -I HIPFW-OUTPUT -p 139 -j QUEUE");
-        system_print("iptables -I HIPFW-OUTPUT -p 50 -j QUEUE");
-        system_print("iptables -I HIPFW-OUTPUT -p 17 --dport 10500 -j QUEUE");
-        system_print("iptables -I HIPFW-OUTPUT -p 17 --sport 10500 -j QUEUE");
-
-        system_print("ip6tables -I HIPFW-FORWARD -p 139 -j QUEUE");
-        system_print("ip6tables -I HIPFW-FORWARD -p 50 -j QUEUE");
-        system_print("ip6tables -I HIPFW-FORWARD -p 17 --dport 10500 -j QUEUE");
-        system_print("ip6tables -I HIPFW-FORWARD -p 17 --sport 10500 -j QUEUE");
-
-        system_print("ip6tables -I HIPFW-INPUT -p 139 -j QUEUE");
-        system_print("ip6tables -I HIPFW-INPUT -p 50 -j QUEUE");
-        system_print("ip6tables -I HIPFW-INPUT -p 17 --dport 10500 -j QUEUE");
-        system_print("ip6tables -I HIPFW-INPUT -p 17 --sport 10500 -j QUEUE");
-
-        system_print("ip6tables -I HIPFW-OUTPUT -p 139 -j QUEUE");
-        system_print("ip6tables -I HIPFW-OUTPUT -p 50 -j QUEUE");
-        system_print("ip6tables -I HIPFW-OUTPUT -p 17 --dport 10500 -j QUEUE");
-        system_print("ip6tables -I HIPFW-OUTPUT -p 17 --sport 10500 -j QUEUE");
+        system_print("iptables -I HIPFW-FORWARD -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-FORWARD -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
+
+        system_print("iptables -I HIPFW-INPUT -p 139 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-INPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-INPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
+
+        system_print("iptables -I HIPFW-OUTPUT -p 139 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-OUTPUT -p 50 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-OUTPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+        system_print("iptables -I HIPFW-OUTPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
+
+        system_print("ip6tables -I HIPFW-FORWARD -p 139 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-FORWARD -p 50 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-FORWARD -p 17 --dport 10500 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-FORWARD -p 17 --sport 10500 -j NFQUEUE --queue-num 1");
+
+        system_print("ip6tables -I HIPFW-INPUT -p 139 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-INPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-INPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 1");
+
+        system_print("ip6tables -I HIPFW-OUTPUT -p 139 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-OUTPUT -p 50 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-OUTPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 1");
+        system_print("ip6tables -I HIPFW-OUTPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 1");
     }
 }
 
@@ -435,35 +437,35 @@
  */
 static void firewall_uninit_filter_traffic(void)
 {
-    system_print("iptables -D HIPFW-FORWARD -p 139 -j QUEUE");
-    system_print("iptables -D HIPFW-FORWARD -p 50 -j QUEUE");
-    system_print("iptables -D HIPFW-FORWARD -p 17 --dport 10500 -j QUEUE");
-    system_print("iptables -D HIPFW-FORWARD -p 17 --sport 10500 -j QUEUE");
-
-    system_print("iptables -D HIPFW-INPUT -p 139 -j QUEUE");
-    system_print("iptables -D HIPFW-INPUT -p 50 -j QUEUE");
-    system_print("iptables -D HIPFW-INPUT -p 17 --dport 10500 -j QUEUE");
-    system_print("iptables -D HIPFW-INPUT -p 17 --sport 10500 -j QUEUE");
-
-    system_print("iptables -D HIPFW-OUTPUT -p 139 -j QUEUE");
-    system_print("iptables -D HIPFW-OUTPUT -p 50 -j QUEUE");
-    system_print("iptables -D HIPFW-OUTPUT -p 17 --dport 10500 -j QUEUE");
-    system_print("iptables -D HIPFW-OUTPUT -p 17 --sport 10500 -j QUEUE");
-
-    system_print("ip6tables -D HIPFW-FORWARD -p 139 -j QUEUE");
-    system_print("ip6tables -D HIPFW-FORWARD -p 50 -j QUEUE");
-    system_print("ip6tables -D HIPFW-FORWARD -p 17 --dport 10500 -j QUEUE");
-    system_print("ip6tables -D HIPFW-FORWARD -p 17 --sport 10500 -j QUEUE");
-
-    system_print("ip6tables -D HIPFW-INPUT -p 139 -j QUEUE");
-    system_print("ip6tables -D HIPFW-INPUT -p 50 -j QUEUE");
-    system_print("ip6tables -D HIPFW-INPUT -p 17 --dport 10500 -j QUEUE");
-    system_print("ip6tables -D HIPFW-INPUT -p 17 --sport 10500 -j QUEUE");
-
-    system_print("ip6tables -D HIPFW-OUTPUT -p 139 -j QUEUE");
-    system_print("ip6tables -D HIPFW-OUTPUT -p 50 -j QUEUE");
-    system_print("ip6tables -D HIPFW-OUTPUT -p 17 --dport 10500 -j QUEUE");
-    system_print("ip6tables -D HIPFW-OUTPUT -p 17 --sport 10500 -j QUEUE");
+    system_print("iptables -D HIPFW-FORWARD -p 139 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-FORWARD -p 50 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-FORWARD -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-FORWARD -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
+
+    system_print("iptables -D HIPFW-INPUT -p 139 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-INPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-INPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
+
+    system_print("iptables -D HIPFW-OUTPUT -p 139 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-OUTPUT -p 50 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-OUTPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 0");
+    system_print("iptables -D HIPFW-OUTPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 0");
+
+    system_print("ip6tables -D HIPFW-FORWARD -p 139 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-FORWARD -p 50 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-FORWARD -p 17 --dport 10500 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-FORWARD -p 17 --sport 10500 -j NFQUEUE --queue-num 1");
+
+    system_print("ip6tables -D HIPFW-INPUT -p 139 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-INPUT -p 50 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-INPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-INPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 1");
+
+    system_print("ip6tables -D HIPFW-OUTPUT -p 139 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-OUTPUT -p 50 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-OUTPUT -p 17 --dport 10500 -j NFQUEUE --queue-num 1");
+    system_print("ip6tables -D HIPFW-OUTPUT -p 17 --sport 10500 -j NFQUEUE --queue-num 1");
 }
 
