网络数据包过滤_04_应用层_Z

1、

数据链路层转发的简单实现

http://www.lai18.com/content/2054051.html

 

2、

基于 linux 平台的 libpcap 源代码分析

https://www.ibm.com/developerworks/cn/linux/l-libpcap/

　　ZC: 文章中搜索 "PF_PACKET" / "bind"

 

3、

VLAN Information to Socket (PF_PACKET/SOCK_RAW) ?

http://developerweb.net/viewtopic.php?pid=34279

　　ZC: 该帖子 主要在讨论，为何 wireshark/libpcap 能抓到的部分  PF_PACKET却抓不到，也涉及了 PF_PACKET 的使用注意点

 

4、

/**
 * @file netfilter_hook.c
 */

#include <linux/module.h>
#include <linux/kernel.h>

#include <linux/ip.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netfilter_arp.h>

MODULE_LICENSE("Dual BSD/GPL");
MODULE_AUTHOR("yuuyuu");
MODULE_DESCRIPTION("netfilter");
MODULE_VERSION("1.0");

/* 打印点分制ip地址 */
#define printk_ip(info, be32_addr) \
    printk("%s %d.%d.%d.%d\n", \
    info, \
    ((unsigned char *)&(be32_addr))[0], \
    ((unsigned char *)&(be32_addr))[1], \
    ((unsigned char *)&(be32_addr))[2], \
    ((unsigned char *)&(be32_addr))[3])

int filter_ip(__be32 addr)
{
    unsigned char net_num = ((unsigned char *)&addr)[0];
    unsigned char host_num = ((unsigned char *)&addr)[3];
    if (net_num == 10 || host_num == 1 || host_num == 2)
        return 1;
    return 0;
}

int filter_src_dst_ip(__be32 s_addr, __be32 d_addr)
{
    int i = filter_ip(s_addr) && filter_ip(d_addr);
    return i;
}

/* NF_INET_PRE_ROUTING */
unsigned int pre_routing_hook(unsigned int hooknum, struct sk_buff *skb,
                                const struct net_device *in, const struct net_device *out,
                                int (*okfn)(struct sk_buff *))
{
//    unsigned char *puc = skb->head + skb->mac_header;
//    unsigned char *puc = &skb->head[(int)skb->mac_header];
//                 skb->head + skb->mac_header;
/*    unsigned char *pucMacHdr = skb_mac_header(skb);
    unsigned int ui12 = pucMacHdr[12];
    unsigned int ui13 = pucMacHdr[13];
    printk("pre_routing_hook() : %02X, %02X <--> %d, %d, %d\n", ui12, ui13, skb->len, skb->data_len, skb->mac_len);

/*
    struct iphdr *ip_header;

    ip_header = ip_hdr(skb);
    if (filter_src_dst_ip(ip_header->saddr, ip_header->daddr))
    {
        printk("pre_routing_hook()==================================\n");
        printk_ip("src ip:", ip_header->saddr);
        printk_ip("dst ip:", ip_header->daddr);
    }
//*/
    return NF_ACCEPT;
}

struct nf_hook_ops pre_routing_ops =
{
    .hook = pre_routing_hook,
    .pf = PF_INET,
    .hooknum = NF_INET_PRE_ROUTING,
    .priority = NF_IP_PRI_FIRST
};

unsigned int pre_routing_hook_ARP(unsigned int hooknum, struct sk_buff *skb,
                                const struct net_device *in, const struct net_device *out,
                                int (*okfn)(struct sk_buff *))
{
//    unsigned char *puc = skb->head + skb->mac_header;
//    unsigned char *puc = &skb->head[(int)skb->mac_header];
//                 skb->head + skb->mac_header;
    unsigned char *pucMacHdr = skb_mac_header(skb);
    unsigned int ui12 = pucMacHdr[12];
    unsigned int ui13 = pucMacHdr[13];
    printk("pre_routing_hook_ARP() : %02X, %02X <--> %d, %d, %d\n", ui12, ui13, skb->len, skb->data_len, skb->mac_len);

    return NF_ACCEPT;
}

struct nf_hook_ops pre_routing_ops_ARP =
{
    .hook = pre_routing_hook_ARP,
    .pf = NF_ARP,
    .hooknum = NF_ARP_IN,//NF_INET_PRE_ROUTING,
    .priority = NF_IP_PRI_FIRST
};

/* NF_INET_POST_ROUTING */
/*
unsigned int post_routing_hook(unsigned int hooknum, struct sk_buff *skb,
                                const struct net_device *in, const struct net_device *out,
                                int (*okfn)(struct sk_buff *))
{
    struct iphdr *ip_header;

    ip_header = ip_hdr(skb);
    if (filter_src_dst_ip(ip_header->saddr, ip_header->daddr))
    {
        printk("post_routing_hook====================================\n");
        printk_ip("src ip:", ip_header->saddr);
        printk_ip("dst ip:", ip_header->daddr);
    }

    return NF_ACCEPT;
}

struct nf_hook_ops post_routing_ops =
{
    .hook = post_routing_hook,
    .pf = PF_INET,
    .hooknum = NF_INET_POST_ROUTING,
    .priority = NF_IP_PRI_FIRST
};
//*/

/* 注册 */
static int hook_init(void)
{
    printk("hook_init()======================\n");
//    nf_register_hook(&pre_routing_ops);
    nf_register_hook(&pre_routing_ops_ARP);
//    nf_register_hook(&post_routing_ops);

    return 0;
}

static void hook_exit(void)
{
    printk("hook_exit()=====================\n");
//    nf_unregister_hook(&pre_routing_ops);
    nf_unregister_hook(&pre_routing_ops_ARP);
//    nf_unregister_hook(&post_routing_ops);
}

module_init(hook_init);
module_exit(hook_exit);

 

http://bbs.chinaunix.net/thread-1940183-1-1.html

5、

 

转载于:https://www.cnblogs.com/LinuxCode/p/5799215.html