所以这就是我想要做的事情（微不足道，我知道；我这样做是为了为一个项目学习一些东西）：我已经构建了这个模块来捕获所有传出流量，检查它是否是 ICMP 回显消息流量。如果是，它只是重新计算 ICMP 数据包的校验和，然后让它继续。
每次我insmod这个模块时，所有PING流量都会失败>.<你能告诉我我在这里做错了什么吗？
/*
Coder: Adel *. *******
Creation Date: April/7th/2012
Last Modification Date: April/9th/2012
Purpose: This module is merely a prototype on how to change the IP/ICMP pakcet information and still let it go without problems
Testing: This module is being tested on a machine running the Linux kernel 2.6.32-33 on a 64bits Intel Processor
Notes: N/A
*/
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/inet.h>
#include <linux/ip.h>
#include <linux/icmp.h>
#include <linux/tcp.h>
#include <linux/in.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
static struct nf_hook_ops nfho;
static void printICMPHeader(struct icmphdr *icmph);
/*
* in_cksum --
* Checksum routine for Internet Protocol
* family headers (C Version)
*/
unsigned short in_cksum(unsigned short *addr, int len)
{
register int sum = 0;
u_short answer = 0;
register u_short *w = addr;
register int nleft = len;
/*
* Our algorithm is simple, using a 32 bit accumulator (sum), we add
* sequential 16 bit words to it, and at the end, fold back all the
* carry bits from the top 16 bits into the lower 16 bits.
*/
while (nleft > 1)
{
sum += *w++;
nleft -= 2;
}
/* mop up an odd byte, if necessary */
if (nleft == 1)
{
*(u_char *) (&answer) = *(u_char *) w;
sum += answer;
}
/* add back carry outs from top 16 bits to low 16 bits */
sum = (sum >> 16) + (sum & 0xffff); /* add hi 16 to low 16 */
sum += (sum >> 16); /* add carry */
answer = ~sum; /* truncate to 16 bits */
return (answer);
}
static unsigned int icmp_check(unsigned int hooknum,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct iphdr *iph;
struct icmphdr *icmph;
struct tcphdr *tcph;
if(skb == NULL)
return -1;
iph = ip_hdr(skb);
if(iph->protocol == IPPROTO_ICMP){
printk(KERN_DEBUG"ICMP traffic!\n");
icmph = icmp_hdr(skb);
if(icmph->type == ICMP_ECHO){
printICMPHeader(icmph);
icmph->checksum = in_cksum((unsigned short *)icmph, sizeof(struct icmphdr));
printICMPHeader(icmph);
}
}/* If IPPROTO_ICMP */
return NF_ACCEPT;
}
static void printICMPHeader(struct icmphdr *icmph)
{
printk(KERN_DEBUG "ICMP print function begin \n");
printk(KERN_DEBUG "ICMP type = %d\n", icmph->type);
printk(KERN_DEBUG "ICMP code = %d\n", icmph->code);
printk(KERN_DEBUG "ICMP checksum = %d\n", icmph->checksum);
printk(KERN_DEBUG "ICMP id = %d\n", icmph->un.echo.id);
printk(KERN_DEBUG "ICMP sequence = %d\n", icmph->un.echo.sequence);
printk(KERN_DEBUG "ICMP print function exit \n");
}
static int __init startup(void)
{
printk(KERN_INFO "Loading Test module...\n");
printk(KERN_ALERT "Hello world\n");
/* Fill in our hook structure */
nfho.hook = icmp_check; /* Handler function */
nfho.hooknum = NF_INET_POST_ROUTING; /* Just before it hits the wire */
nfho.pf = PF_INET;
nfho.priority = NF_IP_PRI_FILTER;
nf_register_hook(&nfho);
//pinger();
return 0;
}
static void __exit cleanup(void)
{
nf_unregister_hook(&nfho);
printk(KERN_ALERT "Goodbye Mr.\n");
}
module_init(startup);
module_exit(cleanup);
编辑： 为了稍微调试一下代码，我制作了自己的用户空间 ping 实用程序，并使用 RAW_SOCKETS 填充了它的所有 IP 和 ICMP 标头
icmp->type = ICMP_ECHO;
icmp->code = 0;
icmp->un.echo.id = 0;
icmp->un.echo.sequence = 0;
icmp-> checksum = in_cksum((unsigned short *)icmp, sizeof(struct icmphdr));
只要我的模块未加载，此实用程序就可以正常工作。奇怪的是，当我加载我的模块并检查内核调试文件时，看看我得到了什么：
Apr 9 10:42:10 DHS-1022CYB kernel: [ 2521.862356] ICMP traffic!
Apr 9 10:42:58 DHS-1022CYB kernel: [ 2569.572346] ICMP traffic!
Apr 9 10:43:22 DHS-1022CYB kernel: [ 2593.317201] ICMP traffic!
Apr 9 10:43:56 DHS-1022CYB kernel: [ 2627.331320] ICMP traffic!
Apr 9 10:44:05 DHS-1022CYB kernel: [ 2636.802236] ICMP traffic!
Apr 9 10:44:08 DHS-1022CYB kernel: [ 2639.876490] ICMP traffic!
Apr 9 10:45:27 DHS-1022CYB kernel: [ 2718.422229] ICMP traffic!
这基本上意味着，出于某种奇怪的原因，我什至无法在我的模块中捕获 ECHO 流量！（当我无法捕捉到它时，它就会熄灭并且工作得很好） PS 我试图将钩子更改为 LOCAL_OUT 并得到相同的结果
EDIT2： DEBUG 文件更改的结果是这样的
Apr 9 10:57:24 DHS-1022CYB kernel: [ 3435.916336] ICMP print function exit
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922656] ICMP traffic!
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922665] ICMP print function begin
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922670] ICMP type = 8
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922674] ICMP code = 0
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922677] ICMP checksum = 50252
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922681] ICMP id = 3673
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922685] ICMP sequence = 512
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922688] ICMP print function exit
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922691] ICMP print function begin
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922695] ICMP type = 8
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922698] ICMP code = 0
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922702] ICMP checksum = 11090
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922705] ICMP id = 3673
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922709] ICMP sequence = 512
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922712] ICMP print function exit
但是请注意，这是 Linux 实用程序 ping 的结果，而不是我手写的 PING（由于某种原因我仍然无法拦截）。只要加载了我的模块，Linux ping 就无法正常工作。