 /**
@@ -530,8 +532,9 @@
 {
     int err = 0;
 
-    if (esp_relay == 0)
+    if (esp_relay == 0) {
         return 0;
+    }
 
     /* Required for ESP relay and might not be active */
     if (!filter_traffic) {
@@ -727,7 +730,7 @@
     char        cmd[40];
     int         mod_total;
     const char *mod_name[] = {
-        "ip_queue", "ip6_queue", "iptable_filter", "ip6table_filter"
+        "iptable_filter", "ip6table_filter"
     };
 
     mod_total = sizeof(mod_name) / sizeof(char *);
@@ -1296,6 +1299,43 @@
 }
 
 /**
+ * Build packet imitating the legacy libipq packets.
+ *
+ * This is to get a compilable version of the firewall out sooner,
+ * converting other functions to use
+ */
+static int build_ipq_packet(struct nfq_data *nfa, struct hip_ipq_packet_msg *ptr)
+{
+    struct nfqnl_msg_packet_hdr *ph;
+    struct nlif_handle          *nlifh;
+    ph = nfq_get_msg_packet_hdr(nfa);
+
+    // Open handle to read interface names from
+    nlifh = nlif_open();
+    if (nlifh == NULL) {
+        HIP_PERROR("nlif_open failed during build_ipq_packet");
+        return -1;
+    }
+    nlif_query(nlifh);      // query the interface table
+
+    // Populate the packet struct
+    ptr->packet_id = ntohl(ph->packet_id);
+    ptr->hook      = ph->hook;
+    nfq_get_indev_name(nlifh, nfa, ptr->indev_name);
+    nfq_get_outdev_name(nlifh, nfa, ptr->outdev_name);
+    ptr->data_len = nfq_get_payload(nfa, (void *) &ptr->payload);   // (void *) because old netfilter_queue used (char **) and
+                                                                    // current uses (unsigned char **). For this application
+                                                                    // either one is fine, but if we choose one, strict type
+                                                                    // checking causes compilation to fail for the other.
+                                                                    // Casting to (void *) omits compiler type checking and
+                                                                    // transfers the responsibility to the programmer.
+
+    // Close the interface handle
+    nlif_close(nlifh);
+    return 1;
+}
+
+/**
  *
  * Initialize context for a packet. The context stores e.g. the packet type and
  * possibly encapsulating packet type. It also stores useful pointers IP and
@@ -1308,28 +1348,31 @@
  * Unsupported types -> type 0
  *
  * @param  ctx        the context.
- * @param  buf        a pointer to a IP packet.
+ * @param  nfa        a pointer to the netfilter packet.
  * @param  ip_version the IP version for this packet
  * @return            One if @c hdr is a HIP packet, zero otherwise.
  */
 static int fw_init_context(struct hip_fw_context *ctx,
-                           const unsigned char *buf,
+                           struct nfq_data *nfa,
                            const int ip_version)
 {
     int err = 0;
     // length of packet starting at udp header
-    uint16_t       udp_len              = 0;
-    struct udphdr *udphdr               = NULL;
-    int            udp_encap_zero_bytes = 0;
+    uint16_t                         udp_len              = 0;
+    struct udphdr                   *udphdr               = NULL;
+    int                              udp_encap_zero_bytes = 0;
+    static struct hip_ipq_packet_msg packet;
 
     // same context memory as for packets before -> re-init
     memset(ctx, 0, sizeof(struct hip_fw_context));
+    memset(&packet, 0, sizeof(struct hip_ipq_packet_msg));
 
     // default assumption
     ctx->packet_type = OTHER_PACKET;
 
     // add whole packet to context and ip version
-    ctx->ipq_packet = ipq_get_packet(buf);
+    ctx->ipq_packet = &packet;
+    build_ipq_packet(nfa, ctx->ipq_packet);
 
     // check if packet is to big for the buffer
     if (ctx->ipq_packet->data_len > HIP_MAX_PACKET) {
@@ -1549,9 +1592,9 @@
  * @param handle    the handle for the packets.
  * @param packet_id the packet ID.
  */
-static void allow_packet(struct ipq_handle *handle, unsigned long packet_id)
+static void allow_packet(struct nfq_q_handle *handle, unsigned long packet_id)
 {
-    ipq_set_verdict(handle, packet_id, NF_ACCEPT, 0, NULL);
+    nfq_set_verdict(handle, packet_id, NF_ACCEPT, 0, NULL);
 
     HIP_DEBUG("Packet accepted \n\n");
 }
@@ -1562,88 +1605,84 @@
  * @param handle    the handle for the packets.
  * @param packet_id the packet ID.
  */
-static void drop_packet(struct ipq_handle *handle, unsigned long packet_id)
+static void drop_packet(struct nfq_q_handle *handle, unsigned long packet_id)
 {
-    ipq_set_verdict(handle, packet_id, NF_DROP, 0, NULL);
+    nfq_set_verdict(handle, packet_id, NF_DROP, 0, NULL);
 
