[SOLVED] how to read sk_buff

laginagesh · 10-08-2009, 03:17 AM

hi,

I have written a module to read sk_buff data length.

-------------------------------------------------------------------------

#include<linux/module.h>
#include<linux/kernel.h>
#include<linux/init.h>
#include<linux/cdev.h>
#include<linux/skbuff.h>

MODULE_LICENSE("Dual BSD/GPL");

struct sk_buff *skb;

int receive_init(void)
{
printk("Module initialized");
printk("Data length = %d\n",skb->data_len);

return 0;
}

void receive_exit(void)
{
printk("Module exited\n");
}

module_init(receive_init);
module_exit(receive_exit);

-------------------------------------------------------------------------
insert module giving Segmentation error.

Dmesg:
-------------------------------------------------------------------------
<1>Unable to handle kernel NULL pointer dereference at virtual address 00000064
printing eip:
ca99f005
*pde = 00000000
Oops: 0000 [#3]
Modules linked in: test12(U) 1(U) test(U) nfsd exportfs lockd autofs4 i2c_dev i2c_core sunrpc iptable_filter ip_tables dm_mod button battery ac md5 ipv6 joydev uhci_hcd snd_intel8x0 snd_ac97_codec snd_pcm_oss snd_mixer_oss snd_pcm snd_timer snd_page_alloc snd_mpu401_uart snd_rawmidi snd_seq_device snd soundcore 8139too mii floppy ext3 jbd
CPU: 0
EIP: 0060:[<ca99f005>] Not tainted VLI
EFLAGS: 00010286 (2.6.9-5.EL)
EIP is at receive_init+0x5/0x2a [test12]
eax: 00000000 ebx: c034f200 ecx: c034f200 edx: 00000000
esi: ca99f480 edi: c034f1c0 ebp: c034f1c0 esp: c4933fac
ds: 007b es: 007b ss: 0068
Process insmod (pid: 4714, threadinfo=c4933000 task=c5fecdd0)
Stack: c013b331 09455018 00000000 00000000 c4933000 c0301bfb 09455018 00013e1e
09455008 00000000 00000000 bfea1738 00000080 0000007b 0000007b 00000080
00b5708e 00000073 00000206 bfea16e0 0000007b
Call Trace:
[<c013b331>] sys_init_module+0x1f1/0x2d9
[<c0301bfb>] syscall_call+0x7/0xb
Code: Bad EIP value.
-------------------------------------------------------------------------

cheers
Nagesh

SethsdadtheLinuxer · 10-29-2009, 08:30 AM

it is good that you wrote a module. Is the point of the post to say that it does not work?

laginagesh · 10-29-2009, 11:21 PM

yup,unable to handle sk_buff pointer ...(insert module giving segmentation fault)
in our project we are reading sk_buff pointer from /net/ipV4/ip_input.c, here we are calling a function passing sk_buff pointer,rebuild the kernel and boot working perfectly.

Now my intention to read sk_buff directly(not from /net/ipv4/ip_input.c), but unable to read...How to handle sk_buff pointer directly?

cheers
Nagesh

bluehaze92 · 11-03-2009, 11:31 AM

You 'skb' variable has not been initialized to anything. This is causing a NULL reference error. Before you can use 'skb' you have to somehow initialize it to something.

Hope this helps.

yaplej · 11-06-2009, 03:32 PM

I spent a long time trying to figure this out also. You have to write a packet handler, and register it with dev_add_pack() in the module initialization function. Here is a simplified example of what I did.

Also when the packet handler is executed its run in "interupt context" so you cannot use any functions that may sleep. This includes all forms of locking except spinlocks, and you also cannot use vmalloc() you can use kmalloc(), kcalloc(), kzalloc() to assign memory, but you must do it atomicly else they might sleep, and cause kernel panic.

All of that learned the hard way.

Code:


/*
 * This is the function that handles the packets. 
 */
static __s32 
packetprocessor_func(struct sk_buff *skb, struct net_device *dev, 
struct packet_type *pt, struct net_device *orig_dev){

	//Do stuff here.

	kfree_skb(skb);
	return 0;

}


static struct packet_type pt =
{ // Specify the function to handle packets.
	.type = __constant_htons(ETH_P_ALL),
	.func = packetprocessor_func,
};

static __s32 __init 
packetprocessor_init(void){
	printk(KERN_ALERT "Loading Packet Processor...\n");
	dev_add_pack(&pt); // Register the packet handler.
	return 0;
}

static void __exit 
packetprocessor_exit(void){
	printk(KERN_ALERT "Unloading Packet Processor...\n");
	dev_remove_pack(&pt);

}

module_init(packetprocessor_init);
module_exit(packetprocessor_exit);

yaplej · 11-11-2009, 11:41 PM

If you just want to access the IP packet and TCP data I just found that the netfilter hooks are much better location to tie into with your module. Its very similar to the packet handler hook too so porting code is pretty quick.

Using the netfilter hooks prevents the posibility of you receiving a packet with bad checksum or any other "junk" sk_buffs. It all gets filtered out at lower layers.

Code:



static __s32 
packetprocessor_func(unsigned int hooknum, 
struct sk_buff **skb, 
const struct net_device *in, 
const struct net_device *out, 
int (*okfn)(struct sk_buff *)){

// Do stuff.

return NF_ACCEPT;
}

static struct nf_hook_ops mynfhook = { // This is a netfilter hook.
	.hook = packetprocessor_func, // Function that executes.
	.hooknum = NF_IP_FORWARD, // For routed traffic only.
	.pf = PF_INET, // Only for IP packets.
	.priority = NF_IP_PRI_FIRST, // My hook executes first.
};

static __s32 __init 
packetprocessor_init(void){
	printk(KERN_ALERT "Loading Packet Processor...\n");
	nf_register_hook(&mynfhook);  
	return 0;
}

static void __exit 
packetprocessor_exit(void){
    printk(KERN_ALERT "Unloading Packet Processor...\n");
    nf_unregister_hook(&mynfhook);
   }

laginagesh · 01-07-2010, 12:32 AM

Thanks yaplej....

danjogom · 06-20-2010, 10:09 PM

Hello all,

I would like to obtain the ip address from kernel space for one of my projects.

I am writing a virtual file system built off of ramfs, which is loaded as a module.

I want to deny the write operation to a file if the user on the filesystem is connected to an unknown ip address.

So in simple, my question is, what is the simplest way to obtain an ip address of a device from kernel space?

I have attempted yaplej's suggest of using nethooks, however, I do not understand how to invoke the operation .hook
I guess I really do not understand how netfilter works in the first place.

Any help on this would be greatly appreciated, or help with any other method of obtaining the ip address.

I am working with the kernel version 2.6.31.13

Thanks in advance,

Danjogom : o )