我無法正確修改內核模塊中的ICMP流量

Question

所以這裏是我正在嘗試做的事（微不足道，我知道;我正在做這個來學習項目的某些東西）： 我已經構建了這個模塊來捕獲所有傳出流量，請檢查它是否是ICMP回顯消息流量。 如果是這樣，它只是重新計算ICMP數據包的校驗和，然後讓它繼續。

每次我insmod這個模塊，所有PING流量都會失敗>。 < 你能告訴我我在做什麼錯嗎？

/* 
     Coder: Adel *. ******* 
    Creation Date: April/7th/2012 
    Last Modification Date: April/9th/2012 
    Purpose: This module is merely a prototype on how to change the IP/ICMP pakcet information and still let it go without problems 
    Testing: This module is being tested on a machine running the Linux kernel 2.6.32-33 on a 64bits Intel Processor  
    Notes: N/A 
*/ 


#include <linux/module.h> 
#include <linux/kernel.h> 
#include <linux/init.h> 

#include <linux/inet.h> 
#include <linux/ip.h> 
#include <linux/icmp.h> 
#include <linux/tcp.h> 
#include <linux/in.h> 

#include <linux/netfilter.h> 
#include <linux/netfilter_ipv4.h> 

static struct nf_hook_ops nfho; 
static void printICMPHeader(struct icmphdr *icmph); 

/* 
* in_cksum -- 
* Checksum routine for Internet Protocol 
* family headers (C Version) 
*/ 
unsigned short in_cksum(unsigned short *addr, int len) 
{ 
    register int sum = 0; 
     u_short answer = 0; 
     register u_short *w = addr; 
     register int nleft = len; 
     /* 
     * Our algorithm is simple, using a 32 bit accumulator (sum), we add 
     * sequential 16 bit words to it, and at the end, fold back all the 
     * carry bits from the top 16 bits into the lower 16 bits. 
     */ 
     while (nleft > 1) 
     { 
      sum += *w++; 
      nleft -= 2; 
     } 
     /* mop up an odd byte, if necessary */ 
     if (nleft == 1) 
     { 
      *(u_char *) (&answer) = *(u_char *) w; 
      sum += answer; 
     } 
     /* add back carry outs from top 16 bits to low 16 bits */ 
     sum = (sum >> 16) + (sum & 0xffff);  /* add hi 16 to low 16 */ 
     sum += (sum >> 16);    /* add carry */ 
     answer = ~sum;    /* truncate to 16 bits */ 
     return (answer); 
} 

static unsigned int icmp_check(unsigned int hooknum, 
        struct sk_buff *skb, 
        const struct net_device *in, 
        const struct net_device *out, 
        int (*okfn)(struct sk_buff *)) 
{ 
    struct iphdr *iph; 
    struct icmphdr *icmph; 
    struct tcphdr *tcph; 

    if(skb == NULL) 
     return -1; 
    iph = ip_hdr(skb); 
    if(iph->protocol == IPPROTO_ICMP){ 
     printk(KERN_DEBUG"ICMP traffic!\n"); 
     icmph = icmp_hdr(skb); 
     if(icmph->type == ICMP_ECHO){ 
      printICMPHeader(icmph); 
      icmph->checksum = in_cksum((unsigned short *)icmph, sizeof(struct icmphdr)); 
      printICMPHeader(icmph); 
     } 
    }/* If IPPROTO_ICMP */ 
    return NF_ACCEPT; 
} 


static void printICMPHeader(struct icmphdr *icmph) 
{ 
    printk(KERN_DEBUG "ICMP print function begin \n"); 
    printk(KERN_DEBUG "ICMP type = %d\n", icmph->type); 
    printk(KERN_DEBUG "ICMP code = %d\n", icmph->code); 
    printk(KERN_DEBUG "ICMP checksum = %d\n", icmph->checksum); 
    printk(KERN_DEBUG "ICMP id = %d\n", icmph->un.echo.id); 
    printk(KERN_DEBUG "ICMP sequence = %d\n", icmph->un.echo.sequence); 
    printk(KERN_DEBUG "ICMP print function exit \n");  
} 


static int __init startup(void) 
{ 
     printk(KERN_INFO "Loading Test module...\n"); 
     printk(KERN_ALERT "Hello world\n"); 