     HIP_DEBUG("Packet dropped \n\n");
 }
 
 /**
  * Analyze a packet.
- *
- * @param buf the packet to be analyzed
- * @param hndl a file handle to the ipqueue
- * @param ip_version the type of traffic: 4 - ipv4; 6 - ipv6.
- * @param ctx packet context
- *
- * @return always 0
+ * This is a callback function for netfilter_queue.
+ *
+ * @param qh the netfilter queue handle
+ * @param nfmsg the netfilter message
+ * @param nfa the netfilter packet, header and payload
+ * @param data
+ * @param ip_version the IP version used
  */
-static int fw_handle_packet(unsigned char *buf, struct ipq_handle *hndl,
-                            const int ip_version, struct hip_fw_context *ctx)
+static int fw_handle_packet(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
+                            struct nfq_data *nfa, void *data, const int ip_version)
 {
-    // assume DROP
-    int verdict = 0;
-
-    /* waits for queue messages to arrive from ip_queue and
-     * copies them into a supplied buffer */
-    if (ipq_read(hndl, buf, HIP_MAX_PACKET, 0) < 0) {
-        HIP_PERROR("ipq_read failed: ");
-        // TODO this error needs to be handled seperately -> die(hndl)?
-        goto out_err;
-    }
-
-    /* queued messages may be a packet messages or an error messages */
-    switch (ipq_message_type(buf)) {
-    case IPQM_PACKET:
-        HIP_DEBUG("Received ipqm packet\n");
-        // no goto -> go on with processing the message below
-        break;
-    case NLMSG_ERROR:
-        HIP_ERROR("Received error message (%d): %s\n", ipq_get_msgerr(buf),
-                  ipq_errstr());
-        goto out_err;
-        break;
-    default:
-        HIP_DEBUG("Unsupported libipq packet\n");
-        goto out_err;
-        break;
-    }
+    static struct hip_fw_context ctx;   // static because of heavy re-use.
+    int                          verdict = 0; // assume DROP
+
+    // Intentionally unused, remove compiler warnings.
+    (void) nfmsg;
+    (void) data;
+
+
+    HIP_DEBUG("Entering netfilter callback for IPv%d\n", ip_version);
 
     // set up firewall context
-    if (fw_init_context(ctx, buf, ip_version)) {
+    if (fw_init_context(&ctx, nfa, ip_version)) {
         goto out_err;
     }
 
-    HIP_DEBUG("packet hook=%d, packet type=%d\n", ctx->ipq_packet->hook,
-              ctx->packet_type);
+    HIP_DEBUG("packet hook=%d, packet type=%d\n", ctx.ipq_packet->hook,
+              ctx.packet_type);
 
     // match context with rules
-    if (fw_handlers[ctx->ipq_packet->hook][ctx->packet_type]) {
-        verdict = (fw_handlers[ctx->ipq_packet->hook][ctx->packet_type])(ctx);
+    if (fw_handlers[ctx.ipq_packet->hook][ctx.packet_type]) {
+        verdict = (fw_handlers[ctx.ipq_packet->hook][ctx.packet_type])(&ctx);
     } else {
-        HIP_DEBUG("Ignoring, no handler for hook (%d) with type (%d)\n");
+        HIP_DEBUG("Ignoring, no handler for hook (%d) with type (%d)\n", ctx.ipq_packet->hook,
+                  ctx.packet_type);
     }
 
+
 out_err:
     if (verdict) {
-        if (ctx->modified == 0) {
+        if (ctx.modified == 0) {
             HIP_DEBUG("=== Verdict: allow packet ===\n");
-            allow_packet(hndl, ctx->ipq_packet->packet_id);
+            allow_packet(qh, ctx.ipq_packet->packet_id);
         } else {
             HIP_DEBUG("=== Verdict: allow modified packet ===\n");
-            allow_modified_packet(hndl, ctx);
+            allow_modified_packet(qh, &ctx);
         }
     } else {
         HIP_DEBUG("=== Verdict: drop packet ===\n");
-        drop_packet(hndl, ctx->ipq_packet->packet_id);
+        drop_packet(qh, ctx.ipq_packet->packet_id);
     }
 
-    // nothing to clean up here as we re-use buf, hndl and ctx
+    // nothing to clean up here.
 
     return 0;
 }
 
+static int netfilter_callback_ipv4(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
+                                   struct nfq_data *nfa, void *data)
+{
+    return fw_handle_packet(qh, nfmsg, nfa, data, 4);
+}
+
+static int netfilter_callback_ipv6(struct nfq_q_handle *qh, struct nfgenmsg *nfmsg,
+                                   struct nfq_data *nfa, void *data)
+{
+    return fw_handle_packet(qh, nfmsg, nfa, data, 6);
+}
+
 /**
  * Receive and process one message from hipd.
  *
@@ -1763,14 +1802,16 @@
                const bool        kill_old,
                const bool        limit_capabilities)
 {
-    int                   err       = 0, highest_descriptor, i;
-    struct ipq_handle    *h4        = NULL, *h6 = NULL;
-    struct hip_common    *msg       = NULL;
-    struct sockaddr_in6   sock_addr = { 0 };
-    fd_set                read_fdset;
-    struct timeval        timeout;
-    unsigned char         buf[HIP_MAX_PACKET];
-    struct hip_fw_context ctx;
+    int                  err   = 0, highest_descriptor, i;
+    struct nfq_handle   *h4    = NULL, *h6    = NULL;
+    struct nfq_q_handle *h4_q  = NULL, *h6_q  = NULL;
+    int                  h4_fd = 0,     h6_fd = 0;
+    int                  nfq_packet_length;
+    struct hip_common   *msg       = NULL;
+    struct sockaddr_in6  sock_addr = { 0 };
+    fd_set               read_fdset;
+    struct timeval       timeout;
+    char                 buf[HIP_MAX_PACKET];
 
 #ifdef CONFIG_HIP_PERFORMANCE
     HIP_DEBUG("Creating perf set\n");
@@ -1848,19 +1889,39 @@
     firewall_probe_kernel_modules();
 
