Htykuut

I wrote a program to listen to iptables modification through netlink sockets, for this I used NETLINK_AUDIT family, when I execute the program and modify the iptables rule, program doesn't receive any message from kernel and it will be in blocking mode only. Could you help me to find what is wrong in this program or what else I need to do to receive iptables notification.

#include "libaudit.h"

#include <stdio.h>

#include <string.h>

#include <unistd.h>



int main()

{

        int rc;

        struct audit_message rep;

        int fd;

        struct sockaddr_nl sa;



        memset(&sa, 0, sizeof(sa));

        sa.nl_family = AF_NETLINK;

        sa.nl_groups = 0; 



        fd = audit_open();



        bind(fd, (struct sockaddr *) &sa, sizeof(sa));



        rc = audit_get_reply(fd, &rep, GET_REPLY_BLOCKING, 0);

        if(rc < 0)

        {

                printf("Error");

        }

        else

        {       

                printf("msg received %d n",rep.nlh.nlmsg_type );

                break;

        }       





        audit_close(fd);



        return 0;

}

try this flag

https://github.com/linux-audit/audit-userspace/blob/master/lib/libaudit.c#L383

from libaudit source code

rc = audit_get_reply(fd, &rep, GET_REPLY_NONBLOCKING,0);