     /* Fill in our hook structure */ 
     nfho.hook = icmp_check;   /* Handler function */ 
     nfho.hooknum = NF_INET_POST_ROUTING; /* Just before it hits the wire */ 
     nfho.pf  = PF_INET; 
     nfho.priority = NF_IP_PRI_FILTER; 
     nf_register_hook(&nfho); 
    //pinger(); 
    return 0; 
} 

static void __exit cleanup(void) 
{ 
    nf_unregister_hook(&nfho); 
    printk(KERN_ALERT "Goodbye Mr.\n"); 
} 

module_init(startup); 
module_exit(cleanup); 

編輯： 要調試的代碼一點點，我做了我自己的用戶空間Ping實用程序，我已經使用ICMP報文頭填補其所有的IP和RAW_SOCKETS

icmp->type   = ICMP_ECHO; 
    icmp->code   = 0; 
    icmp->un.echo.id  = 0; 
    icmp->un.echo.sequence = 0; 
    icmp-> checksum  = in_cksum((unsigned short *)icmp, sizeof(struct icmphdr)); 

只要我的模塊沒有加載，此實用程序工作得很好。 古怪的是，當我打開我的模塊，並檢查內核調試文件，看看我得到：

Apr 9 10:42:10 DHS-1022CYB kernel: [ 2521.862356] ICMP traffic! 
Apr 9 10:42:58 DHS-1022CYB kernel: [ 2569.572346] ICMP traffic! 
Apr 9 10:43:22 DHS-1022CYB kernel: [ 2593.317201] ICMP traffic! 
Apr 9 10:43:56 DHS-1022CYB kernel: [ 2627.331320] ICMP traffic! 
Apr 9 10:44:05 DHS-1022CYB kernel: [ 2636.802236] ICMP traffic! 
Apr 9 10:44:08 DHS-1022CYB kernel: [ 2639.876490] ICMP traffic! 
Apr 9 10:45:27 DHS-1022CYB kernel: [ 2718.422229] ICMP traffic! 

這基本上意味着，我，一些奇怪的原因，我甚至無法趕上ECHO交通我的模塊！ （當我能不能抓住它，它只是出去和運行完美） PS我試圖改變鉤LOCAL_OUT，得到了相同的結果

EDIT2：結果DEBUG文件的變化是這樣的

Apr 9 10:57:24 DHS-1022CYB kernel: [ 3435.916336] ICMP print function exit 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922656] ICMP traffic! 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922665] ICMP print function begin 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922670] ICMP type = 8 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922674] ICMP code = 0 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922677] ICMP checksum = 50252 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922681] ICMP id = 3673 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922685] ICMP sequence = 512 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922688] ICMP print function exit 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922691] ICMP print function begin 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922695] ICMP type = 8 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922698] ICMP code = 0 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922702] ICMP checksum = 11090 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922705] ICMP id = 3673 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922709] ICMP sequence = 512 
Apr 9 10:57:25 DHS-1022CYB kernel: [ 3436.922712] ICMP print function exit 

但請注意，這是Linux實用程序ping的結果，而不是我手寫的PING（我仍然因爲某些原因無法截取）。 只要裝載我的模塊，Linux ping就不能工作。

Answer 1

您不能正確計算校驗和......正如您可以通過日誌看到的一樣。 ICMP校驗和計算整個消息，而不僅僅是頭部。所以你的情況：

icmph->checksum = in_cksum((unsigned short *)icmph, sizeof(struct icmphdr)); 

應該是：

icmph->checksum = 0; 
icmph->checksum = in_cksum((unsigned short *)icmph, 
          ntohs(iph->tot_len) - (iph->ihl << 2)); 

另外，不要忘了初始化字段設置爲0

Answer 2

它看起來像你錯估校驗，通過包括未初始化校驗字段本身：

icmph->checksum = in_cksum((unsigned short *)icmph, sizeof(struct icmphdr)); 

AVRnet docs說，校驗字段應該被初始化爲0，則計算校驗和之前。因此，嘗試，簡單地說：

icmph->checksum = 0; 
icmph->checksum = in_cksum((unsigned short *)icmph, sizeof(struct icmphdr)); 

這只是一個猜測真的;我從來沒有編寫過TCP/IP編程的不幸：D但是我認爲，即使內核足夠聰明，可以將它初始化爲0以用於校驗碼，但是您正在進行重新校驗和，所以這個會是的問題。