summaryrefslogtreecommitdiff
path: root/md/notes/kernel/netfilter_module.md
blob: fbe56b64bd71e825f9e7c4d808a8217a36d6e9dc (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
title: Netlink socket
keywords: kernel,linux,netlink,socket

# Kernel netfilter module


## Files

You need to create to files __Makefile__ and __netlink_socket.c__.

__Makefile__
```Makefile
obj-m += netlink_socket.o

KDIR ?= /lib/modules/$(shell uname -r)/build

all:
	make -C $(KDIR) M=$(PWD) modules

clean:
	make -C $(KDIR) M=$(PWD) clean

```


__netlink_socket.c__
```c
//http://www.tldp.org/LDP/lkmpg/2.4/html/c147.htm
#include <linux/module.h>  /* Needed by all modules */
#include <linux/kernel.h>

int netlink_socket_init( void )
{
	printk(KERN_DEBUG "Netlink World!\n");
	return 0;
}

void netlink_socket_exit( void )
{
	printk(KERN_DEBUG "Exit Netlink World!\n");
}

module_init( netlink_socket_init );
module_exit( netlink_socket_exit );

MODULE_LICENSE("GPL");
```


Add to makefile step to compile userspace program

```makefile
all:
	make -C $(KDIR) M=$(PWD) modules
	gcc netlink_connect.c -o netlink_connect
```



## Prepare the hook function

```c
...
static unsigned int netfilter_icmp_blockicmppkt_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state)
{
	struct iphdr *iph;   // IP header
	struct udphdr *udph; // UDP header

	if(!skb)
		return NF_ACCEPT;

	iph = ip_hdr(skb); // retrieve the IP headers from the packet
	if(iph->protocol == IPPROTO_UDP) { 
		udph = udp_hdr(skb);
		if(ntohs(udph->dest) == 53) {
			return NF_ACCEPT; // accept UDP packet
		}
	}
	else if (iph->protocol == IPPROTO_TCP) {
		return NF_ACCEPT; // accept TCP packet
	}
	else if (iph->protocol == IPPROTO_ICMP) {
		printk(KERN_INFO "Drop ICMP packet \n");
		return NF_DROP;   // drop TCP packet
	}

	return NF_ACCEPT;
}
...
```

## Register netfilter

```c
...
int netfilter_icmp_init( void )
{
	...
	nf_blockicmppkt_ops = (struct nf_hook_ops*)kcalloc(1,  sizeof(struct nf_hook_ops), GFP_KERNEL);
	if (nf_blockicmppkt_ops != NULL) {
		nf_blockicmppkt_ops->hook = (nf_hookfn*)netfilter_icmp_blockicmppkt_hook;
		nf_blockicmppkt_ops->hooknum = NF_INET_PRE_ROUTING;
		nf_blockicmppkt_ops->pf = NFPROTO_IPV4;
		nf_blockicmppkt_ops->priority = NF_IP_PRI_FIRST; // set the priority
		
		nf_register_net_hook(&init_net, nf_blockicmppkt_ops);
	}
	...
	return 0;
}
...
```

## Data structures and fucntions

The lis of functions used in this example

__nf_register_net_hook__
```
int nf_register_net_hook(struct net *net, const struct nf_hook_ops *ops);
```

__udp_hdr__
```c
static inline struct udphdr *udp_hdr(const struct sk_buff *skb)
{
	return (struct udphdr *)skb_transport_header(skb);
}
```

__ip_hdr__
```c
static inline struct iphdr *ip_hdr(const struct sk_buff *skb)
{
	return (struct iphdr *)skb_network_header(skb);
}
```

list of hooknum options in hook_ops
```c
enum nf_inet_hooks {
	NF_INET_PRE_ROUTING,
	NF_INET_LOCAL_IN,
	NF_INET_FORWARD,
	NF_INET_LOCAL_OUT,
	NF_INET_POST_ROUTING,
	NF_INET_NUMHOOKS,
	NF_INET_INGRESS = NF_INET_NUMHOOKS,
};
```

list of pf options in hook_ops
```c
enum {
	NFPROTO_UNSPEC =  0,
	NFPROTO_INET   =  1,
	NFPROTO_IPV4   =  2,
	NFPROTO_ARP    =  3,
	NFPROTO_NETDEV =  5,
	NFPROTO_BRIDGE =  7,
	NFPROTO_IPV6   = 10,
#ifndef __KERNEL__ /* no longer supported by kernel */
	NFPROTO_DECNET = 12,
#endif
	NFPROTO_NUMPROTO,
};
```


