1.5个HOOK点的执行点说明：
数据包从进入系统，进行IP校验以后，首先经过第一个HOOK函数NF_IP_PRE_ROUTING进行处理；
然后就进入FORWARD路由匹配，其决定该数据报是需要转发还是发给本机的；
若该数据包是发给本机的，则该数据经过HOOK函数NF_IP_LOCAL_IN处理以后然后传递给上层协议；
若该数据报应该被转发则它被NF_IP_FORWARD处理；
经过转发的数据报经过最后一个HOOK函数NF_IP_POST_ROUTING处理以后，再传输到网络上。
本地产生的数据经过HOOK函数NF_IP_LOCAL_OUT 处理后，进行路由选择处理，然后经过NF_IP_POST_ROUTING处理后发送出去。
2.nf_hooks结构：
3.协议头字段
#include <linux/netfilter.h>
/* only for userspace compatibility */
#include <limits.h> /* for INT_MIN, INT_MAX */
/* IP Cache bits. */
/* Src IP address. */
#define NFC_IP_SRC 0x0001
/* Dest IP address. */
#define NFC_IP_DST 0x0002
/* Input device. */
#define NFC_IP_IF_IN 0x0004
/* Output device. */
#define NFC_IP_IF_OUT 0x0008
/* TOS. */
#define NFC_IP_TOS 0x0010
/* Protocol. */
#define NFC_IP_PROTO 0x0020
/* IP options. */
#define NFC_IP_OPTIONS 0x0040
/* Frag & flags. */
#define NFC_IP_FRAG 0x0080
/* Per-protocol information: only matters if proto match. */
/* TCP flags. */
#define NFC_IP_TCPFLAGS 0x0100
/* Source port. */
#define NFC_IP_SRC_PT 0x0200
/* Dest port. */
#define NFC_IP_DST_PT 0x0400
/* Something else about the proto */
#define NFC_IP_PROTO_UNKNOWN 0x2000
1.通过源码make编译，生成simple_nf_test.ko，加载进内核使用；
2.使用rmmod卸载模块，将内核计算数据保存进user file；
3.使用od -tu /root/netfilter.log查看保存的file数据。
#Makefile
KERNELDIR ?= /lib/modules/$(shell uname -r)/build
obj-m += simple_nf_test.o
all:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) modules
clean:
make -C /lib/modules/$(shell uname -r)/build M=$(PWD) clean
[root@test02 netfilter-test]# insmod simple_nf_test.ko
[root@test02 netfilter-test]# ping 114.114.114.114
PING 114.114.114.114 (114.114.114.114) 56(84) bytes of data.
^C
--- 114.114.114.114 ping statistics ---
64 packets transmitted, 0 received, 100% packet loss, time 64552ms
[root@test02 netfilter-test]# rmmod simple_nf_test
#dmesg日志
[22038.705777] ----------------------------------------------------------
[22038.705779] 114.114.114.114 is denied by netfilter!
[22038.705780] drop 114.114.114.114 packets count is : 20
[22039.575591] ----------------------------------------------------------
[22039.575602] # source address is 63baf772 , 114.247.186.99
[22039.575607] # dest address is bc14a8c0 , 192.168.20.188
[22039.575609] ----------------------------------------------------------
[22039.575611] ...packet pass filter...
[22039.575613] [simple_nf_test] packet_filter. end.
[22039.729706] ----------------------------------------------------------
[22039.729762] # source address is 72727272 , 114.114.114.114
[22039.729767] # dest address is bc14a8c0 , 192.168.20.188
[22039.729770] ----------------------------------------------------------
[22039.729772] 114.114.114.114 is denied by netfilter!
[22039.729774] drop 114.114.114.114 packets count is : 21
[22040.753807] ----------------------------------------------------------
[22040.753822] # source address is 72727272 , 114.114.114.114
[22040.753826] # dest address is bc14a8c0 , 192.168.20.188
[22040.753829] ----------------------------------------------------------
[22040.753830] 114.114.114.114 is denied by netfilter!
[22040.753832] drop 114.114.114.114 packets count is : 22
...
[22088.630236] ----------------------------------------------------------
[22088.630237] ...packet pass filter...
[22088.630239] [simple_nf_test] packet_filter. end.
