[求助]关于使用NetFilter Hook进行FTP地址伪装的问题 - Chinaunix

#include <linux/module.h>;
#include <linux/kernel.h>;
#include <linux/skbuff.h>;
#include <linux/if_ether.h>;
#include <linux/ip.h>;
#include <linux/tcp.h>;
#include <linux/in.h>;
#include <linux/netfilter.h>;
#include <linux/netfilter_ipv4.h>;
#include <linux/netdevice.h>;
#include <net/tcp.h>;
#include <asm/checksum.h>;
MODULE_AUTHOR("SKY <skywjf@hotmail.com>;");
MODULE_DESCRIPTION("NerFilter Hook Reserch Test");
#ifdef MODULE_LICENSE
MODULE_LICENSE("GPL");
#endif /* MODULE_LICENSE */
static char local_ip[] = { 0xc0, 0xa8, 0x03, 0x78 }; /* 192.168.3.120 */
static char target_ip[] = { 0xc0, 0xa8, 0x03, 0x3c }; /* 192.168.3.60 */
static char foo_ip[] = { 0xc0, 0xa8, 0x03, 0x6f }; /* 192.168.3.111 */
/*
* ip_post_fn
* out packet hook function:
* catch the out ftp packet, change the source IP to foo.
*/
unsigned int
ip_post_fn(unsigned int hooknum,
struct sk_buff **skb,
const struct net_device *in,
const struct net_device *out, int (*okfn) (struct sk_buff *))
{
struct sk_buff *sb = *skb;
struct iphdr *ihead = (struct iphdr *)sb->;nh.iph;
struct tcphdr *thead = (struct tcphdr *)((unsigned int *)ihead + ihead->;ihl);
/* is a ftp packet to target host? */
if (ihead->;saddr != *(unsigned int *)local_ip ||
ihead->;daddr != *(unsigned int *)target_ip ||
ihead->;protocol != IPPROTO_TCP || thead->;dest != htons(21)) {
return NF_ACCEPT;
}
/* change it */
ihead->;saddr = *(unsigned int *)foo_ip; /* fooip */
thead->;check = 0;
thead->;check =
tcp_v4_check(thead, sb->;len - ihead->;ihl * 4, ihead->;saddr, ihead->;daddr,
csum_partial((char *)thead, sb->;len - ihead->;ihl * 4, 0));
ihead->;check = 0;
ihead->;check = ip_fast_csum((unsigned char *)ihead, ihead->;ihl);
return NF_ACCEPT;
}
/*
* ip_pre_fn
* in packet hook function:
* catch the in ftp packet, change the dest IP.
*/
unsigned int
ip_pre_fn(unsigned int hooknum,
struct sk_buff **skb,
const struct net_device *in,
const struct net_device *out, int (*okfn) (struct sk_buff *))
{
struct sk_buff *sb = *skb;
struct iphdr *ihead = (struct iphdr *)sb->;nh.iph;
struct tcphdr *thead = (struct tcphdr *)((unsigned int *)ihead + ihead->;ihl);
if (ihead->;saddr != *(unsigned int *)target_ip ||
ihead->;daddr != *(unsigned int *)foo_ip ||
ihead->;protocol != IPPROTO_TCP || thead->;source != htons(21)) {
return NF_ACCEPT;
}
ihead->;daddr = *(unsigned int *)local_ip; /* fooip */
thead->;check = 0;
thead->;check =
tcp_v4_check(thead, sb->;len - ihead->;ihl * 4, ihead->;saddr, ihead->;daddr,
csum_partial((char *)thead, sb->;len - ihead->;ihl * 4, 0));
ihead->;check = 0;
ihead->;check = ip_fast_csum((unsigned char *)ihead, ihead->;ihl);
return NF_ACCEPT;
}
static struct nf_hook_ops ip_post_ops =
{ {NULL, NULL}, ip_post_fn, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_FIRST };
static struct nf_hook_ops ip_pre_ops =
{ {NULL, NULL}, ip_pre_fn, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_FIRST };
/*
* init_module
* module init function
*/
int
init_module()
{
int ret = 0;
if ((ret = nf_register_hook(&ip_post_ops)) < 0) {
printk("can't register ip_post_ops hook\n");
return ret;
}
if ((ret = nf_register_hook(&ip_pre_ops)) < 0) {
printk("can't register ip_pre_ops hook\n");
nf_unregister_hook(&ip_post_ops);
return ret;
}
return 0;
}
/*
* cleanup_module
* module destroy function
*/
void
cleanup_module()
{
nf_unregister_hook(&ip_post_ops);
nf_unregister_hook(&ip_pre_ops);
}
/*----- eof -----*/

复制代码

Frame 1 (74 bytes on wire, 74 bytes captured)
Arrival Time: Apr 22, 2004 15:10:28.868024000
Time delta from previous packet: 0.000000000 seconds
Time since reference or first frame: 0.000000000 seconds
Frame Number: 1
Packet Length: 74 bytes
Capture Length: 74 bytes
Ethernet II, Src: 00:90:27:08:90:bc, Dst: 00:00:e2:47:3b:d5
Destination: 00:00:e2:47:3b:d5 (00:00:e2:47:3b:d5)
Source: 00:90:27:08:90:bc (00:90:27:08:90:bc)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.3.111 (192.168.3.111), Dst Addr: 192.168.3.60 (192.168.3.60)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 60
Identification: 0xeca8 (60584)
Flags: 0x04
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: TCP (0x06)
Header checksum: 0xc617 (correct)
Source: 192.168.3.111 (192.168.3.111)
Destination: 192.168.3.60 (192.168.3.60)
Transmission Control Protocol, Src Port: 1126 (1126), Dst Port: 21 (21), Seq: 0, Ack: 0, Len: 0
Source port: 1126 (1126)
Destination port: 21 (21)
Sequence number: 0
Header length: 40 bytes
Flags: 0x0002 (SYN)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Window size: 5840
Checksum: 0x5150 (correct)
Options: (20 bytes)
Maximum segment size: 1460 bytes
SACK permitted
Time stamp: tsval 39767606, tsecr 0
NOP
Window scale: 0 (multiply by 1)
0000 00 00 e2 47 3b d5 00 90 27 08 90 bc 08 00 45 00 ...G;...'.....E.
0010 00 3c ec a8 40 00 40 06 c6 17 c0 a8 03 6f c0 a8 .<..@.@......o..
0020 03 3c 04 66 00 15 60 3d 22 9e 00 00 00 00 a0 02 .<.f..`=".......
0030 16 d0 51 50 00 00 02 04 05 b4 04 02 08 0a 02 5e ..QP...........^
0040 ce 36 00 00 00 00 01 03 03 00 .6........

复制代码