一个完整的netfilter的hook的例子

http://www.xml.org.cn/blog/more.asp?name=hongrui&id=48276

 

这个例子 就是阻断以后的网络数据包
//'Hello World' netfilter hooks example
//For any packet, we drop it, and log fact to /var/log/messages

 

#include <linux/kernel.h> #include <linux/module.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv4.h> static struct nf_hook_ops nfho; //struct holding set of hook function options //function to be called by hook unsigned int hook_func(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *)) { printk(KERN_INFO "packet dropped/n"); //log to var/log/messages return NF_DROP; //drops the packet } //Called when module loaded using 'insmod' int init_module() { nfho.hook = hook_func; //function to call when conditions below met nfho.hooknum = NF_IP_PRE_ROUTING; //called right after packet recieved, first hook in Netfilter nfho.pf = PF_INET; //IPV4 packets nfho.priority = NF_IP_PRI_FIRST; //set to highest priority over all other hook functions nf_register_hook(&nfho); //register hook return 0; //return 0 for success } //Called when module unloaded using 'rmmod' void cleanup_module() { nf_unregister_hook(&nfho); //cleanup – unregister hook }

 

Makefile

obj-m := hello.o
KDIR := /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)
default:
 $(MAKE) -C $(KDIR) SUBDIRS=$(PWD) modules

编译命令 make -C /usr/src/kernels/2.6.9-67.EL-i686/ SUBDIRS=$PWD modules
加载模块 insmod hello.ko
此时网络已经断开，到控制台 输入 lsmod |grep hello
rmmod hello.ko
tail /var/log/messages

 

再上多一个例子

 

#ifndef __KERNEL__ #define __KERNEL__ #endif #ifndef MODULE #define MODULE #endif #include <linux/module.h> #include <linux/kernel.h> #include <linux/skbuff.h> #include <linux/in.h> #include <linux/ip.h> #include <linux/tcp.h> #include <linux/icmp.h> #include <linux/netdevice.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv4.h> #include <linux/if_arp.h> #include <linux/if_ether.h> #include <linux/if_packet.h> static struct nf_hook_ops nfho; unsigned char* ip = "/x7f/x00/x00/x01"; unsigned char* drop_ip = "/xC0/xA8/x08/xC9"; unsigned int hook_func(unsigned int hooknum, struct sk_buff **skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *)) { struct sk_buff* sb = *skb; struct tcphdr *tcp = NULL; unsigned int d_ip ,s_ip = 0; unsigned int d_port = 0,s_port = 0; if( sb->nh.iph->protocol == IPPROTO_TCP ) tcp = (struct tcphdr *)((sb->data) + (sb->nh.iph->ihl * 4)); d_ip = sb->nh.iph->daddr; s_ip = sb->nh.iph->saddr; if( tcp) { d_port = tcp->source; s_port = tcp->dest; } if( sb->nh.iph->saddr == *(unsigned int*)drop_ip ) { printk( "Droped packet from ..%d.%d.%d.%d:%d/n", NIPQUAD(s_ip), s_port ); return NF_DROP; } printk( "FROM:%d.%d.%d.%d:%d TO:%d.%d.%d.%d:%d ETH:%s/n", NIPQUAD(s_ip), s_port, NIPQUAD(d_ip), d_port, in->name ); return NF_ACCEPT; } int init_module() { printk( "begin init module test2/n" ); nfho.hook = hook_func; nfho.hooknum = NF_IP_PRE_ROUTING; nfho.pf = PF_INET; nfho.priority = NF_IP_PRI_FIRST; nf_register_hook(&nfho); printk("init module test2/n"); return 0; } void cleanup_module() { nf_unregister_hook(&nfho); printk("cleanup module test2/n"); } MODULE_LICENSE("GPL");