1)在产品中添加VPN功能,将所有用户虚拟成一个局域网,需要做较多工作,虽然可以向公司要一笔钱,但眼下确实没时间了,可惜啊!
2)在用户出口,在产品上给去往教育局视频资源网站的访问流打一个标签,并在教育局网站前端以透明网桥方式加入我们的产品,并检查访问流是否有特殊的标签决定是否放行。该方法比较简单,原来想是修改http请求头,加入一个特殊fingerprint,有点复杂,需要在内核做字符串匹配,每个包都需要判断是否是HTTP的GET请求,后来直接在TCP包头上加入一个特殊标记,利用tcp的保留位置入一个特殊标记。
实现:基于NETFILTER的数据包处理框架,和2.6的内核模块,代码如下:
用户端打标签程序:
--------------------------------------------------------------------------------------------
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/kernel.h>
#include <linux/inet.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <net/checksum.h>
#include <net/tcp.h>
#include <net/ip.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Xiong");
static char * markdip= "192.168.1.1";
static unsigned short markdport=10000;
module_param(markdport,ushort,S_IRUSR);
module_param(markdip,charp,S_IRUSR);
#define PRINT(fmt,args...) printk("Marker: " fmt, ##args)
unsigned int hook_mark_packet(unsigned int hookunm,struct sk_buff **skb,
const struct net_device *in,const struct net_device *out,int (*okfn)(struct sk_buff *))
{
struct iphdr *iph;
struct tcphdr *tcph;
int datalen;
iph=(struct iphdr *)(*skb)->nh.iph;
if(iph->daddr == in_aton(markdip))
{
if(iph->protocol==6)
{
tcph=(struct tcphdr*)((__u32 *)iph+iph->ihl);
if(ntohs(tcph->dest) == markdport)
{
tcph->res1 = 5;
ip_send_check(iph);
datalen = (*skb)->len - iph->ihl*4;
tcph->check = 0;
tcph->check = tcp_v4_check(tcph, datalen, iph->saddr, iph->daddr,
csum_partial((char *)tcph, datalen, 0));
}
}
}
return NF_ACCEPT;
}
static struct nf_hook_ops nfho_marker;
static int init_marker(void)
{
nfho_marker.hook=hook_mark_packet;
nfho_marker.hooknum=NF_IP_POST_ROUTING;
nfho_marker.pf=PF_INET;
nfho_marker.priority=NF_IP_PRI_LAST;
nf_register_hook(&nfho_marker);
PRINT("Initialized successfully, and we mark packet to %s:%un",markdip,markdport);
return 0;
}
static void exit_marker(void)
{
PRINT("Exitn");
nf_unregister_hook(&nfho_marker);
}
module_init(init_marker);
module_exit(exit_marker);
---------------------------------------------------------------------------------------------------------------------
教育局网站前端代码也类似,核心hook函数修改:
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/kernel.h>
#include <linux/inet.h>
#include <linux/ip.h>
#include <linux/tcp.h>
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Xiong");
static char * markdip= "192.168.1.1";
static unsigned short markdport=10000;
module_param(markdport,ushort,S_IRUSR);
module_param(markdip,charp,S_IRUSR);
#define PRINT(fmt,args...) printk("Marker: " fmt, ##args)
unsigned int hook_mark_packet(unsigned int hookunm,struct sk_buff **skb,
const struct net_device *in,const struct net_device *out,int (*okfn)(struct sk_buff *))
{
struct iphdr *iph;
struct tcphdr *tcph;
iph=(struct iphdr *)(*skb)->nh.iph;
if(iph->daddr == in_aton(markdip))
{
if(iph->protocol==6)
{
tcph=(struct tcphdr*)((__u32 *)iph+iph->ihl);
if(ntohs(tcph->dest) == markdport)
{
PRINT("Drop IP: [%u.%u.%u.%u]-->[%u.%u.%u.%u]:%u,%un",NIPQUAD(iph->saddr),NIPQUAD(iph->daddr),ntohs(tcph->dest), ntohs(tcph->res1));
if(tcph->res1 == 0)
{
return NF_DROP;
}
}
}
}
return NF_ACCEPT;
}
static struct nf_hook_ops nfho_marker;
static int init_marker(void)
{
nfho_marker.hook=hook_mark_packet;
nfho_marker.hooknum=NF_IP_PRE_ROUTING;
nfho_marker.pf=PF_INET;
nfho_marker.priority=NF_IP_PRI_FIRST;
nf_register_hook(&nfho_marker);
PRINT("Initialized successfully, and we mark packet to %s:%un",markdip,markdport);
return 0;
}
static void exit_marker(void)
{
PRINT("Exitn");
nf_unregister_hook(&nfho_marker);
}
module_init(init_marker);
module_exit(exit_marker);
-------------------------------------------------------------------------------
编译Makefile:
ifneq ($(KERNELRELEASE),)
obj-m := gt_client.o gt_server.o
else
KERNELDIR = /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)
default:
$(MAKE) -C $(KERNELDIR) M=$(PWD) modules
endif
---------------------------------------------------------------------------------------
Make
insmod gt_server/client.ko markdport=80 markdip="123.123.123.123"
Done!
<script type="text/javascript" id="wumiiRelatedItems"> </script>