     // create firewall queue handles for IPv4 traffic
-    HIP_IFEL(!(h4 = ipq_create_handle(0, PF_INET)), -1,
-             "ipq_create_handle(): %s\n", ipq_errstr());
-    HIP_IFEL(ipq_set_mode(h4, IPQ_COPY_PACKET, HIP_MAX_PACKET) == -1, -1,
-             "ipq_set_mode(): %s\n", ipq_errstr());
+    HIP_IFEL(!(h4 = nfq_open()), -1,
+             "nfq_open(): %s\n", "Error during nfq_open(), IPv4");
+    HIP_IFEL((nfq_unbind_pf(h4, AF_INET) < 0), -1,
+             "nfq_unbind(): %s\n", "Error during Netfilter initialization (IPv4). Is the obsolete 'ip_queue' kernel module loaded?"); // Unbinding any previous handlers
+    HIP_IFEL((nfq_bind_pf(h4, AF_INET) < 0), -1,
+             "nfq_bind(): %s\n", "Error during nfq_bind(), IPv4");
+    HIP_IFEL(!(h4_q = nfq_create_queue(h4, 0, &netfilter_callback_ipv4, NULL)), -1,
+             "nfq_create_queue(): %s\n", "Error during nfq_create_queue(), IPv4");
+    HIP_IFEL(nfq_set_mode(h4_q, NFQNL_COPY_PACKET, HIP_MAX_PACKET) == -1, -1,
+             "nfq_set_mode(): %s\n", "Error during nfq_set_mode(), IPv4");
     HIP_DEBUG("IPv4 handle created (mode COPY_PACKET)\n");
 
     // create firewall queue handles for IPv6 traffic
-    HIP_IFEL(!(h6 = ipq_create_handle(0, PF_INET6)), -1,
-             "ipq_create_handle(): %s\n", ipq_errstr());
-    HIP_IFEL(ipq_set_mode(h6, IPQ_COPY_PACKET, HIP_MAX_PACKET) == -1, -1,
-             "ipq_set_mode(): %s\n", ipq_errstr());
+    HIP_IFEL(!(h6 = nfq_open()), -1,
+             "nfq_open(): %s\n", "Error during nfq_open(), IPv6");
+    HIP_IFEL((nfq_unbind_pf(h6, AF_INET6) < 0), -1,
+             "nfq_unbind(): %s\n", "Error during Netfilter initialization (IPv6). Is the obsolete 'ip6_queue' kernel module loaded?"); // Unbinding any previous handlers
+    HIP_IFEL((nfq_bind_pf(h6, AF_INET6) < 0), -1,
+             "nfq_bind(): %s\n", "Error during nfq_bind(), IPv6");
+    HIP_IFEL(!(h6_q = nfq_create_queue(h6, 1, &netfilter_callback_ipv6, NULL)), -1,
+             "nfq_create_queue(): %s\n", "Error during nfq_create_queue(), IPv6");
+    HIP_IFEL(nfq_set_mode(h6_q, NFQNL_COPY_PACKET, HIP_MAX_PACKET) == -1, -1,
+             "nfq_set_mode(): %s\n", "Error during nfq_set_mode(), IPv6");
     HIP_DEBUG("IPv6 handle created (mode COPY_PACKET)\n");
 
+    // Create file handles for the queues
+    HIP_IFEL(!(h4_fd = nfq_fd(h4)), -1,
+             "nfq_fd(): %s\n", "Unable to get file descriptor, IPv4");
+    HIP_DEBUG("IPv4 file descriptor created\n");
+    HIP_IFEL(!(h6_fd = nfq_fd(h6)), -1,
+             "nfq_fd(): %s\n", "Unable to get file descriptor, IPv6");
+    HIP_DEBUG("IPv6 file descriptor created\n");
+
     // set up ip(6)tables rules and firewall extensions
     HIP_IFEL(firewall_init(), -1, "Firewall init failed\n");
 
@@ -1868,8 +1929,8 @@
         HIP_IFEL(hip_set_lowcapability(), -1, "Failed to reduce privileges\n");
     }
 
-    highest_descriptor = hip_fw_async_sock > h4->fd ? hip_fw_async_sock : h4->fd;
-    highest_descriptor = h6->fd > highest_descriptor ? h6->fd : highest_descriptor;
+    highest_descriptor = hip_fw_async_sock > h4_fd ? hip_fw_async_sock : h4_fd;
+    highest_descriptor = h6_fd > highest_descriptor ? h6_fd : highest_descriptor;
 
     /* Allocate message. */
     HIP_IFEL(!(msg = hip_msg_alloc()), -1, "Insufficient memory\n");
@@ -1885,8 +1946,8 @@
         // set up file descriptors for select
         FD_ZERO(&read_fdset);
         FD_SET(hip_fw_async_sock, &read_fdset);
-        FD_SET(h4->fd, &read_fdset);
-        FD_SET(h6->fd, &read_fdset);
+        FD_SET(h4_fd, &read_fdset);
+        FD_SET(h6_fd, &read_fdset);
 
         timeout.tv_sec  = HIP_SELECT_TIMEOUT;
         timeout.tv_usec = 0;
@@ -1899,14 +1960,26 @@
             continue;
         }
 
-        if (FD_ISSET(h4->fd, &read_fdset)) {
-            HIP_DEBUG("received IPv4 packet from iptables queue\n");
-            err = fw_handle_packet(buf, h4, 4, &ctx);
+        if (FD_ISSET(h4_fd, &read_fdset)) {
+            nfq_packet_length = recv(h4_fd, buf, HIP_MAX_PACKET, 0);
+            if (nfq_packet_length == -1) {
+                err = errno;
+                HIP_PERROR("Error reading received IPv4 packet.\n");
+            } else if (nfq_packet_length > 0) {
+                HIP_DEBUG("received IPv4 packet from iptables queue\n");
+                err = nfq_handle_packet(h4, buf, nfq_packet_length);
+            }
         }
 