[22089.055705] ----------------------------------------------------------
[22089.055722] # source address is 63baf772 , 114.247.186.99
[22089.055727] # dest address is bc14a8c0 , 192.168.20.188
[22089.055729] ----------------------------------------------------------
[22089.055731] ...packet pass filter...
[22089.055733] [simple_nf_test] packet_filter. end.
[22089.060209] packet fillter capture count: 64
[22089.060212] begin to write to netfilter.log
[22089.060258] record file write done .
[22089.060470] [simple_nf_test] remove hook lkm success!
#netfilter.log记录（8byte）
[root@test02 netfilter-test]# od -tu /root/netfilter.log
0000000 64 0
0000010
#simple_nf_test.c
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/init.h>
#include <linux/fs.h>
#include <linux/uaccess.h>
//count变量用于统计filter hook的拦截次数
unsigned long int count = 0L;
//内核数据写入本地文件方法
static int _fileWrite(unsigned long int count)
{
unsigned long int buf[]= { count };
printk("packet fillter capture count: %ld \n",count);
struct file *fp;
mm_segment_t fs;
loff_t pos;
printk("begin to write to netfilter.log \n");
//打开本地文件句柄
fp =filp_open("/root/netfilter.log",O_RDWR|O_CREAT,0644);
if (IS_ERR(fp)){
printk("open file error\n");
return -1;
}
//保护内核空间,地址参数检查
fs =get_fs();
//扩大空间限制到内核地址空间，从而可以在内核空间中使用文件系统调用
set_fs(KERNEL_DS);
//ssize_t kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos)
//内核数据写入用户态文件API，注意buf如果为Int类型，将以ascii码的方式，保存进文件。所以从文件中获取Int数据时，需要使用od -tu filename命令。
pos =0;
kernel_write(fp,buf, sizeof(buf), &pos);
//关闭文件句柄
filp_close(fp,NULL);
//关闭内核空间的文件系统调用
set_fs(fs);
return 0;
}
unsigned int packet_filter(unsigned int hooknum, struct sk_buff *skb,const struct net_device *in, const struct net_device *out,int (*okfn)(struct sk_buff *))
{
//ip协议头部
struct iphdr *iph;
//tcp协议头部
struct tcphdr *tcph;
//udp协议头部
struct udphdr *udph;
//如socket buffer指针为空，则当前hook点允许该数据包继续在协议栈中流转。
//define NF_ACCEPT 1
if(skb == NULL)
return NF_ACCEPT;
//如skb不为空，则从skb获取ip头，使用内核API ip_hdr（）
iph = ip_hdr(skb);
//如ip头为空，则当前hook点允许该数据包继续在协议栈中流转。
if(iph == NULL)
return NF_ACCEPT;
//打印经过hook的包信息
printk("----------------------------------------------------------");
printk("# source address is %x , %pI4 \n",iph->saddr,&iph->saddr);
printk("# dest address is %x , %pI4 \n",iph->daddr,&iph->daddr);
printk("----------------------------------------------------------");
//示例增加对IP地址114.114.114.114（十六进制表示：0x72727272）的地址过滤
if(iph->saddr == 0x72727272){
printk("114.114.114.114 is denied by netfilter!\n");
//命中计数器统计
count++;
printk("drop 114.114.114.114 packets count is : %ld \n",count);
// 丢弃该数据包
return NF_DROP;
/*
#include\uapi\linux\netfilter.h
/* Responses from hook functions. */
#define NF_DROP 0 // 丢弃该数据包
#define NF_ACCEPT 1 // 当前hook点，允许该数据包继续在协议栈中流转
#define NF_STOLEN 2 // 让netfilter框架忽略该数据包的处理
#define NF_QUEUE 3 // 该数据包加入到用户队列，供用户程序处理
#define NF_REPEAT 4
#define NF_STOP 5 /* Deprecated, for userspace nf_queue compatibility. */
#define NF_MAX_VERDICT NF_STOP
*/
}
printk("...packet pass filter...");
//协议层逻辑
switch(iph->protocol)
