[求助]关于使用NetFilter Hook进行FTP地址伪装的问题

skywjf

各位：

我想利用Linux内核中的NetFilter提供的Hook函数实现FTP地址伪装。
基本想法是：
1、在数据包即将离开本机之前设置Hook，对特定的数据包(FTP)进行编辑
2、编辑内容：将源IP地址(本机地址)改成伪装地址，重新计算checksum
3、编辑完成后让该数据包继续在网路上传播
4、由于MAC地址是正确的，所以本机理论上应该能收到FTP服务器的答复
5、在数据包到达本机的时候设置Hook，对特定的数据包(FTP)进行编辑
6、编辑内容：将目标IP地址(伪装地址)改成本机地址，重新计算checksum
7、编辑完成后让将数据包继续交给下一个协议层

源代码如下：

1. 
   
2. #include <linux/module.h>;
   
3. #include <linux/kernel.h>;
   
4. #include <linux/skbuff.h>;
   
5. #include <linux/if_ether.h>;
   
6. #include <linux/ip.h>;
   
7. #include <linux/tcp.h>;
   
8. #include <linux/in.h>;
   
9. #include <linux/netfilter.h>;
   
10. #include <linux/netfilter_ipv4.h>;
    
11. #include <linux/netdevice.h>;
    
12. #include <net/tcp.h>;
    
13. #include <asm/checksum.h>;
    
14. 
    
15. MODULE_AUTHOR("SKY <skywjf@hotmail.com>;");
    
16. MODULE_DESCRIPTION("NerFilter Hook Reserch Test");
    
17. #ifdef MODULE_LICENSE
    
18. MODULE_LICENSE("GPL");
    
19. #endif /* MODULE_LICENSE */
    
20. 
    
21. static char local_ip[] = { 0xc0, 0xa8, 0x03, 0x78 };  /* 192.168.3.120 */
    
22. static char target_ip[] = { 0xc0, 0xa8, 0x03, 0x3c }; /* 192.168.3.60 */
    
23. static char foo_ip[] = { 0xc0, 0xa8, 0x03, 0x6f };  /* 192.168.3.111 */
    
24. 
    
25. /*
    
26. * ip_post_fn
    
27. * out packet hook function:
    
28. * catch the out ftp packet, change the source IP to foo.
    
29. */
    
30. unsigned int
    
31. ip_post_fn(unsigned int hooknum,
    
32.            struct sk_buff **skb,
    
33.            const struct net_device *in,
    
34.            const struct net_device *out, int (*okfn) (struct sk_buff *))
    
35. {
    
36.   struct sk_buff *sb = *skb;
    
37.   struct iphdr *ihead = (struct iphdr *)sb->;nh.iph;
    
38.   struct tcphdr *thead = (struct tcphdr *)((unsigned int *)ihead + ihead->;ihl);
    
39. 
    
40.   /* is a ftp packet to target host? */
    
41.   if (ihead->;saddr != *(unsigned int *)local_ip ||
    
42.       ihead->;daddr != *(unsigned int *)target_ip ||
    
43.       ihead->;protocol != IPPROTO_TCP || thead->;dest != htons(21)) {
    
44.     return NF_ACCEPT;
    
45.   }
    
46. 
    
47.   /* change it */
    
48.   ihead->;saddr = *(unsigned int *)foo_ip; /* fooip */
    
49.   thead->;check = 0;
    
50.   thead->;check =
    
51.     tcp_v4_check(thead, sb->;len - ihead->;ihl * 4, ihead->;saddr, ihead->;daddr,
    
52.                  csum_partial((char *)thead, sb->;len - ihead->;ihl * 4, 0));
    
53.   ihead->;check = 0;
    
54.   ihead->;check = ip_fast_csum((unsigned char *)ihead, ihead->;ihl);
    
55. 
    
56.   return NF_ACCEPT;
    
57. }
    
58. 
    
59. 
    
60. /*
    
61. * ip_pre_fn
    
62. * in packet hook function:
    
63. * catch the in ftp packet, change the dest IP.
    
