两个netfilter的例子

１。　第一个，简单的丢弃掉网络包：

//'Hello World' netfilter hooks example
//For any packet, we drop it, and log fact to /var/log/messages

#include 
#include 
#include 
#include 

static struct nf_hook_ops nfho;         //struct holding set of hook function options

//function to be called by hook
unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
{
  printk(KERN_INFO "packet dropped\n");                                             //log to var/log/messages
  return NF_DROP;                                                                   //drops the packet
}

//Called when module loaded using 'insmod'
int init_module()
{
  nfho.hook = hook_func;                       //function to call when conditions below met
  nfho.hooknum = NF_INET_PRE_ROUTING;            //called right after packet recieved, first hook in Netfilter
  nfho.pf = PF_INET;                           //IPV4 packets
  nfho.priority = NF_IP_PRI_FIRST;             //set to highest priority over all other hook functions
  nf_register_hook(&nfho);                     //register hook

  return 0;                                    //return 0 for success
}

//Called when module unloaded using 'rmmod'
void cleanup_module()
{
  nf_unregister_hook(&nfho);                     //cleanup – unregister hook
}

编译之后，执行结果如下：

:/#insmod  /mnt/code/modules/netfilter.ko 
netfilter: module license 'unspecified' taints kernel.
Disabling lock debugging due to kernel taint
root@taotao:/#ls /mnt/code
packet dropped
packet dropped
packet dropped
packet dropped
packet dropped
packet dropped

2.  针对 UDP包进行过滤：

     //’Hello World’ v2 netfilter hooks example
    //For any packet, get the ip header and check the protocol field
    //if the protocol number equal to UDP (17), log in var/log/messages
    //default action of module to let all packets through
     
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 
    #include 
     
    static struct nf_hook_ops nfho;   //net filter hook option struct
    struct udphdr *udp_header;          //udp header struct (not used)
    struct iphdr *ip_header;            //ip header struct
     
    unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
    {
            ip_header = (struct iphdr *)skb_network_header(skb);    //grab network header using accessor
           
            //if(!sock_buff) { return NF_ACCEPT;}
     
            if (ip_header->protocol==17) {
                    udp_header = (struct udphdr *)skb_transport_header(skb);  //grab transport header
     
                    printk(KERN_INFO "got udp packet \n");     //log we’ve got udp packet to /var/log/messages
                    return NF_DROP;
            }
                   
            return NF_ACCEPT;
    }
     
    int init_module()
    {
            nfho.hook = hook_func;
            nfho.hooknum = NF_INET_PRE_ROUTING;
            nfho.pf = PF_INET;
            nfho.priority = NF_IP_PRI_FIRST;
     
            nf_register_hook(&nfho);
           
            return 0;
    }
     
    void cleanup_module()
    {
            nf_unregister_hook(&nfho);     
    }
     

     

在 hook_func的调用栈为：

#0  0xbf000024 in hook_func (hooknum=0, skb=0xeda5e9c0, in=0xed8798c0, out=0x0 <__vectors_start>, 
    okfn=0xc03930c4 ) at /home/charles/code/modules/netfilter2.c:21
#1  0xc038e0f4 in nf_iterate (head=0xc05e20a0 , head@entry=0x80000000, 
    skb=skb@entry=0xeda5e9c0, hook=hook@entry=0, indev=indev@entry=0xed8798c0, 
    outdev=outdev@entry=0x0 <__vectors_start>, elemp=elemp@entry=0xc05d9d94 , 
    okfn=okfn@entry=0xc03930c4 , hook_thresh=-2147483648, hook_thresh@entry=0)
    at net/netfilter/core.c:149
#2  0xc038e180 in nf_hook_slow (pf=pf@entry=2 '\002', hook=hook@entry=0, skb=skb@entry=0xeda5e9c0, 
    indev=indev@entry=0xed8798c0, outdev=outdev@entry=0x0 <__vectors_start>, 
    okfn=okfn@entry=0xc03930c4 , hook_thresh=hook_thresh@entry=-2147483648)
    at net/netfilter/core.c:185
#3  0xc0393884 in nf_hook_thresh (thresh=-2147483648, okfn=0xc03930c4 , 
    outdev=0x0 <__vectors_start>, indev=0xed8798c0, skb=0xeda5e9c0, hook=0, pf=2 '\002')
    at include/linux/netfilter.h:136
#4  NF_HOOK_THRESH (thresh=-2147483648, okfn=0xc03930c4 , out=0x0 <__vectors_start>, 
    in=0xed8798c0, skb=0xeda5e9c0, hook=0, pf=2 '\002') at include/linux/netfilter.h:169
#5  NF_HOOK (okfn=0xc03930c4 , out=0x0 <__vectors_start>, in=0xed8798c0, 
    skb=0xeda5e9c0, hook=0, pf=2 '\002') at include/linux/netfilter.h:193
#6  ip_rcv (skb=, dev=0xed8798c0, pt=, orig_dev=)
    at net/ipv4/ip_input.c:445
#7  0xc036d620 in __netif_receive_skb_core (skb=0xc00e68f8 , 
---Type  to continue, or q  to quit---
    pfmemalloc=) at net/core/dev.c:3545
#8  0xc036ed60 in netif_receive_skb (skb=skb@entry=0xeda5e9c0) at net/core/dev.c:3626
#9  0xc02c235c in smsc911x_poll (napi=0xed879dd4, budget=16)
    at drivers/net/ethernet/smsc/smsc911x.c:1278
#10 0xc0370198 in net_rx_action (h=) at net/core/dev.c:4197
#11 0xc0027b8c in __do_softirq () at kernel/softirq.c:253
#12 0xc0027de8 in do_softirq () at kernel/softirq.c:303
#13 0xc0028038 in invoke_softirq () at kernel/softirq.c:342
#14 irq_exit () at kernel/softirq.c:376
#15 0xc000ea64 in handle_IRQ (irq=47, regs=regs@entry=0xc05d9f60 )
    at arch/arm/kernel/irq.c:83
#16 0xc0008594 in gic_handle_irq (regs=0xc05d9f60 )
    at drivers/irqchip/irq-gic.c:295

结果如下：

#ping www.baidu.com
got udp packet 
got udp packet 
got udp packet 
got udp packet 

参考：

http://www.paulkiddie.com/2009/11/creating-a-netfilter-kernel-module-which-filters-udp-packets/