在NETFILTER框架中实现对SK_BUFF的操作!

lihw_2002

struct iphdr *iph=(*pskb)->nh.iph; struct sk_buff *oldskb=*pskb; struct sk_buff *newskb=skb_copy(oldskb,GFP_ATOMIC); if(iph->protocol == IPPROTO_ICMP)     {         if(newskb){             newskb->sk=oldskb->sk;             skb_insert(oldskb,newskb,&(oldskb->sk)->sk_write_queue);             skb_unlink(oldskb,&(oldskb->sk)->sk_write_queue);             kfree_skb(oldskb);             printk("OK!");     }

在NF_IP_LOCAL_OUT处添加如上代码,实现对SK_BUFF的操作,即拷贝一个SKB,用新的SKB代替旧的SKB(SKB_INSERT:插入,SKB_UNLINK:删除).正常加载后系统崩溃!
有谁了解,一起探讨一下啊!

platinum

没用过 insert 和 unlink 函数
可否贴出崩溃信息？

lihw_2002

1. PING 10.10.103.20 (10.10.103.20) 56(84) bytes of data.
   
2. 
   
3. Message from syslogd@localhost at Fri Dec  7 05:58:51 2007 ...
   
4. localhost kernel: Oops: 0002 [#3]
   
5. 
   
6. Message from syslogd@localhost at Fri Dec  7 05:58:51 2007 ...
   
7. localhost kernel: SMP
   
8. 
   
9. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
   
10. localhost kernel: CPU:    0
    
11. 
    
12. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
13. localhost kernel: EIP is at skb_insert+0x1c/0x31
    
14. 
    
15. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
16. localhost kernel: eax: 00000286   ebx: cd0b9d80   ecx: cfcf9360   edx: 00000000
    
17. 
    
18. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
19. localhost kernel: esi: cfcf9360   edi: cd0b9a80   ebp: cfcf936c   esp: cf396c20
    
20. 
    
21. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
22. localhost kernel: ds: 007b   es: 007b   ss: 0068
    
23. 
    
24. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
25. localhost kernel: Process ping (pid: 3378, ti=cf396000 task=c0150070 task.ti=cf396000)
    
26. 
    
27. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
28. localhost kernel: Stack: cf163610 cd0b9a80 00000003 cf396ca8 d0a4203c cf396c78 d0a42678 cf396c78
    
29. 
    
30. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
31. localhost kernel:        c05c5cd8 cb68f800 c05cd47c c0813a58 00000003 cf396ca8 c0813a58 00000002
    
32. 
    
33. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
34. localhost kernel:        c05c5e12 00000000 cb68f800 cf396c78 c05cd47c 80000000 d0a42678 cf163610
    
35. 
    
36. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
37. localhost kernel: Call Trace:
    
38. 
    
39. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
40. localhost kernel:  [<d0a4203c>] get_icmp+0x3c/0x74 [imp2_k]
    
41. 
    
42. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
43. localhost kernel:  [<c05c5cd8>] nf_iterate+0x38/0x6a
    
44. 
    
45. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
46. localhost kernel:  [<c05c5e12>] nf_hook_slow+0x4d/0xb5
    
47. 
    
48. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
49. localhost kernel:  [<c05cd94a>] ip_push_pending_frames+0x2f2/0x3c3
    
50. 
    
51. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
52. localhost kernel:  [<c05e6644>] raw_sendmsg+0x62b/0x6eb
    
53. 
    
54. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
55. localhost kernel:  [<c05ecee1>] inet_sendmsg+0x3b/0x45
    
56. 
    
57. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
58. localhost kernel:  [<c05a6be3>] sock_sendmsg+0xd0/0xeb
    
59. 
    
60. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
61. localhost kernel:  [<c05a7408>] sys_sendmsg+0x192/0x1f7
    
62. 
    
63. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
64. localhost kernel:  [<c05a895e>] sys_socketcall+0x240/0x261
    
65. 
    
66. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
67. localhost kernel:  [<c0404027>] syscall_call+0x7/0xb
    
68. 
    
69. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
70. localhost kernel: DWARF2 unwinder stuck at syscall_call+0x7/0xb
    
71. 
    
72. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
73. localhost kernel: Leftover inexact backtrace:
    
74. 
    
75. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
76. localhost kernel:  =======================
    
77. 
    
78. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
79. localhost kernel: Code: 5f 5d c3 8b 4c 24 04 83 c1 04 e9 c7 fe ff ff 55 57 89 c7 8d 69 0c 56 89 e8 53 89 ce 89 d3 e8 36 07 06 00 8b 57 04 89 3b 89 53 04 <89> 1a 89 5f 04 89 c2 89 e8 ff 46 08 5b 5e 5f 5d e9 01 07 06 00
    
80. 
    
81. Message from syslogd@localhost at Fri Dec  7 05:58:52 2007 ...
    
82. localhost kernel: EIP: [<c05ab451>] skb_insert+0x1c/0x31 SS:ESP 0068:cf396c20

复制代码

独孤九贱

原帖由 lihw_2002 于 2007-12-6 17:05 发表
struct iphdr *iph=(*pskb)->nh.iph;
struct sk_buff *oldskb=*pskb;
struct sk_buff *newskb=skb_copy(oldskb,GFP_ATOMIC);
if(iph->protocol == IPPROTO_ICMP)
    {
        if(newskb){
            ...

你在三层来操作Socket层的队列？我没有仔细看过Socket层的Skb_buff的队列，不过感觉这个时候这个队列或许都不在了……
你判断一下先？

而且，你要替代这个包，也用不着搞这么麻烦吧？Hook函数传过来的是**pskb，是两个**，实际上也就允许你直接让它重新指向一个新的skb_buff吧？

lihw_2002

队列是存在的,判断过.如果不存在队列也不便实现对SK_BUFF的管理啊.
**pskb看起来是能重新指向一个新的SK_BUFF,但我想sk_buff是经过一个链表管理的,直接这样更改可行吗?

platinum

是否需要考虑锁的问题？因为正如你所说，sk_buff 是一个链表
没读过 skb_insert 和 skb_unlink 函数，不知道其内部是不是已经集成了锁操作

lihw_2002

1. void skb_insert(struct sk_buff *old, struct sk_buff *newsk, struct sk_buff_head *list)
   
2. {
   
3.         unsigned long flags;
   
4. 
   
5.         spin_lock_irqsave(&list->lock, flags);
   
6.         __skb_insert(newsk, old->prev, old, list);
   
7.         spin_unlock_irqrestore(&list->lock, flags);
   
8. }
   

复制代码

在skb_insert和skb_unlink中有对锁的操作,__skb_insert(newsk, old->prev, old, list);中才实现的是具体的指针修改操作,所以我应该可以直接调用那两个函数,不用考虑锁了吧?