这个好像跟iptable类似，但是自己写在内核模块可以获取更多信息功能，操作也更加灵活一些吧，这里内核还写文件了，导致很容易死机，因为网络转发的数据太频繁了
其实这个例子也是很好的驱动hello world程序
#include <linux/module.h> #include <linux/kernel.h> #include <linux/init.h> #include <linux/skbuff.h> #include <linux/netfilter.h> #include <uapi/linux/netfilter_ipv4.h> #include <linux/ip.h> #include <linux/udp.h> #include <linux/types.h> #include <linux/fs.h> #include <linux/uaccess.h> #define DRIVER_AUTHOR "JWGUO" #define DRIVER_DESC "HELLO WORLD" struct sk_buff *sock_buff; static struct nf_hook_ops nfho; //---------------------------------------------------------------- int mystrlen(char* buffer) { int l = 0; int i = 0; if(buffer == 0) { return 0; } for( i = 0; i < 1000; i ++ ) { if(buffer[i] == 0) { break; } l ++; } return l; } void logfile(char* fileName, char* buffer) { struct file *fp; mm_segment_t fs; loff_t pos; printk("hello enter\n"); fp = filp_open(fileName, O_APPEND | O_RDWR | O_CREAT, 0644);//mode_t mode = S_IRWXU | SIRWXG; if (IS_ERR(fp)) { printk("create file error\n"); return; } fs = get_fs(); set_fs(KERNEL_DS); pos = 0; vfs_write(fp, buffer, mystrlen(buffer), &pos); } //---------------------------------------------------------------- /* Older kernel has different funcion definition. */ static unsigned int hook_func( const struct nf_hook_ops *ops, struct sk_buff *skb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *)) { char buffer[512] = {0}; char *ifname = (char *)(in->name); struct ethhdr *mac_header = (struct ethhdr *)skb_mac_header(skb); struct iphdr *ip_header = (struct iphdr *)skb_network_header(skb); sock_buff = skb; if (!sock_buff) { return NF_ACCEPT; } // Do something to the pkt. printk(KERN_INFO "======HELLO WAYNE@net_dev: %s=====\n", ifname); printk(KERN_INFO "src_mac: %pM", mac_header->h_source); printk(KERN_INFO "dst_mac: %pM", mac_header->h_dest); printk(KERN_INFO "src_ip: %pI4", &ip_header->saddr); printk(KERN_INFO "dst_ip: %pI4", &ip_header->daddr); printk(KERN_INFO "\n"); sprintf(buffer, "src_mac: %pM dst_mac: %pM src_ip: %pI4 dst_ip: %pI4\n", mac_header->h_source, mac_header->h_dest, &ip_header->saddr, &ip_header->daddr); logfile("/root/kernellog", buffer); return NF_ACCEPT; } static int __init init_main(void) { nfho.hook = hook_func; nfho.hooknum = NF_INET_PRE_ROUTING; // For older kernel: NF_IP_PRE_ROUTING nfho.pf = PF_INET; nfho.priority = NF_IP_PRI_FIRST; nf_register_hook(&nfho); printk(KERN_INFO "Successfully inserted a hook into kernel\n"); logfile("/root/kernellog","Successfully inserted a hook into kernel\n"); return 0; } static void __exit cleanup_main(void) { nf_unregister_hook(&nfho); printk(KERN_INFO "Successfully unloaded the hook\n"); logfile("/root/kernellog","Successfully unloaded the hook\n"); } module_init(init_main); module_exit(cleanup_main); MODULE_LICENSE("GPLv3"); MODULE_AUTHOR(DRIVER_AUTHOR); MODULE_DESCRIPTION(DRIVER_DESC); Makefile ifneq ($(KERNELRELEASE),) obj-m := nfhook.o else KDIR := /home/zmy/Desktop/linux-rpi-4.0.y all: make -C $(KDIR) M=$(PWD) modules ARCH=arm CROSS_COMPILE=/home/zmy/Ubuntu/RSPLinuxSource/tools-master/arm-bcm2708/arm-bcm2708hardfp-linux-gnueabi/bin/arm-bcm2708hardfp-linux-gnueabi- clean: rm -f *.ko *.o *.mod.o *.mod.c *.symvers modul* endif