netfilter无法正常获取smtp包数据问题，高手都进来！

zhayun604863141

1. static unsigned int smtp_bcc_process(unsigned int hook,
   
2.                  struct sk_buff *pskb,
   
3.                  const struct net_device *in,
   
4.                  const struct net_device *out,
   
5.                  int (*okfn)(struct sk_buff *))
   
6. {
   
7.     struct iphdr *iph = ip_hdr(pskb);
   
8. 
   
9.     unsigned int dataoff, datalen;
   
10.     struct tcphdr _tcph, *th;
    
11.     char *smtp_ptr = NULL;
    
12.     __be32 srcaddr=0, dstaddr=0;
    
13.     short emailindex = 0;
    
14.     int addrlen = 0;
    
15.   if (iph->protocol != IPPROTO_TCP)
    
16.     {
    
17.         return NF_ACCEPT;
    
18.     }
    
19.    
    
20.     th = skb_header_pointer(pskb, iph->ihl*4, sizeof(_tcph), &_tcph);
    
21.     if (th == NULL)
    
22.     {
    
23.         return NF_ACCEPT;
    
24.     }
    
25. 
    
26. #if defined(__LITTLE_ENDIAN_BITFIELD)
    
27.     if (th->dest == 0x1900)
    
28. #else
    
29.     if (th->dest == 0x0019)
    
30. #endif
    
31.     {
    
32.         
    
33.         printk(KERN_ALERT "source =%d dest = %d\n",th->source,th->dest);   
    
34.         srcaddr = ntohl(iph->saddr);
    
35.         emailindex = srcaddr%EMAIL_BCC_MAX_ITEM_COUNT;
    
36.     }
    
37. #if defined(__LITTLE_ENDIAN_BITFIELD)
    
38.     else if (th->source == 0x1900)
    
39. #else
    
40.     else if (th->source == 0x0019)
    
41. #endif
    
42.     {
    
43.         
    
44.         printk(KERN_ALERT "source =%d dest = %d\n",th->source,th->dest);   
    
45.         dstaddr = ntohl(iph->daddr);
    
46.         emailindex = dstaddr%EMAIL_BCC_MAX_ITEM_COUNT;
    
47.     }
    
48.     else
    
49.     {
    
50.         return NF_ACCEPT;
    
51.     }
    
52.    
    
53.     if (strlen(proc_emailbcc_info_t.emailaddr) < 5)
    
54.     {
    
55.         printk(KERN_ALERT "strlen <5 NF_ACCEPT\n");
    
56.         DEBUGP("the email bcc address is not valid\n");
    
57.         return NF_ACCEPT;
    
58.     }
    
59.     printk(KERN_ALERT "pskb_data = %s\n",pskb->data);   
    
60.     dataoff =  iph->ihl*4 + th->doff*4;
    
61.    
    
62.     printk(KERN_ALERT "dataoff = %d\n",dataoff);   
    
63.         
    
64.     if (dataoff >= (pskb)->len)
    
65.     {
    
66.         if (th->syn == 1)
    
67.         {
    
68.             email_client_info_t[emailindex].ctl_state = MAIL_STATE_ZERO;
    
69.             email_client_info_t[emailindex].flag = 0;
    
70.             printk(KERN_ALERT "syn == 1 NF_ACCEPT\n");
    
71.             return NF_ACCEPT;
    
72.         }
    
73.     }   
    
74.     data = (char *)th + th->doff*4;
    
75.     printk(KERN_ALERT "pskb->len = %d\n",(pskb)->len);   
    
76.     datalen = (pskb)->len - dataoff;
    
77.    
    
78.     smtp_ptr = skb_header_pointer(pskb, dataoff,
    
79.                     datalen, smtp_buffer);
    
80.     printk(KERN_ALERT "smtp_ptr = %s\n",smtp_ptr);
    
81.     if(smtp_ptr == NULL)
    
82.         printk(KERN_ALERT "smtp_ptr == NULL\n");
    
83.    
    
84.     printk(KERN_ALERT "datalen == %d\n",datalen);
    
85.     smtp_ptr[datalen] = '\0';
    
86.          printk(KERN_ALERT "smtp_ptr== %d\n",smtp_ptr);
    
87.     return NF_ACCEPT;
    
88. }
    

复制代码

发送邮件时，为什么只有两个包打印出来了，而且只有这两个包的pskb->len > 40,其他数据包的pskb->len都等于40。而且邮件正文内容页没有打印出来。

zhayun604863141

自己顶下，防沉！