64. */
    
65. unsigned int
    
66. ip_pre_fn(unsigned int hooknum,
    
67.           struct sk_buff **skb,
    
68.           const struct net_device *in,
    
69.           const struct net_device *out, int (*okfn) (struct sk_buff *))
    
70. {
    
71.   struct sk_buff *sb = *skb;
    
72.   struct iphdr *ihead = (struct iphdr *)sb->;nh.iph;
    
73.   struct tcphdr *thead = (struct tcphdr *)((unsigned int *)ihead + ihead->;ihl);
    
74. 
    
75.   if (ihead->;saddr != *(unsigned int *)target_ip ||
    
76.       ihead->;daddr != *(unsigned int *)foo_ip ||
    
77.       ihead->;protocol != IPPROTO_TCP || thead->;source != htons(21)) {
    
78.     return NF_ACCEPT;
    
79.   }
    
80. 
    
81.   ihead->;daddr = *(unsigned int *)local_ip; /* fooip */
    
82.   thead->;check = 0;
    
83.   thead->;check =
    
84.     tcp_v4_check(thead, sb->;len - ihead->;ihl * 4, ihead->;saddr, ihead->;daddr,
    
85.                  csum_partial((char *)thead, sb->;len - ihead->;ihl * 4, 0));
    
86.   ihead->;check = 0;
    
87.   ihead->;check = ip_fast_csum((unsigned char *)ihead, ihead->;ihl);
    
88. 
    
89.   return NF_ACCEPT;
    
90. }
    
91. 
    
92. 
    
93. static struct nf_hook_ops ip_post_ops =
    
94.   { {NULL, NULL}, ip_post_fn, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_FIRST };
    
95. static struct nf_hook_ops ip_pre_ops =
    
96.   { {NULL, NULL}, ip_pre_fn, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_FIRST };
    
97. 
    
98. 
    
99. /*
    
100. * init_module
     
101. * module init function
     
102. */
     
103. int
     
104. init_module()
     
105. {
     
106.   int  ret = 0;
     
107. 
     
108.   if ((ret = nf_register_hook(&ip_post_ops)) < 0) {
     
109.     printk("can't register ip_post_ops hook\n");
     
110.     return ret;
     
111.   }
     
112. 
     
113.   if ((ret = nf_register_hook(&ip_pre_ops)) < 0) {
     
114.     printk("can't register ip_pre_ops hook\n");
     
115.     nf_unregister_hook(&ip_post_ops);
     
116.     return ret;
     
117.   }
     
118. 
     
119.   return 0;
     
120. }
     
121. 
     
122. 
     
123. /*
     
124. * cleanup_module
     
125. * module destroy function
     
126. */
     
127. void
     
128. cleanup_module()
     
129. {
     
130.   nf_unregister_hook(&ip_post_ops);
     
131.   nf_unregister_hook(&ip_pre_ops);
     
132. }
     
133. 
     
134. /*----- eof -----*/
     
135. 
     

复制代码

编译并安装模块后，执行FTP命令，访问target_ip:
ftp 192.168.3.60

结果没反应，在192.168.3.60端抓包发现，FTP包过来了，并且是伪装的IP地址，
checksum也都没有问题。奇怪的是FTP服务器收到这个包不作任何响应。抓包结果如下：

1. 
   
2. Frame 1 (74 bytes on wire, 74 bytes captured)
   
3.     Arrival Time: Apr 22, 2004 15:10:28.868024000
   
4.     Time delta from previous packet: 0.000000000 seconds
   
5.     Time since reference or first frame: 0.000000000 seconds
   
6.     Frame Number: 1
   
7.     Packet Length: 74 bytes
   
8.     Capture Length: 74 bytes
   
9. Ethernet II, Src: 00:90:27:08:90:bc, Dst: 00:00:e2:47:3b:d5
   
10.     Destination: 00:00:e2:47:3b:d5 (00:00:e2:47:3b:d5)
    
11.     Source: 00:90:27:08:90:bc (00:90:27:08:90:bc)
    
12.     Type: IP (0x0800)
    
13. Internet Protocol, Src Addr: 192.168.3.111 (192.168.3.111), Dst Addr: 192.168.3.60 (192.168.3.60)
    
14.     Version: 4
    
15.     Header length: 20 bytes
    
16.     Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
    
17.         0000 00.. = Differentiated Services Codepoint: Default (0x00)
    
