改lwfw轻量级防火墙,2.6.28上运行

最新推荐文章于 2022-04-22 18:48:38 发布

隔壁-老阳

最新推荐文章于 2022-04-22 18:48:38 发布

阅读量1w

点赞数

分类专栏： Linux Kernel 文章标签：防火墙 statistics module interface hook tcp

本文链接：https://blog.csdn.net/oyangyufu/article/details/6148741

版权

lwfw轻量级防火墙(改)，kernel 2.6.28

lwfw基本思想：注册设备驱动文件，实例化设备文件的相关操作，主要通过ioctl来控制用户传的ip,tcp,源接口名，实现从内核态匹配规则，达到filter功能。

/* lwfw.c */

#include <linux/module.h> #include <linux/kernel.h> #include <linux/net.h> #include <linux/types.h> #include <linux/skbuff.h> #include <linux/string.h> #include <linux/netdevice.h> #include <linux/netfilter.h> #include <linux/netfilter_ipv4.h> #include <linux/in.h> #include <linux/ip.h> #include <linux/tcp.h> #include <asm/uaccess.h> #include <asm/errno.h> #include <linux/cdev.h> #include <linux/types.h> #include <linux/device.h> #include "lwfw.h" static struct cdev *cdev; static dev_t devno; struct class *my_class; /* Local function prototypes */ static int set_if_rule(char *name); static int set_ip_rule(unsigned int ip); static int set_port_rule(unsigned short port); static int check_ip_packet(struct sk_buff *skb); static int check_tcp_packet(struct sk_buff *skb); static int copy_stats(struct lwfw_stats *statbuff); /* Some function prototypes to be used by lwfw_fops below. */ static int lwfw_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg); static int lwfw_open(struct inode *inode, struct file *file); static int lwfw_release(struct inode *inode, struct file *file); /* Various flags used by the module */ /* This flag makes sure that only one instance of the lwfw device * can be in use at any one time. */ static int lwfw_ctrl_in_use = 0; /* This flag marks whether LWFW should actually attempt rule checking. * If this is zero then LWFW automatically allows all packets. */ static int active = 0; /* Specifies options for the LWFW module */ static unsigned int lwfw_options = (LWFW_IF_DENY_ACTIVE | LWFW_IP_DENY_ACTIVE | LWFW_PORT_DENY_ACTIVE); /* This struct will describe our hook procedure. */ struct nf_hook_ops nfkiller; /* Module statistics structure */ static struct lwfw_stats lwfw_statistics = { 0, 0, 0, 0, 0}; /* Actual rule 'definitions'. */ /* TODO: One day LWFW might actually support many simultaneous rules. * Just as soon as I figure out the list_head mechanism... */ static char *deny_if = NULL; /* Interface to deny */ static unsigned int deny_ip = 0x00000000; /* IP address to deny */ static unsigned short deny_port = 0x0000; /* TCP port to deny */ /* * This is the interface device's file_operations structure */ struct file_operations lwfw_fops = { .ioctl=lwfw_ioctl, .open=lwfw_open, .release=lwfw_release, }; /* * This is the function that will be called by the hook */ unsigned int lwfw_hookfn(unsigned int hooknum,