-        if (FD_ISSET(h6->fd, &read_fdset)) {
-            HIP_DEBUG("received IPv6 packet from iptables queue\n");
-            err = fw_handle_packet(buf, h6, 6, &ctx);
+        if (FD_ISSET(h6_fd, &read_fdset)) {
+            nfq_packet_length = recv(h6_fd, buf, HIP_MAX_PACKET, 0);
+            if (nfq_packet_length == -1) {
+                err = errno;
+                HIP_PERROR("Error reading received IPv6 packet.\n");
+            } else if (nfq_packet_length > 0) {
+                HIP_DEBUG("received IPv6 packet from iptables queue\n");
+                err = nfq_handle_packet(h6, buf, nfq_packet_length);
+            }
         }
 
         if (FD_ISSET(hip_fw_async_sock, &read_fdset)) {
@@ -1919,11 +1992,19 @@
     }
 
 out_err:
+    if (h4_q) {
+        nfq_destroy_queue(h4_q);
+    }
     if (h4) {
-        ipq_destroy_handle(h4);
+        // nfq_unbind_pf(h4, AF_INET);  /* This command is dangerous because it unbinds other programs too */
+        nfq_close(h4);
+    }
+    if (h6_q) {
+        nfq_destroy_queue(h6_q);
     }
     if (h6) {
-        ipq_destroy_handle(h6);
+        // nfq_unbind_pf(h6, AF_INET6); /* This command is dangerous because it unbinds other programs too */
+        nfq_close(h6);
     }
     if (hip_fw_async_sock) {
         close(hip_fw_async_sock);

=== modified file 'hipfw/hipfw_defines.h'
--- hipfw/hipfw_defines.h	2012-05-12 06:54:33 +0000
+++ hipfw/hipfw_defines.h	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010-2012 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010-2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -28,13 +28,13 @@
 
 #define _BSD_SOURCE
 
-#include <libipq.h>
 #include <stdint.h>
 #include <stdbool.h>
 #include <netinet/in.h>
 #include <netinet/ip6.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
 
 #include "libcore/common.h"
 #include "libcore/linkedlist.h"
@@ -53,6 +53,19 @@
 };
 
 /**
+ *  @note Backwards-compatibility header with the depracated libipq library
+ *
+ */
+typedef struct hip_ipq_packet_msg {
+    unsigned long  packet_id;
+    unsigned int   hook;
+    char           indev_name[IFNAMSIZ];
+    char           outdev_name[IFNAMSIZ];
+    size_t         data_len;
+    unsigned char *payload;
+} hip_ipq_packet_msg_t;
+
+/**
  * @note When adding new members, check if hip_fw_context_enable_write() needs
  *       to be updated as well.
  * @see hip_fw_context_enable_write()
@@ -60,7 +73,7 @@
  */
 struct hip_fw_context {
     // queued packet
-    ipq_packet_msg_t *ipq_packet;
+    hip_ipq_packet_msg_t *ipq_packet;
 
     // IP layer information
     int             ip_version;   /* 4, 6 */

=== modified file 'hipfw/lsi.c'
--- hipfw/lsi.c	2012-05-12 06:54:33 +0000
+++ hipfw/lsi.c	2013-08-01 14:18:46 +0000
@@ -44,7 +44,6 @@
 
 #define _BSD_SOURCE
 
-#include <libipq.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
@@ -54,6 +53,7 @@
 #include <netinet/ip_icmp.h>
 #include <netinet/tcp.h>
 #include <netinet/udp.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
 
 #include "libcore/builder.h"
 #include "libcore/icomm.h"
@@ -204,7 +204,7 @@
  */
 static int reinject_packet(const struct in6_addr *src_hit,
                            const struct in6_addr *dst_hit,
-                           const ipq_packet_msg_t *m,
+                           const hip_ipq_packet_msg_t *m,
                            const int ip_orig_traffic,
                            const int incoming)
 {
@@ -292,7 +292,7 @@
  * @return            1 if translation not done
  *                    0 if packet reinjected with lsis as addresses
  */
-int hip_fw_handle_incoming_hit(const ipq_packet_msg_t *m,
+int hip_fw_handle_incoming_hit(const hip_ipq_packet_msg_t *m,
                                const struct in6_addr *ip_src,
                                const struct in6_addr *ip_dst,
                                const int lsi_support)
@@ -384,7 +384,7 @@
  * @param lsi_dst     destination LSI
  * @return            err during the BEX
  */
-int hip_fw_handle_outgoing_lsi(ipq_packet_msg_t *m, struct in_addr *lsi_src,
+int hip_fw_handle_outgoing_lsi(hip_ipq_packet_msg_t *m, struct in_addr *lsi_src,
                                struct in_addr *lsi_dst)
 {
     int                              err        = 0;

=== modified file 'hipfw/lsi.h'
--- hipfw/lsi.h	2012-05-12 06:54:33 +0000
+++ hipfw/lsi.h	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010, 2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -28,10 +28,11 @@
 
 #define _BSD_SOURCE
 
-#include <libipq.h>
 #include <netinet/in.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
 
 #include "libcore/protodefs.h"
+#include "hipfw_defines.h"
 
 int hip_trigger_bex(const struct in6_addr *src_hit,
                     const struct in6_addr *dst_hit,
@@ -39,12 +40,12 @@
                     const hip_lsi_t *dst_lsi,
                     const struct in6_addr *src_ip,
                     const struct in6_addr *dst_ip);
-int hip_fw_handle_incoming_hit(const ipq_packet_msg_t *m,
+int hip_fw_handle_incoming_hit(const hip_ipq_packet_msg_t *m,
                                const struct in6_addr *ip_src,
                                const struct in6_addr *ip_dst,
                                const int lsi_support);
 
-int hip_fw_handle_outgoing_lsi(ipq_packet_msg_t *m,
+int hip_fw_handle_outgoing_lsi(hip_ipq_packet_msg_t *m,
                                struct in_addr *ip_src,
                                struct in_addr *ip_dst);
 