list of priority option in hook_ops
```c
enum nf_ip_hook_priorities {
	NF_IP_PRI_FIRST = INT_MIN,
	NF_IP_PRI_RAW_BEFORE_DEFRAG = -450,
	NF_IP_PRI_CONNTRACK_DEFRAG = -400,
	NF_IP_PRI_RAW = -300,
	NF_IP_PRI_SELINUX_FIRST = -225,
	NF_IP_PRI_CONNTRACK = -200,
	NF_IP_PRI_MANGLE = -150,
	NF_IP_PRI_NAT_DST = -100,
	NF_IP_PRI_FILTER = 0,
	NF_IP_PRI_SECURITY = 50,
	NF_IP_PRI_NAT_SRC = 100,
	NF_IP_PRI_SELINUX_LAST = 225,
	NF_IP_PRI_CONNTRACK_HELPER = 300,
	NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
	NF_IP_PRI_LAST = INT_MAX,
};
```

List of protocol options when check for ip header protocol


```c
enum {
  IPPROTO_IP = 0,		/* Dummy protocol for TCP		*/
  IPPROTO_ICMP = 1,		/* Internet Control Message Protocol	*/
  IPPROTO_IGMP = 2,		/* Internet Group Management Protocol	*/
  IPPROTO_IPIP = 4,		/* IPIP tunnels (older KA9Q tunnels use 94) */
  IPPROTO_TCP = 6,		/* Transmission Control Protocol	*/
  IPPROTO_EGP = 8,		/* Exterior Gateway Protocol		*/
  IPPROTO_PUP = 12,		/* PUP protocol				*/
  IPPROTO_UDP = 17,		/* User Datagram Protocol		*/
  IPPROTO_IDP = 22,		/* XNS IDP protocol			*/
  IPPROTO_TP = 29,		/* SO Transport Protocol Class 4	*/
  IPPROTO_DCCP = 33,		/* Datagram Congestion Control Protocol */
  IPPROTO_IPV6 = 41,		/* IPv6-in-IPv4 tunnelling		*/
  IPPROTO_RSVP = 46,		/* RSVP Protocol			*/
  IPPROTO_GRE = 47,		/* Cisco GRE tunnels (rfc 1701,1702)	*/
  IPPROTO_ESP = 50,		/* Encapsulation Security Payload protocol */
  IPPROTO_AH = 51,		/* Authentication Header protocol	*/
  IPPROTO_MTP = 92,		/* Multicast Transport Protocol		*/
  IPPROTO_BEETPH = 94,		/* IP option pseudo header for BEET	*/
  IPPROTO_ENCAP = 98,		/* Encapsulation Header			*/
  IPPROTO_PIM = 103,		/* Protocol Independent Multicast	*/
  IPPROTO_COMP = 108,		/* Compression Header Protocol		*/
  IPPROTO_L2TP = 115,		/* Layer 2 Tunnelling Protocol		*/
  IPPROTO_SCTP = 132,		/* Stream Control Transport Protocol	*/
  IPPROTO_UDPLITE = 136,	/* UDP-Lite (RFC 3828)			*/
  IPPROTO_MPLS = 137,		/* MPLS in IP (RFC 4023)		*/
  IPPROTO_ETHERNET = 143,	/* Ethernet-within-IPv6 Encapsulation	*/
  IPPROTO_RAW = 255,		/* Raw IP packets			*/
  IPPROTO_MPTCP = 262,		/* Multipath TCP connection		*/
  IPPROTO_MAX
};
```

## Compile

Compile the module and userspace program

```sh
make
```

## Load module

```sh
sudo insmod netlink_socket.ko
```

check that module is running

```sh
lsmod | grep netlink
```

## Unload module

```sh
rmmod netlink_socket
```


## Test

Run userspace programm and receive back message with capitalised letters

```bash

```

## Note 

This example mostly followed from levelup blog, now time to figure out what I can add on top of it.

## Links

1. https://inai.de/documents/Netfilter_Modules.pdf  
2. https://infosecwriteups.com/linux-kernel-communication-part-1-netfilter-hooks-15c07a5a5c4e  
3. https://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO-4.html  
4. https://github.com/zentyal/ndpi-netfilter/blob/master/src/main.c  
5. https://levelup.gitconnected.com/write-a-linux-firewall-from-scratch-based-on-netfilter-462013202686  
6. https://blogs.oracle.com/linux/post/introduction-to-netfilter  
7. https://elixir.bootlin.com/linux/v6.6.20/source/include/uapi/linux/netfilter.h#L12  
8. https://elixir.bootlin.com/linux/v6.6.20/source/net/ipv4/ip_input.c#L560
9. https://elixir.bootlin.com/linux/v6.6.20/source/include/linux/ip.h#L19
10. https://elixir.bootlin.com/linux/v6.6.20/source/include/linux/udp.h#L21
11. https://elixir.bootlin.com/linux/v6.6.20/source/include/linux/skbuff.h#L842