Chinaunix首页 | 论坛 | 博客

Pole的CU栈

首页　| 　博文目录　| 　关于我

polejo

  • 博客访问： 694676
  • 博文数量： 79
  • 博客积分： 10
  • 博客等级： 民兵
  • 技术积分： 1338
  • 用 户 组： 普通用户
  • 注册时间： 2012-06-12 08:51
个人简介

XMU->九天揽月->五湖抓鳖->DSP->driver->kernel/OpenWRT->ISP/RTOS

文章分类

全部博文（79）

文章存档

2020年（2）

2018年（3）

2016年（7）

2015年（42）

2014年（25）

最近访客
推荐博文
相关博文
开发一个netfilter（iptables）扩展模块

分类： LINUX

2015-09-01 20:59:56

本文参考自(十四)洞悉linux下的Netfilter&iptables：开发一个match模块【实战】，修复了其中的一些错误，并适配3.x以上的内核和netfilter版本，模块在centos7(kernel 3.10\iptables1.4.21)工作正常。

内核扩展 ipt_pktsize.c
  1. #include <linux/module.h>
  2. #include <linux/skbuff.h>
  3. #include <linux/ip.h>
  4. #include <linux/version.h>
  5. #include <linux/netfilter_ipv4/ip_tables.h>

  7. MODULE_AUTHOR("pole");
  8. MODULE_DESCRIPTION("iptables modules: frame size range match.");
  9. MODULE_LICENSE("GPL");

  11. #define PKTSIZE_VERSION "0.1"
  12. struct ipt_pktsize_info {
  13.     u_int32_t min_pktsize,max_pktsize;
  14. };

  16. #if (LINUX_VERSION_CODE > KERNEL_VERSION(2,6,9))
  17. /* for xtables */
  18. static bool
  19. match(const struct sk_buff *skb, struct xt_action_param *par)
  20. {
  21.     const struct ipt_pktsize_info *info = par->matchinfo;
  22.     
  23.     //int len = skb->len; // eth data part len
  24.     int len = skb->len + skb->mac_len; // frame len including eth head
  25.     //const struct iphdr *iph = ip_hdr(skb);
  26.     //int len = ntohs(iph->tot_len)-(iph->ihl*4); // ip data len ntohs(iph->tot_len) = skb->len

  28.     if(len >= info->min_pktsize && len <= info->max_pktsize)
  29.     {
  30.         printk(KERN_EMERG " ipt_pktsize: hit a pkt len %u in %u~%u \n", len, info->min_pktsize, info->max_pktsize);
  31.         return true;
  32.     }
  33.     
  34.     return false;
  35. }


  38. #else
  39. #error /* ancient iptables */
  40. static int
  41. match(const struct sk_buff *skb,
  42.       const struct net_device *in,
  43.       const struct net_device *out,
  44.       const struct xt_match *match,
  45.       const void *matchinfo,
  46.       int offset,
  47.       unsigned int protoff,
  48.       int *hotdrop)
  49. {
  50.         const struct ipt_pktsize_info *info = matchinfo;
  51.         const struct iphdr *iph = ip_hdr(skb);

  53.         int pkttruesize = ntohs(iph->tot_len)-(iph->ihl*4);
  54.         printk(KERN_INFO "****** iph->tot_len = %d, iph->ihl = %d\n", iph->tot_len, iph->ihl);
  55.         printk(KERN_INFO " skb->len = %d, skb->data_len = %d\n", iph->tot_len, iph->ihl);

  57.         if(pkttruesize>=info->min_pktsize && pkttruesize <=info->max_pktsize){
  58.                 return 1;
  59.         }
  60.         else{
  61.                 return 0;
  62.         }
  63.     return 1;
  64. }

  66. #endif


  69. static struct xt_match pktsize_match = {
  70.         .name = "pktsize",
  71.         .family = NFPROTO_IPV4,
  72.         .match = match,
  73.         .matchsize = sizeof(struct ipt_pktsize_info),
  74.         .destroy = NULL,
  75.         .me = THIS_MODULE,
  76. };


  79. static int __init init(void)
  80. {
  81.     printk(KERN_INFO "pktsize module loading\n");
  82.     return xt_register_match(&pktsize_match);
  83. }

  85. static void __exit fini(void)
  86. {
  87.     xt_unregister_match(&pktsize_match);
  88.     printk(KERN_INFO "pktsize module unloaded\n");
  89. }

