Comments on: Creating a Netfilter kernel module which filters UDP packets

By: Kesava

Kesava — Thu, 24 Nov 2011 07:18:45 +0000

HI Paul,

Thank You Very Much for the Information. It helped me a lot. I am trying to add an Extra IP header over the Received Ping Packet. I have increased the size of skb by 20 bytes and filled the IP Header Fields accordingly.

After adding the IP header ; I have return NF_STOLEN. Please let me know ; What is the Function that I should call to forward the STOLEN Packet?? OR Please Point me to some Documentation from where I can get the necessary information ???

-Thanks in Advance,
VKS

By: Miracle

Miracle — Fri, 14 Oct 2011 08:04:23 +0000

I try to do something more : modify tcp header and then calculate tcp checksum again by using Netfilter. Can you help me to do with this.

By: Karol Sabat

Karol Sabat — Mon, 06 Dec 2010 08:20:33 +0000

Hey Folks,

Had the same problem so, do the trick;)

#undef __KERNEL__
#include /* for constants like NF_IP_PRI_FIRST */
#define __KERNEL__

Regards,
Karol

By: sunil shah

sunil shah — Mon, 18 Oct 2010 15:08:38 +0000

to get rid of freezing problem change
sk_buff **skb
to
sk_buff *skb

and
sock_buff = * skb to
sock_buff = skb

and for nfho.hooknum = NF_IP_PRE_ROUTING error
either set it to 0
or change it to
nfho.hooknum = NF_INET_PRE_ROUTING; ( not sure)

By: saurabh

saurabh — Thu, 07 Oct 2010 13:00:48 +0000

Similar freeze for me on ubuntu 10.04. I am using a similar code. To me it looks like whenever I try to read “ip_header” extracted from sk_buff, i get the freeze.

By: Maaz Khan

Maaz Khan — Sat, 25 Sep 2010 23:18:48 +0000

Hi I suppose my reply is very late but if anyone is still having problem: ‘NF_IP_PRE_ROUTING’ undeclared (first use in this function)

try using 0 instead of ‘NF_IP_PRE_ROUTING’ because NF_IP_PRE_ROUTING=0;

Also when i run you UDP capture example the system freezes any suggestion… i m using ubuntu 8.04

thanks

By: prashant kapoor

prashant kapoor — Fri, 11 Jun 2010 15:43:06 +0000

Hi Paul

Congrats , I think you have the best tutorial explaining netfilter kernel module.

If we make drastic changes to the packet that the packet is not at all recognizable and we want to send the packets back to the pre-routing, do we have to do something special?

By: jashmi

jashmi — Tue, 20 Apr 2010 16:08:36 +0000

Hi paul,
I am a beginer .I tried inserting this module and module insertion was successfull.But wen i sent traffic , system hangs.Any suggestion on what can be done for this problem.I changed NF_IP_PRE_ROUTING as NF_INET_PRE_ROUTING.

By: Ben Evans

Ben Evans — Mon, 25 Jan 2010 18:16:19 +0000

Hi Paul,

Thanks for this series of articles – they’ve been very useful so far.

One thing, is that neither this one nor the previous seem to work on Ubuntu 9 (2.6.28-16 kernel). The errors look like this:

bje@bje-desktop:~/projects/netfilter-test$ make
make -C /lib/modules/2.6.28-16-generic/build SUBDIRS=/home/bje/projects/netfilter-test modules
make[1]: Entering directory `/usr/src/linux-headers-2.6.28-16-generic’
CC [M] /home/bje/projects/netfilter-test/nfudp.o
/home/bje/projects/netfilter-test/nfudp.c: In function ‘init_module’:
/home/bje/projects/netfilter-test/nfudp.c:42: warning: assignment from incompatible pointer type
/home/bje/projects/netfilter-test/nfudp.c:43: error: ‘NF_IP_PRE_ROUTING’ undeclared (first use in this function)
/home/bje/projects/netfilter-test/nfudp.c:43: error: (Each undeclared identifier is reported only once
/home/bje/projects/netfilter-test/nfudp.c:43: error: for each function it appears in.)
make[2]: *** [/home/bje/projects/netfilter-test/nfudp.o] Error 1
make[1]: *** [_module_/home/bje/projects/netfilter-test] Error 2
make[1]: Leaving directory `/usr/src/linux-headers-2.6.28-16-generic’
make: *** [default] Error 2

Examining linux/netfilter_ipv4.h seems to indicate that an #ifndef __KERNEL__ now extends further than it used to and is preventing NF_IP_PRE_ROUTING from being visible to the module. Something similar is suggested by:

http://markmail.org/message/kvzvzc32v3htduin#query:netfilter_ipv4.h%20changes%20kernel+page:1+mid:chddq75k2cxjzuqr+state:results

Any thoughts as to what needs to be done to change these examples to work with a 2.6.28-16 or thereabouts kernel?

By: Srudeep K

Srudeep K — Mon, 02 Nov 2009 19:35:57 +0000

Is there any other way to do it? Is acess to the saddr field of iphdr structure is legal? or is there any other method to access it?