18.         .... ..0. = ECN-Capable Transport (ECT): 0
    
19.         .... ...0 = ECN-CE: 0
    
20.     Total Length: 60
    
21.     Identification: 0xeca8 (60584)
    
22.     Flags: 0x04
    
23.         0... = Reserved bit: Not set
    
24.         .1.. = Don't fragment: Set
    
25.         ..0. = More fragments: Not set
    
26.     Fragment offset: 0
    
27.     Time to live: 64
    
28.     Protocol: TCP (0x06)
    
29.     Header checksum: 0xc617 (correct)
    
30.     Source: 192.168.3.111 (192.168.3.111)
    
31.     Destination: 192.168.3.60 (192.168.3.60)
    
32. Transmission Control Protocol, Src Port: 1126 (1126), Dst Port: 21 (21), Seq: 0, Ack: 0, Len: 0
    
33.     Source port: 1126 (1126)
    
34.     Destination port: 21 (21)
    
35.     Sequence number: 0
    
36.     Header length: 40 bytes
    
37.     Flags: 0x0002 (SYN)
    
38.         0... .... = Congestion Window Reduced (CWR): Not set
    
39.         .0.. .... = ECN-Echo: Not set
    
40.         ..0. .... = Urgent: Not set
    
41.         ...0 .... = Acknowledgment: Not set
    
42.         .... 0... = Push: Not set
    
43.         .... .0.. = Reset: Not set
    
44.         .... ..1. = Syn: Set
    
45.         .... ...0 = Fin: Not set
    
46.     Window size: 5840
    
47.     Checksum: 0x5150 (correct)
    
48.     Options: (20 bytes)
    
49.         Maximum segment size: 1460 bytes
    
50.         SACK permitted
    
51.         Time stamp: tsval 39767606, tsecr 0
    
52.         NOP
    
53.         Window scale: 0 (multiply by 1)
    
54. 
    
55. 0000  00 00 e2 47 3b d5 00 90 27 08 90 bc 08 00 45 00   ...G;...'.....E.
    
56. 0010  00 3c ec a8 40 00 40 06 c6 17 c0 a8 03 6f c0 a8   .<..@.@......o..
    
57. 0020  03 3c 04 66 00 15 60 3d 22 9e 00 00 00 00 a0 02   .<.f..`=".......
    
58. 0030  16 d0 51 50 00 00 02 04 05 b4 04 02 08 0a 02 5e   ..QP...........^
    
59. 0040  ce 36 00 00 00 00 01 03 03 00                     .6........
    
60. 
    

复制代码

请教这是为什么？

好好先生

不懂编程，替你顶一下。等待高手出现。

gowind

iptables不是已经有这个功能，是自己练手？

skywjf

自己练习，感觉很简单的样子，只是出了这样的问题很不解。

skywjf

这是一个TCP握手包，看样子数据包在到达TCP协议层之前就被丢了，很不解：为什么checksum都是对的，包还会丢呢？还是有其他的原因？

zhanghx1977

学习，顶一下，支持，也想知道，各位大虾请多指教！qq：254836615  email：zhanghx1977@163.com

zhubaining

鄙人最近在研究用netfilter实现类似NAT功能的应用。。。
也在对数据包进行修改/转发。。。

建议你先查看一下那个FTP server的ARP表格，看看它上面192.168.3.111对应的MAC地址是不是192.168.3.120的。

另外，似乎对数据包不能直接修改吧，之前要调用skb_make_writable()之类的函数吧。

我的MSN：zhubaining（at）hotmail.com，可以讨论讨论。。。