{
case IPPROTO_TCP:
tcph = (struct tcphdr *)(skb->data + (iph->ihl * 4));
//printk("#tcp source port is [%d].\n",ntohs(tcph->source));
//printk("#tcp dest port is [%d].\n",ntohs(tcph->dest));
//if TCP then do something
break;
case IPPROTO_UDP:
udph = (struct udphdr *)(skb->data + (iph->ihl * 4));
//printk("#udp source port is [%d].\n",ntohs(udph->source));
//printk("#udp dest port is [%d].\n",ntohs(udph->source));
//if UDP then do someting
break;
default :
//放行数据包
return NF_ACCEPT;
}
printk("[simple_nf_test] %s. end.\n", __func__);
return NF_ACCEPT;
};
/*
//hook结构体
struct nf_hook_ops {
struct list_head list; /* 标准链表—由于链接所有钩子点 */
/* User fills in from here down. */
nf_hookfn *hook; /* 钩子函数回调指针 */
struct net_device *dev; /* 网络设备指针 */
void *priv; /* 私有数据，在钩子回调函数中使用 */
u_int8_t pf; /* 协议族 */
unsigned int hooknum; /* hook点 */
/* Hooks are ordered in ascending priority. */
int priority; /* 优先级 */
};
*/
//初始化hook参数
static struct nf_hook_ops packet_simple_nf_opt = {
//hook函数packet_filter
.hook = (nf_hookfn *)packet_filter,
//协议指定为ip协议
.pf = NFPROTO_INET,
//hook点 NF_INET_PRE_ROUTING 优先级最高
.hooknum = NF_INET_PRE_ROUTING,
.priority = NF_IP_PRI_FIRST,
/*
//hook支持的协议
enum {
NFPROTO_UNSPEC = 0,
NFPROTO_INET = 1,
NFPROTO_IPV4 = 2,
NFPROTO_ARP = 3,
NFPROTO_NETDEV = 5,
NFPROTO_BRIDGE = 7,
NFPROTO_IPV6 = 10,
NFPROTO_DECNET = 12,
NFPROTO_NUMPROTO,
};
*/
/*
内核中注册的5个HOOK点如下：
enum nf_inet_hooks {
NF_INET_PRE_ROUTING,
NF_INET_LOCAL_IN,
NF_INET_FORWARD,
NF_INET_LOCAL_OUT,
NF_INET_POST_ROUTING,
NF_INET_NUMHOOKS
};
*/
/*
enum nf_ip_hook_priorities {
NF_IP_PRI_FIRST = INT_MIN,
NF_IP_PRI_RAW_BEFORE_DEFRAG = -450,
NF_IP_PRI_CONNTRACK_DEFRAG = -400,
NF_IP_PRI_RAW = -300,
NF_IP_PRI_SELINUX_FIRST = -225,
NF_IP_PRI_CONNTRACK = -200,
NF_IP_PRI_MANGLE = -150,
NF_IP_PRI_NAT_DST = -100,
NF_IP_PRI_FILTER = 0,
NF_IP_PRI_SECURITY = 50,
NF_IP_PRI_NAT_SRC = 100,
NF_IP_PRI_SELINUX_LAST = 225,
NF_IP_PRI_CONNTRACK_HELPER = 300,
NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
NF_IP_PRI_LAST = INT_MAX,
};
*/
};
static int simple_nf_init(void)
{
//注册函数钩子，内核版本大于4.3.0的内核函数API为nf_register_net_hook，否则为nf_register_hook
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,3,0)
//int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
//网络系统在初始化的时候会初始化一个初始网络命名空间，即init_net命名空间。后续创建的net namespace命名空间会和init_net一起通过list项组织起来，且每个网络设备都对应一个命名空间
nf_register_net_hook(&init_net, &packet_simple_nf_opt);
#else
nf_register_hook(&packet_simple_nf_opt);
#endif
printk("[simple_nf_test] network hooks success.\n");
return 0;
};
static void simple_nf_exit(void)
{
//write capute packets count to user file.
_fileWrite(count);
printk("record file write done.\n");
//卸载hook函数
#if LINUX_VERSION_CODE >= KERNEL_VERSION(4,3,0)
nf_unregister_net_hook(&init_net, &packet_simple_nf_opt);
#else
nf_unregister_hook(&packet_simple_nf_opt);
#endif
printk("[simple_nf_test] remove hook lkm success!\n");
};
//内核模块加载和卸载时，执行的函数
module_init(simple_nf_init);
module_exit(simple_nf_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Jeb");