netfilter小例子

最新推荐文章于 2019-11-16 15:23:24 发布

原创最新推荐文章于 2019-11-16 15:23:24 发布 · 588 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#hook #struct #module #shell #function #linux

linux_driver 专栏收录该内容

3 篇文章

订阅专栏

本文介绍了一个简单的Linux内核模块，该模块使用Netfilter框架拦截IPv4数据包并将其丢弃。通过注册hook函数实现，在数据包到达路由前进行操作。

hello.c

#include <linux/kernel.h> #include <linux/module.h> #include <linux/netfilter_ipv4.h> MODULE_LICENSE("Dual BSD/GPL"); static struct nf_hook_ops nfho; //struct holding set of hook function options //function to be called by hook unsigned int hook_func(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *)) { printk(KERN_INFO "packet dropped/n"); //log to var/log/messages return NF_DROP; //drops the packet } //Called when module loaded using 'insmod' static int init(void) { // printk(KERN_INFO "is ok wxm/n"); // #endif nfho.hook = hook_func; //function to call when conditions below met nfho.hooknum = 0;//NF_IP_PRE_ROUTING; //called right after packet recieved, first hook in Netfilter nfho.pf = PF_INET; //IPV4 packets nfho.priority = NF_IP_PRI_FIRST; //set to highest priority over all other hook functions nf_register_hook(&nfho); //register hook return 0; //return 0 for success } //Called when module unloaded using 'rmmod' void exit(void) { nf_unregister_hook(&nfho); //cleanup – unregister hook } module_init(init); module_exit(exit);

Makefile

obj-m := hello.o KERNELDIR ?= /lib/modules/$(shell uname -r)/build PWD := $(shell pwd) default: $(MAKE) -C $(KERNELDIR) M=$(PWD) modules

太小了,所以不解释了~

参考资料:

http://www.xfocus.net/articles/200308/599.html 深入Linux网络核心堆栈