|
questions about register modules onto netfilter
hello,
i am trying to realize a firewall based on netfilter,so i need to write myself modules and register them onto some hook points of netfilter.I get a simple example from website named" linux magazine",the example is like this:
/* example.c*/
#include <linux/config.h>
#include <linux/module.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
MODULE_LICENSE("Dual BSD/GPL");
static unsigned int
linuxmag_hook(unsigned int hook, struct sk_buff **pskb,
const struct net_device *indev, const
struct net_device *outdev, int
(*okfn)(struct sk_buff *))
{
/* Get a handle to the packet data */
unsigned char *data = (void *)(*pskb)->nh.iph +
(*pskb)->nh.iph->ihl*4;
(*pskb)->nfcache |= NFC_UNKNOWN;
printk("hello\n");
switch ((*pskb)->len) {
case 100:
printk("linuxmag: corrupting packet\n");
data[99]++;
(*pskb)->nfcache |= NFC_ALTERED;
return NF_ACCEPT;
case 200:
printk("linuxmag: dropping packet\n");
return NF_DROP;
default:
return NF_ACCEPT;
}
}
static struct nf_hook_ops linuxmag_ops
= { { NULL, NULL }, linuxmag_hook,
PF_INET, NF_IP_LOCAL_OUT,
NF_IP_PRI_FILTER-1 };
int init_module(void) {
return nf_register_hook(&linuxmag_ops);
}
void cleanup_module(void)
{
nf_unregister_hook(&linuxmag_ops);
}
i have inserted the module (i found it is there when i use lsmod),but the following was my trail result:
[root@localhost example]# ping -c1 -s 72 210.45.119.241
PING 210.45.119.241 (210.45.119.241) 72(100) bytes of data.
80 bytes from 210.45.119.241: icmp_seq=0 ttl=64 time=0.056 ms
--- 210.45.119.241 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.056/0.056/0.056/0.000 ms, pipe 2
[root@localhost example]# ping -c1 -s 172 210.45.119.241
PING 210.45.119.241 (210.45.119.241) 172(200) bytes of data.
180 bytes from 210.45.119.241: icmp_seq=0 ttl=64 time=0.095 ms
--- 210.45.119.241 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 7ms
rtt min/avg/max/mdev = 0.095/0.095/0.095/0.000 ms, pipe 2
but according to the program ,the second time the packet should not be sent out.
so i used lsmod to check and found the value of "Used by" of "example" (this module name ) is 0, is the reason that i have not successfully registered the module onto the hook point of netfilter ?
any response will be appreciated very much.
|