=== modified file 'hipfw/rewrite.c'
--- hipfw/rewrite.c	2012-05-12 06:54:33 +0000
+++ hipfw/rewrite.c	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2011, 2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -54,17 +54,16 @@
  *       more thoroughly, these optimizations should be considered hacks (and
  *       are thus not used here).
  *
- * @author Christof Mroz <[e-mail]>
  */
 
 #define _BSD_SOURCE
 
 #include <netinet/in.h>
-#include <linux/netfilter.h>
-#include <libipq.h>
 #include <limits.h>
 #include <stdlib.h>
 #include <string.h>
+#include <linux/netfilter.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
 
 #include "libcore/builder.h"
 #include "libcore/debug.h"
@@ -75,8 +74,8 @@
 static const bool assume_ipq_buffer_sufficient = false;
 
 struct scratch_buffer {
-    ipq_packet_msg_t ipq;
-    uint8_t         *payload[HIP_MAX_PACKET];
+    hip_ipq_packet_msg_t ipq;
+    uint8_t             *payload[HIP_MAX_PACKET];
 } __attribute__((packed)); // no gaps between header and payload
 
 static struct scratch_buffer scratch_buffer;
@@ -316,7 +315,7 @@
  * @param handle libipq file handle
  * @param ctx The current packet context.
  */
-void allow_modified_packet(struct ipq_handle *const handle,
+void allow_modified_packet(struct nfq_q_handle *const handle,
                            struct hip_fw_context *const ctx)
 {
     HIP_ASSERT(ctx->modified);
@@ -373,7 +372,7 @@
         }
     }
 
-    ipq_set_verdict(handle, ctx->ipq_packet->packet_id, NF_ACCEPT,
+    nfq_set_verdict(handle, ctx->ipq_packet->packet_id, NF_ACCEPT,
                     ctx->ipq_packet->data_len, ctx->ipq_packet->payload);
     HIP_DEBUG("Packet accepted with modifications\n\n");
 }

=== modified file 'hipfw/rewrite.h'
--- hipfw/rewrite.h	2011-11-25 13:52:20 +0000
+++ hipfw/rewrite.h	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2011, 2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -33,7 +33,7 @@
 
 bool hipfw_splice_param(struct hip_fw_context *const ctx,
                         const struct hip_tlv_common *const param);
-void allow_modified_packet(struct ipq_handle *const handle,
+void allow_modified_packet(struct nfq_q_handle *const handle,
                            struct hip_fw_context *const ctx);
 
 #endif /* HIPL_HIPFW_REWRITE_H */

=== modified file 'packaging/hipl.spec'
--- packaging/hipl.spec	2013-01-29 11:49:17 +0000
+++ packaging/hipl.spec	2013-08-01 14:18:46 +0000
@@ -7,7 +7,7 @@
 Vendor: InfraHIP
 License: GPLv2
 Group: System Environment/Daemons
-BuildRequires: gcc autoconf automake libtool xmlto w3m openssl-devel iptables-devel python >= 2.4.3
+BuildRequires: gcc autoconf automake libtool xmlto w3m openssl-devel iptables-devel python >= 2.4.3 libnetfilter_queue-devel
 BuildRoot: %{_tmppath}/%{name}-%{version}-root
 
 %description
@@ -55,7 +55,7 @@
 HIP for Linux IPsec key management and mobility daemon.
 
 %package firewall
-Requires: openssl iptables
+Requires: openssl iptables libnetfilter_queue
 Summary: HIPL multi-purpose firewall daemon
 Group: System Environment/Daemons
 %description firewall

=== modified file 'packaging/openwrt/hipl/Makefile.in'
--- packaging/openwrt/hipl/Makefile.in	2012-03-19 12:32:25 +0000
+++ packaging/openwrt/hipl/Makefile.in	2013-08-01 14:18:46 +0000
@@ -57,7 +57,7 @@
 
 define Package/hipl-firewall
     $(call Package/hipl/Default)
-    DEPENDS:=+libconfig +iptables +ip6tables +kmod-ipt-queue
+    DEPENDS:=+libconfig +iptables +ip6tables +kmod-ipt-queue +libnetfilter-queue
     TITLE:=HIPL firewall
 endef
 

=== modified file 'test/check_hipfw.c'
--- test/check_hipfw.c	2011-11-25 13:52:20 +0000
+++ test/check_hipfw.c	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010, 2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -38,7 +38,6 @@
     srunner_add_suite(sr, firewall_line_parser());
     srunner_add_suite(sr, firewall_midauth());
     srunner_add_suite(sr, firewall_port_bindings());
-    srunner_add_suite(sr, firewall_rewrite());
 
     srunner_run_all(sr, CK_NORMAL);
     number_failed = srunner_ntests_failed(sr);

