nf_hook_ops 实现DNS拦截

内核模式实现DNS拦截（或代为回复）。注意，内核需要在2.6.31版本以上

#include <linux/vermagic.h>
#include <linux/compiler.h>
#include <linux/sockios.h>
#include <linux/inetdevice.h>
#include <linux/netdevice.h>
#include <linux/types.h>
#include <linux/skbuff.h>
#include <linux/if_ether.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/string.h>

#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/workqueue.h>
#include <linux/in.h>
#include <linux/inet.h>
#include <linux/socket.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <net/sock.h>
#include <net/route.h>
#include <net/ip.h>
#include <net/flow.h>

#include <linux/version.h>

#include "iDNS_intercept.h"

static unsigned int idns_intercept_handler( unsigned int hooknum,
                            struct sk_buff *skb,
                            const struct net_device *in,
                            const struct net_device *out,
                            int ( *okfn )(struct sk_buff *) );


static struct nf_hook_ops idns_hook_ops = {
    .hook    =    idns_intercept_handler,
    .owner    =    THIS_MODULE,
    .pf        =    PF_INET,
    .hooknum =    NF_INET_PRE_ROUTING,
    .priority    =    NF_IP_PRI_NAT_DST - 1,/*    after DNAT */
};


static unsigned char query_str[] = {
        0x03,
        0x77,0x77,0x77,    /* www */
        0x05,
        0x6c,0x6f,0x67,0x69,0x6e,    /* login */
        0x03,
        0x6e,0x65,0x74,    /* net */
        0x00
};

#define DNS_QUERY_LEN    sizeof( query_str)


static unsigned int idns_intercept_handler( unsigned int hooknum,
                            struct sk_buff *skb,
                            const struct net_device *in,
                            const struct net_device *out,
                            int ( *okfn )(struct sk_buff *) )
{
    struct sk_buff *pskb = skb;
    struct iphdr *iph = ip_hdr(pskb);
    struct udphdr *udp_hdr;
    DNS_HEADER *dns_hdr;

    unsigned char * dns_payload;
    unsigned char * tmp;

    __u16 dport;
    __u16 query_type;

    int ret;
    int name_type;


    if ( ETH_P_IP != pskb->protocol )/* not IP packets */
    {
            return NF_ACCEPT;
    }

    if ( NULL == iph || 4 != iph->version)/* not IPv4 packets */
    {
        return NF_ACCEPT;
    }

    if ( IPPROTO_UDP != iph->protocol )/* not UDP packets */
    {
        return NF_ACCEPT;
    }

    udp_hdr = ( struct udphdr * )( ( unsigned char * )iph + iph->ihl * 4 );/* strip IP header*/
    if ( NULL == udp_hdr )
    {
        return NF_ACCEPT;
    }

    dport = udp_hdr->dest;
    dport = ntohs( dport );

    if ( DOMAIN_PORT != dport )/*    not dns request packet    */
    {
        return NF_ACCEPT;
    }

    dns_hdr = ( DNS_HEADER * )( ( unsigned char * )udp_hdr + UDP_HEADER_LEN ); /* strip UDP header*/
    if ( NULL == dns_hdr)
    {
        return NF_ACCEPT;
    }

    if ( ( ntohs( dns_hdr->flag ) & DNS_RESPONSE_PACKET ) )/* not dns request? */
    {
        return NF_ACCEPT;
    }

    dns_payload = ( unsigned char * )( ( unsigned char * )dns_hdr + DNS_HEADER_LEN );
    if ( NULL == dns_payload )
    {
        return NF_ACCEPT;
    }

    ret = memcmp( dns_payload, query_str, DNS_QUERY_LEN);
    if (0 == ret)
    {
        printk("Intercept one DNS requst\n");
        // do intercept
    }

    return NF_ACCEPT;
/*
    tmp = dns_payload + DNS_QUERY_LEN;
    memcpy( &query_type, tmp, sizeof( query_type ) );
    query_type = ntohs( query_type );

    if( DNS_QUERY_TYPE != query_type )// is query type not A?
        return NF_ACCEPT;
    }

    tp_send_dns_packet( pskb, iph, udp_hdr, dns_hdr, name_type );

    return NF_DROP;

*/
}

int start_dns_intercept(void)
{
    int ret;

    ret = nf_register_hook(&idns_intercept_handler);
    if ( ret < 0 )
    {
        return ret;
    }

    return 0;
}

void exit_dns_intercept(void)
{
    nf_unregister_hook(&idns_intercept_handler);
    return;
}

#ifndef I_DNS_INTERCEPT_H
#define I_DNS_INTERCEPT_H

#define DOMAIN_PORT 53

#define ETH_HEADER_LEN ( 2 + 14 )
#define IP_PACKET_TTL 128
#define DNS_ANSWER_TTL ( 2 * 24 * 60 *60 )

#define IP_ADDR_LEN sizeof( __u32 )
#define PORT_LEN sizeof( __u16 )
#define UDP_HEADER_LEN sizeof( struct udphdr )
#define DNS_HEADER_LEN sizeof( DNS_HEADER )

#define DNS_RESPONSE_PACKET ( 0x8000 ) /* response packet flag */
#define DNS_QUERY_TYPE    ( 0x0001 )         /* query type,type A */
#define DNS_QUERY_CLASS ( 0x0001 )        /* query class,clase internet */
#define DNS_RESPONSE_FLAG ( 0x8080 )    /* response flag value */
#define DNS_RESPONSE_POINTER ( 0xc00c )/* response field pointer */
#define DNS_RESOURCE_LEN ( 0x0004 )        /* response field IP length */


typedef struct
{
    __u16 transaction_id;
    __u16 flag;
    __u16 questions;
    __u16 answers_rrs;
    __u16 authority_rrs;
    __u16 additional_rrs;
}__attribute__ ((__packed__))DNS_HEADER;

int start_dns_intercept(void);
void exit_dns_intercept(void);

#endif

代为回复未实现。