两个netfilter的例子
１。 第一个，简单的丢弃掉网络包：
//'Hello World' netfilter hooks example
//For any packet, we drop it, and log fact to /var/log/messages
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
static struct nf_hook_ops nfho; //struct holding set of hook function options
//function to be called by hook
unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
{
printk(KERN_INFO "packet dropped\n"); //log to var/log/messages
return NF_DROP; //drops the packet
}
//Called when module loaded using 'insmod'
int init_module()
{
nfho.hook = hook_func; //function to call when conditions below met
nfho.hooknum = NF_INET_PRE_ROUTING; //called right after packet recieved, first hook in Netfilter
nfho.pf = PF_INET; //IPV4 packets
nfho.priority = NF_IP_PRI_FIRST; //set to highest priority over all other hook functions
nf_register_hook(&nfho); //register hook
return 0; //return 0 for success
}
//Called when module unloaded using 'rmmod'
void cleanup_module()
{
nf_unregister_hook(&nfho); //cleanup – unregister hook
}
编译之后，执行结果如下：
:/#insmod /mnt/code/modules/netfilter.ko netfilter: module license 'unspecified' taints kernel. Disabling lock debugging due to kernel taint root@taotao:/#ls /mnt/code packet dropped packet dropped packet dropped packet dropped packet dropped packet dropped
2. 针对 UDP包进行过滤：
//’Hello World’ v2 netfilter hooks example
//For any packet, get the ip header and check the protocol field
//if the protocol number equal to UDP (17), log in var/log/messages
//default action of module to let all packets through
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/skbuff.h>
#include <linux/udp.h>
#include <linux/ip.h>
static struct nf_hook_ops nfho; //net filter hook option struct
struct udphdr *udp_header; //udp header struct (not used)
struct iphdr *ip_header; //ip header struct
unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
{
ip_header = (struct iphdr *)skb_network_header(skb); //grab network header using accessor
//if(!sock_buff) { return NF_ACCEPT;}
if (ip_header->protocol==17) {
udp_header = (struct udphdr *)skb_transport_header(skb); //grab transport header
printk(KERN_INFO "got udp packet \n"); //log we’ve got udp packet to /var/log/messages
return NF_DROP;
}
return NF_ACCEPT;
}
int init_module()
{
nfho.hook = hook_func;
nfho.hooknum = NF_INET_PRE_ROUTING;
nfho.pf = PF_INET;
nfho.priority = NF_IP_PRI_FIRST;
nf_register_hook(&nfho);
return 0;
}
void cleanup_module()
{
nf_unregister_hook(&nfho);
}
在 hook_func的调用栈为：
#0 0xbf000024 in hook_func (hooknum=0, skb=0xeda5e9c0, in=0xed8798c0, out=0x0 <__vectors_start>,
okfn=0xc03930c4 <ip_rcv_finish>) at /home/charles/code/modules/netfilter2.c:21
#1 0xc038e0f4 in nf_iterate (head=0xc05e20a0 <nf_hooks+128>, head@entry=0x80000000,
skb=skb@entry=0xeda5e9c0, hook=hook@entry=0, indev=indev@entry=0xed8798c0,
outdev=outdev@entry=0x0 <__vectors_start>, elemp=elemp@entry=0xc05d9d94 <init_thread_union+7572>,
okfn=okfn@entry=0xc03930c4 <ip_rcv_finish>, hook_thresh=-2147483648, hook_thresh@entry=0)
at net/netfilter/core.c:149
#2 0xc038e180 in nf_hook_slow (pf=pf@entry=2 '\002', hook=hook@entry=0, skb=skb@entry=0xeda5e9c0,
indev=indev@entry=0xed8798c0, outdev=outdev@entry=0x0 <__vectors_start>,
okfn=okfn@entry=0xc03930c4 <ip_rcv_finish>, hook_thresh=hook_thresh@entry=-2147483648)
at net/netfilter/core.c:185
#3 0xc0393884 in nf_hook_thresh (thresh=-2147483648, okfn=0xc03930c4 <ip_rcv_finish>,
outdev=0x0 <__vectors_start>, indev=0xed8798c0, skb=0xeda5e9c0, hook=0, pf=2 '\002')
at include/linux/netfilter.h:136
#4 NF_HOOK_THRESH (thresh=-2147483648, okfn=0xc03930c4 <ip_rcv_finish>, out=0x0 <__vectors_start>,
in=0xed8798c0, skb=0xeda5e9c0, hook=0, pf=2 '\002') at include/linux/netfilter.h:169
#5 NF_HOOK (okfn=0xc03930c4 <ip_rcv_finish>, out=0x0 <__vectors_start>, in=0xed8798c0,
skb=0xeda5e9c0, hook=0, pf=2 '\002') at include/linux/netfilter.h:193
#6 ip_rcv (skb=<optimized out>, dev=0xed8798c0, pt=<optimized out>, orig_dev=<optimized out>)
at net/ipv4/ip_input.c:445
#7 0xc036d620 in __netif_receive_skb_core (skb=0xc00e68f8 <kmem_cache_alloc+248>,
---Type <return> to continue, or q <return> to quit---
pfmemalloc=<optimized out>) at net/core/dev.c:3545
#8 0xc036ed60 in netif_receive_skb (skb=skb@entry=0xeda5e9c0) at net/core/dev.c:3626
#9 0xc02c235c in smsc911x_poll (napi=0xed879dd4, budget=16)
at drivers/net/ethernet/smsc/smsc911x.c:1278
#10 0xc0370198 in net_rx_action (h=<optimized out>) at net/core/dev.c:4197
#11 0xc0027b8c in __do_softirq () at kernel/softirq.c:253
#12 0xc0027de8 in do_softirq () at kernel/softirq.c:303
#13 0xc0028038 in invoke_softirq () at kernel/softirq.c:342
#14 irq_exit () at kernel/softirq.c:376
#15 0xc000ea64 in handle_IRQ (irq=47, regs=regs@entry=0xc05d9f60 <init_thread_union+8032>)
at arch/arm/kernel/irq.c:83
#16 0xc0008594 in gic_handle_irq (regs=0xc05d9f60 <init_thread_union+8032>)
at drivers/irqchip/irq-gic.c:295
结果如下：
#ping www.baidu.com got udp packet got udp packet got udp packet got udp packet
参考：
http://www.paulkiddie.com/2009/11/creating-a-netfilter-kernel-module-which-filters-udp-packets/