=== removed file 'test/hipfw/rewrite.c'
--- test/hipfw/rewrite.c	2012-05-12 06:54:33 +0000
+++ test/hipfw/rewrite.c	1970-01-01 00:00:00 +0000
@@ -1,131 +0,0 @@
-/*
- * Copyright (c) 2011-2012 Aalto University and RWTH Aachen University.
- *
- * Permission is hereby granted, free of charge, to any person
- * obtaining a copy of this software and associated documentation
- * files (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use,
- * copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the
- * Software is furnished to do so, subject to the following
- * conditions:
- *
- * The above copyright notice and this permission notice shall be
- * included in all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
- * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
- * OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
- * NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
- * HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
- * WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
- * OTHER DEALINGS IN THE SOFTWARE.
- */
-
-#define _BSD_SOURCE
-
-#include <check.h>
-#include <stdlib.h>
-#include <string.h>
-
-#include "hipfw/hipfw_defines.h"
-#include "libcore/common.h"
-#include "modules/midauth/hipd/midauth.h"
-#include "modules/midauth/lib/midauth_builder.h"
-#include "test/mocks.h"
-#include "test_suites.h"
-
-#include "hipfw/hipfw.c"
-
-
-static const unsigned char tmp_ipq_packet[] = "\xA0\x85\x07\x12\x00\x88\xFF\xFF\x00\x00"
-                                              "\x00\x00\x00\x00\x00\x00\xD3\x98\x81\x4E\x00\x00\x00\x00\x27\x21\x0D"
-                                              "\x00\x00\x00\x00\x00\x02\x00\x00\x00\x65\x74\x68\x31\x00\x00\x00\x00"
-                                              "\x00\x00\x00\x00\x00\x00\x00\x00\x65\x74\x68\x32\x00\x00\x00\x00\x00"
-                                              "\x00\x00\x00\x00\x00\x00\x00\x08\x00\x01\x00\x06\x08\x00\x27\x45\x4D"
-                                              "\x26\x00\x00\x00\x00\x00\x00\x00\x00\x00\xA0\x02\x00\x00\x00\x00\x00"
-                                              "\x00\x45\x00\x02\xA0\x00\x00\x40\x00\x3F\x11\xB3\xEF\xC0\xA8\x01\x0A"
-                                              "\xC0\xA8\x03\x03\x29\x04\x29\x04\x02\x8C\x00\x00\x00\x00\x00\x00\x3B"
-                                              "\x4F\x03\x11\x00\x00\x00\x00\x20\x01\x00\x1B\xD8\xB0\x77\xF0\xC6\x17"
-                                              "\x71\x70\xDE\xD7\xF3\x20\x20\x01\x00\x17\x5D\xF8\xC4\x26\x98\xE5\x5F"
-                                              "\xA2\x28\x6D\x28\x47\x00\x41\x00\x0C\x00\x00\x00\x48\x00\x00\x00\x00"
-                                              "\x2D\x4A\x07\x08\x01\x41\x00\x14\x00\x00\x48\x49\x90\x7D\xD8\x95\x84"
-                                              "\xB3\x8D\xDC\x18\x25\xF9\x65\xE3\x31\x3E\xDD\x01\x42\x00\x1C\x01\x02"
-                                              "\x82\xEC\x42\x00\x00\x00\x00\x00\x5A\x3C\x03\x14\x9A\x0E\x9D\xCA\xF0"
-                                              "\x19\xAD\x2B\xBA\x43\x33\x66\xF8\xB2\x02\x01\x00\xC3\x03\x00\xC0\x7C"
-                                              "\xDA\x02\x1F\xB7\xFE\x85\xBB\xD1\x93\xFD\xB2\xFB\xC0\xB1\xAD\x09\x61"
-                                              "\x1F\x8E\xDD\x8F\x1B\xFC\xC3\x97\xA1\xCE\x4C\x55\x85\xB4\x4A\x8B\x66"
-                                              "\x93\x2A\xDF\x85\xC0\x3A\x84\xA2\x22\x4F\xB3\xF9\x6F\xC5\x54\x23\x9D"
-                                              "\xC2\x03\xEB\xB9\x55\xA4\xF0\x19\xC0\x2B\x4C\xD1\xBF\xC9\x04\xF5\x32"
-                                              "\xAB\x39\xEF\x7B\xF9\xA7\xAB\x5A\xC5\x27\x5E\x21\x83\x48\xB0\x8E\x19"
-                                              "\xB4\x51\x2B\xBA\x79\x00\x62\x70\x48\xF3\x44\xAE\x49\xD4\xC9\x20\x74"
-                                              "\x38\x0D\x11\xCA\xB3\x6F\x03\x47\x9A\x39\xA5\xFB\xC0\x70\xD6\xB5\xB6"
-                                              "\x35\x08\xB4\xB0\x33\x19\xF9\x07\x3C\x82\x7D\x3C\x16\x0C\x74\x9A\x1F"
-                                              "\x9B\xB2\xE6\xB3\xC7\xB3\x08\xE2\x10\x66\x23\x95\xF6\x00\xC7\x57\x8B"
-                                              "\x19\x83\x9E\x6F\xB6\x9D\x6A\x44\x25\xF1\xFD\x45\xFB\xD4\xD9\xE8\xA7"
-                                              "\xD5\xF9\xA7\xA5\xFB\xA3\x23\xD2\xDE\x67\x15\x9C\x6C\xFB\x5B\x08\xAC"
-                                              "\x7F\xC9\xF9\xD7\x00\x02\x41\x00\x02\x00\x01\x00\x00\x02\xC1\x00\x92"
-                                              "\x00\x88\x10\x06\x02\x02\xFF\x05\x03\x01\x00\x01\xD6\xBD\x7C\x86\xC3"
-                                              "\x4A\xA3\x93\x7F\xD9\x82\xBD\x22\xF1\xC7\x4F\x72\x76\x4F\x2F\x68\xF7"
-                                              "\x4F\x9D\xCE\xF3\xAE\xD4\x3B\x13\x5D\xC1\xF7\xF8\x09\x4E\xB4\xCD\x82"
-                                              "\x6F\xF8\xD1\x70\x01\x4E\xC0\x64\x82\xF1\x7E\x21\x54\x62\x73\x08\xEA"
-                                              "\x0A\x66\x1B\xA7\x9A\x4A\xAA\x17\x56\x77\x1D\x4D\x0D\xD2\x19\x92\xA0"
-                                              "\xAC\xF7\x23\x62\xE2\xF0\xFB\x1E\x73\x19\x16\x61\x1B\x85\x02\x42\x4B"
-                                              "\x89\x46\x09\x71\x42\x6F\x40\x8E\x62\x31\xA6\x4F\x17\x45\xF2\x7B\xFA"
-                                              "\xF2\xB6\xC8\x87\x37\x3A\xDF\xBB\x10\xE8\xDA\x97\x31\x6C\x38\xDF\xD0"
-                                              "\x97\x45\x84\x39\x61\x6C\x69\x63\x65\x00\x00\x00\x0F\xFF\x00\x04\x00"
-                                              "\x00\x00\x01\xF0\x41\x00\x14\xE7\x35\x6F\x89\x30\x3E\x1E\xA7\xFB\x93"
-                                              "\x8B\xBE\xD1\x34\x1F\x35\xB8\xE0\x82\x0C\xF1\x01\x00\x81\x05\xA6\xA2"
-                                              "\x75\xEF\xA8\xC3\x9C\x64\x9E\x9A\xDA\xFB\x38\xB4\x05\x8C\x6A\x6E\x5B"
-                                              "\x59\x9F\x11\x5B\xA6\xC0\x05\x42\xA6\x0D\x9C\x62\x17\x0E\x23\xB6\x3B"
-                                              "\x15\xB8\xEC\x6F\xE3\xB6\x6E\x80\x76\x97\xBE\x5B\x5B\x1A\x90\x30\xDF"
-                                              "\x1F\x32\x2C\x4E\x22\x20\x0B\xD4\x2B\x5B\x7C\xEF\x27\xEA\xB9\x80\x27"
-                                              "\xEF\xBC\xB4\xAF\x97\x2A\xD5\x86\xDA\xEE\x2C\xF0\x8B\x45\x00\x10\xE1"
-                                              "\x3A\x95\x35\xAC\x7C\xA8\x88\xC1\x60\xB9\x71\xD3\xE2\x29\xF7\x75\xD0"
-                                              "\x7E\x27\x1B\x21\x43\xAE\xBB\x08\xE1\x6B\x9E\x1E\xB9\x55\x89\xE3\x2B"
-                                              "\x29\x06\x4A\xA2\x90\x98\x38\x00\x00\x00";
-static const uint8_t opaque[] = "\x01\x41\x01\x14\x05\x00\x48\x49\x0b"
-                                "\x02\x42\x02\x15\x06\x08\x49\x50\x0c";
-
-#ifdef HAVE_TCASE_ADD_EXIT_TEST
-START_TEST(hipfw_splice_param_NULL_ctx)
-{
-    struct hip_common           *tmp_msg = NULL;
-    const struct hip_tlv_common *param   = NULL;
-
-    tmp_msg = hip_msg_alloc();
-    hip_build_param_challenge_request(tmp_msg, 0, 0, opaque,
-                                      MIDAUTH_DEFAULT_NONCE_LENGTH);
-    param = hip_get_param(tmp_msg, HIP_PARAM_CHALLENGE_REQUEST);
-
-    fail_unless(hipfw_splice_param(NULL, param) == false, NULL);
-}
-END_TEST
-
-START_TEST(hipfw_splice_param_NULL_param)
-{
-    struct hip_fw_context ctx;
-
-    mock_ipq         = true;
-    mock_ipq_pkt_len = ARRAY_SIZE(tmp_ipq_packet);
-
-    fail_unless(fw_init_context(&ctx, tmp_ipq_packet, 4) == 0, NULL);
-    fail_unless(hipfw_splice_param(&ctx, NULL) == false, NULL);
-}
-END_TEST
-#endif
-
-Suite *firewall_rewrite(void)
-{
-    Suite *s          = suite_create("hipfw/rewrite");
-    TCase *tc_rewrite = tcase_create("rewrite");
-
-#ifdef HAVE_TCASE_ADD_EXIT_TEST
-    tcase_add_exit_test(tc_rewrite, hipfw_splice_param_NULL_ctx, 1);
-    tcase_add_exit_test(tc_rewrite, hipfw_splice_param_NULL_param, 1);
-#endif
-    suite_add_tcase(s, tc_rewrite);
-
-    return s;
-}