  91. module_init(init);
  92. module_exit(fini);

用户态 libipt_pktsize.c
  1. #include <stdio.h>
  2. #include <netdb.h>
  3. #include <string.h>
  4. #include <stdlib.h>
  5. #include <getopt.h>
  6. #include <ctype.h>

  8. #include <iptables.h>

  10. #define PKTSIZE_VERSION "0.1"
  11. struct ipt_pktsize_info {
  12.     u_int32_t min_pktsize,max_pktsize;
  13. };

  15. #undef OLD_PARSER

  17. #if 1
  18. #define dbg_print(arg...) printf(arg)
  19. #else
  20. #define dbg_print(arg...)
  21. #endif


  24. #ifdef OLD_PARSER
  25. static struct option opts[] = {
  26.         { "size", 1, NULL, '1' },
  27.         {0}
  28. };
  29. #else
  30. enum {
  31.         O_SIZE = 0,
  32.         O_BURST,
  33. };
  34. static const struct xt_option_entry pktsize_opts[] = {
  35.         {.name = "size", .id = O_SIZE, .type = XTTYPE_STRING},
  36.         XTOPT_TABLEEND
  37. };
  38. #endif

  40. static void help(void)
  41. {
  42.     printf(
  43.     "pktsize v%s options:\n"
  44.     " --size size[:size] Match packet size against value or range\n"
  45.     "\nExamples:\n"
  46.     " iptables -A FORWARD -m pktsize --size 65 -j DROP\n"
  47.     " iptables -A FORWARD -m pktsize --size 80:120 -j DROP\n"
  48.     , PKTSIZE_VERSION);
  49. }


  52. /* 输入参数的可能格式为如下:
  53.     xx 指定数据包大小 XX
  54.     :XX 范围是0~XX
  55.     YY: 范围是YY~65535
  56.     xx:YY 范围是XX~YY
  57. */
  58. static void parse_pkts(const char* s,struct ipt_pktsize_info *info){
  59.         char* buff,*cp;
  60.         
  61.         buff = strdup(s);

  63.         if(NULL == (cp=strchr(buff,':'))){
  64.                 info->min_pktsize = info->max_pktsize = strtol(buff,NULL,0);
  65.         }else{
  66.                 *cp = '\0';
  67.                 cp++;

  69.                 info->min_pktsize = strtol(buff,NULL,0);
  70.                 info->max_pktsize = (cp[0]? strtol(cp,NULL,0):0xFFFF);
  71.         }

  73.         free(buff);

  75.         if (info->min_pktsize > info->max_pktsize)
  76.                 xtables_error(PARAMETER_PROBLEM,
  77.                            "pktsize min. range value `%u' greater than max. "
  78.                            "range value `%u'", info->min_pktsize, info->max_pktsize);
  79. }

  81. #ifdef OLD_PARSER
  82. static int
  83. parse(int c, char **argv, int invert, unsigned int *flags,
  84.         const void *entry,
  85.         struct ipt_entry_match **match)
  86. {
  87.         struct ipt_pktsize_info *info = (struct ipt_pktsize_info *)(*match)->data;
  88.         switch(c){
  89.                 case '1':
  90.                         if (*flags)
  91.                                 xtables_error(PARAMETER_PROBLEM,
  92.                                            "size: `--size' may only be "
  93.                                            "specified once");
  94.                         parse_pkts(argv[optind-1], info);
  95.                         *flags = 1;
  96.                         break;
  97.                 default:
  98.                         return 0;
  99.         }
  100.         return 1;
  101. }

  103. static void final_check(unsigned int flags)
  104. {
  105.     if (!flags)
  106.             xtables_error(PARAMETER_PROBLEM,
  107.             "\npktsize-parameter problem: for pktsize usage type: iptables -m pktsize --help\n");
  108. }

  110. #else
  111. static void pktsize_parse(struct xt_option_call *cb)
  112. {
  113.         struct ipt_pktsize_info *info = cb->data;
  114.         xtables_option_parse(cb);

  116.         dbg_print(" %s-%d, args: %s \n", __FUNCTION__, __LINE__, cb->arg);
  117.         switch (cb->entry->id)
  118.         {
  119.             case O_SIZE:
  120.                 parse_pkts(cb->arg, info);
  121.                 break;
  122.         }
  123.         
  124.         if (cb->invert)
  125.                 xtables_error(PARAMETER_PROBLEM,
  126.                            " does not support invert");
  127. }

