该楼层疑似违规已被系统折叠 隐藏此楼查看此楼
#include
#include
#include
#include
#include
MODULE_LICENSE("Dual BSD/GPL");
MODULE_AUTHOR("CG");
MODULE_DESCRIPTION("FW based on Netfilter Frame");
MODULE_VERSION("1.0");
#define printk_ip(info, be32_addr)\
printk("%s %d.%d.%d.%d\n",info,\
((unsigned char *)&(be32_addr))[0],\
((unsigned char *)&(be32_addr))[1],\
((unsigned char *)&(be32_addr))[2],\
((unsigned char *)&(be32_addr))[3])
int filter_ip(__be32 addr)
{
unsigned char net_num = ((unsigned char *)&addr)[0];
unsigned char host_num = ((unsigned char *)&addr)[3];
if (net_num == 10 || host_num == 1 || host_num == 2)
return 1;
return 0;
}
int filter_src_dst_ip(__be32 s_addr, __be32 d_addr)
{
int i = filter_ip(s_addr) && filter_ip(d_addr);
return i;
}
/* NF_INET_LOCAL_IN Hook func.*/
unsigned int local_in_hook(unsigned int hooknum, struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct iphdr *ip_header;
ip_header = ip_hdr(skb);
if(filter_src_dst_ip(ip_header->saddr, ip_header->daddr))
{
printk("Local_in_hook()=============================\n");
printk_ip("Src IP:", ip_header->saddr);
printk_ip("Dst IP:", ip_header->daddr);
}
return NF_ACCEPT;
}
/*We need this to register our hook func.*/
struct nf_hook_ops local_in_ops =
{
.hook= local_in_hook,//Hook func.
.pf= PF_INET,//Protocal type -> IPV4
.hooknum= NF_INET_LOCAL_IN, //Hook Point
.priority= NF_IP_PRI_FIRST
};
/* NF_INET_LOCAL_OUT Hook func.*/
unsigned int local_out_hook(unsigned int hooknum, struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct iphdr *ip_header;
ip_header = ip_hdr(skb);
if (filter_src_dst_ip(ip_header->saddr, ip_header->daddr))
{
printk("Local_out_hook()===========================\n");
printk_ip("Src IP:", ip_header->saddr);
printk_ip("Dst IP:", ip_header->daddr);
}
return NF_ACCEPT;
}
/*Enum of LOCAL_OUT Hook func*/
struct nf_hook_ops local_out_ops =
{
.hook= local_out_hook,
.pf= PF_INET,//Protocal type -> IPV4
.hooknum= NF_INET_LOCAL_OUT,//Hook Point
.priority= NF_IP_PRI_FIRST
};
/*Register hook func.*/
static int hook_init(void)
{
printk("Hook_init()===================================\n");
nf_register_hook(&local_in_ops);
nf_register_hook(&local_out_ops);
return 0;
}
/*Unregister hook func.*/
static void hook_exit(void)
{
printk("Hook_exit()===================================\n");
nf_unregister_hook(&local_in_ops);
nf_unregister_hook(&local_out_ops);
}
module_init(hook_init);
module_exit(hook_exit);