=== modified file 'test/hipfw/test_suites.h'
--- test/hipfw/test_suites.h	2011-11-25 17:56:24 +0000
+++ test/hipfw/test_suites.h	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2010 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2010, 2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -34,6 +34,5 @@
 Suite *firewall_line_parser(void);
 Suite *firewall_midauth(void);
 Suite *firewall_port_bindings(void);
-Suite *firewall_rewrite(void);
 
 #endif /* HIPL_TEST_FIREWALL_TEST_SUITES_H */

=== modified file 'test/mocks.c'
--- test/mocks.c	2011-10-19 11:57:13 +0000
+++ test/mocks.c	2013-08-01 14:18:46 +0000
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011 Aalto University and RWTH Aachen University.
+ * Copyright (c) 2011, 2013 Aalto University and RWTH Aachen University.
  *
  * Permission is hereby granted, free of charge, to any person
  * obtaining a copy of this software and associated documentation
@@ -87,7 +87,7 @@
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
-#include <libipq.h>
+#include <libnetfilter_queue/libnetfilter_queue.h>
 
 #include "mocks.h"
 
@@ -190,28 +190,3 @@
 
     return EXIT_SUCCESS;
 }
-
-/*** ipq_get_packet(3) ***/
-bool         mock_ipq         = false;
-unsigned int mock_ipq_pkt_len = 0;
-
-/**
- * ipq_get_packet(3) mock function. Controlled by the ::mock_ipq flag.
- *
- * @param buf   contents of the returned ipq_packet_msg_t
- * @return      a fully filled ipq_packet_msg_t
- *
- * @note The buffer length is required for this mock function. You can provide
- *       it via the ::mock_ipq_pkt_len flag.
- */
-ipq_packet_msg_t *ipq_get_packet(const unsigned char *buf)
-{
-    if (!mock_ipq) {
-        ipq_packet_msg_t *(*original)(const unsigned char *) = get_original(ipq_get_packet, "ipq_get_packet");
-        return original(buf);
-    } else {
-        char *tmp = malloc(mock_ipq_pkt_len);
-        memcpy(tmp, buf, mock_ipq_pkt_len);
-        return (ipq_packet_msg_t *) tmp;
-    }
-}