将革命进行到底,再来一个netfilter例子,这次是过滤指定IP地址的数据包。
1、源代码:filterIp.c
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/netdevice.h>
MODULE_LICENSE("GPL");
/* This is the structure we shall use to register our function */
static struct nf_hook_ops nfho;
/* IP address we want to drop packets from, in NB order */
static unsigned char *drop_ip = "/x7f/x00/x00/x01"; /* 127.0.0.1 */
/* This is the hook function itself */
unsigned int hook_func(unsigned int hooknum,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct sk_buff *sb = skb;
struct iphdr *iph;
iph = ip_hdr(sb);
if (iph->saddr == *(unsigned int *)drop_ip)
{
printk("Dropped packet from... %d.%d.%d.%d/n",
*drop_ip, *(drop_ip + 1), *(drop_ip + 2),*(drop_ip + 3));
return NF_DROP;
}
else
{
return NF_ACCEPT;
}
}
/* Initialisation routine */
int init_module()
{
/* Fill in our hook structure */
nfho.hook = hook_func; /* Handler function */
nfho.hooknum = NF_INET_PRE_ROUTING; /* First hook for IPv4 */
nfho.pf = PF_INET;
nfho.priority = NF_IP_PRI_FIRST; /* Make our function first */
nf_register_hook(&nfho);
pr_info("filterIp install into kernel!/n");
return 0;
}
/* Cleanup routine */
void cleanup_module()
{
nf_unregister_hook(&nfho);
pr_info("filterIp removed from kernel!/n");
}
2、Makefile:
obj-m +=filterIp.o
all:
make -C /lib/modules/`uname -r`/build M=`pwd`
clean:
make -C /lib/modules/`uname -r`/build M=`pwd` clean
install:
/sbin/insmod filterIp.ko
remove:
/sbin/rmmod filterIp
3、编译:
make
4、安装模块:
make install
5、测试:
ping 127.0.0.1
查看/var/log/messages,有如下字样:
Sep 11 11:15:40 vm04 kernel: Dropped packet from... 127.0.0.1
6、卸载模块:
make remove