  129. static void pktsize_fcheck(struct xt_fcheck_call *cb)
  130. {
  131.     if (cb->xflags == 0)
  132.         xtables_error(PARAMETER_PROBLEM,
  133.          "pktsize match: Parameter --size is required, resort to -h");
  134. }
  135. #endif


  138. static void __print(struct ipt_pktsize_info * info)
  139. {
  140.         if (info->max_pktsize == info->min_pktsize)
  141.                 printf("%u ", info->min_pktsize);
  142.         else
  143.                 printf("%u:%u ", info->min_pktsize, info->max_pktsize);
  144. }

  146. static void print(const void *ip, const struct ipt_entry_match *match, int numeric)
  147. {
  148.         printf("size ");
  149.         __print((struct ipt_pktsize_info *)match->data);

  151. }

  153. static void save(const void *ip, const struct ipt_entry_match *match)
  154. {
  155.         printf("--size ");
  156.         __print((struct ipt_pktsize_info *)match->data);
  157. }


  160. static struct xtables_match pktsize_match = {
  161.     .next = NULL,
  162.     .name = "pktsize",
  163.     .version = XTABLES_VERSION,
  164.     .family = NFPROTO_IPV4,
  165.     .size = XT_ALIGN(sizeof(struct ipt_pktsize_info)),
  166.     .userspacesize = XT_ALIGN(sizeof(struct ipt_pktsize_info)),
  167.     .help = help,
  168.     #ifdef OLD_PARSER
  169.     .parse = parse,
  170.     .final_check = final_check,
  171.     .extra_opts = opts,
  172.     #else
  173.     .x6_parse = pktsize_parse,
  174.     .x6_fcheck = pktsize_fcheck,
  175.     .x6_options = pktsize_opts,
  176.     #endif
  177.     .print = print,
  178.     .save = save,
  179. };


  182. void _init(void)
  183. {
  184.     xtables_register_match(&pktsize_match);
  185. }

Makefile
编译用户态扩展so时，需要下载iptables源码包，下载
  1. CC=gcc
  2. LD=ld
  3.   
  4. IPTABLES_SRC=/home/pole/work/net/iptables-1.4.21
  5. INCLUDE=-I$(IPTABLES_SRC)/include

  7. PKG:=ipt_pktsize
  8. name_ko:=$(PKG)
  9. name_so:=lib$(PKG)
  10. ipt_ko=$(name_ko).ko
  11. ipt_so=$(name_so).so
  12.   
  13.   
  14. all: kmod lib
  15. #kmod: $(ipt_ko)
  16. #lib: $(ipt_so)

  18. # compile kernel module
  19. KERNEL_SRC=/lib/modules/`uname -r`/build
  20. obj-m:=$(PKG).o
  21. kmod: $(name_ko).c
  22.     $(MAKE) -C $(KERNEL_SRC) SUBDIRS=$(PWD) modules

  24. # compile user lib
  25. lib: $(name_so).c
  26.     $(CC) $(INCLUDE) -fPIC -c $(name_so).c
  27.     $(LD) -shared -o $(ipt_so) $(name_so).o

  29. clean:
  30.     @rm -rf *.o *.so *.ko *.mod.c .*.cmd *.markers *.order *.symvers .tmp_versions

  32. install: all
  33.     cp -rf $(ipt_so) /usr/lib64/xtables/
  34.     cp -rf $(ipt_ko) /lib/modules/`uname -r`/kernel/net/ipv4/netfilter/
  35.     @depmod -a

加载ipt_pktsize.ko和libipt_pktsize.so
sudo iptables -t mangle -A OUTPUT -p icmp -m pktsize --size 1200:1500 -j DROP
测试 ping $ip -s 1300 ，这时候会看到由于Pktsize规则可以匹配，icmp请求被防火墙拒绝发送。

阅读(3801) | 评论(0) | 转发(0) |
0

上一篇：linux 内核网络，数据接收流程图

下一篇：linux device tree源代码解析

给主人留下些什么吧！~~
关于我们 | 关于IT168 | 联系方式 | 广告合作 | 法律声明 | 免费注册

Copyright 2001-2010 ChinaUnix.net All Rights Reserved 北京皓辰网域网络信息技术有限公司. 版权所有

感谢所有关心和支持过ChinaUnix的朋友们

16024965号-6