I'm writing a module on Kernel 2.4. A part of this module can be view as
a firewall.
My module is logically located between the IP layer and the link layer.
In fact, the binding is done on NF_IP_POST_ROUTING for packets outgoing,
and on NF_IP_PRE_ROUTING for packets incoming.
I'd like my firewall to respond by an TCP/RST packet when a packet is
forbidden.
There is no problem with that when I send this packet over the network.
To do that :
- I created a new skbuff, that I properly fill with TCP/IP headers.
- I find the route by calling something like :
if (ip_route_output(&rt, iph->daddr, iph->saddr,
RT_TOS(iph->tos), 0) != 0)
return NULL;
dev = rt->u.dst.dev;
-Then I fill properly my sk_buff,
-Later I send the packet with a code like that:
static inline int output_maybe_reroute(struct sk_buff *skb)
{
return skb->dst->output(skb);
}
NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, skb->dev,
output_maybe_reroute);
There is no problem with that, it work fine in that way !
My problem is that sometimes, I'd like to pass those RST packets UP to
the protocol layer.
Instead of sending packets on the network, I'd like to pass them up.
As it works for the sending way, I'm trying to do the same and just
modifying the last step by something like :
- Pass my packet up to the protocol layer
static inline int input_maybe_reroute(struct sk_buff *skb) {
return skb->dst->input(skb);
}
NF_HOOK(PF_INET, NF_IP_LOCAL_IN skb, skb->dev, NULL,
input_maybe_reroute);
But of course it fails, (in fact I don't even know what should do the
skb->dst->input() function) !
Anyone has an idea on how to do something like that or where to find
doc. ?
When do we have to call ip_route_input() ?
Thank you for help
Gautier Harmel
PS : As I've not subscribe to the mailing list, could you, please, put
my email adress in CC
Gautier.Harmel@qosmos.net
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Sat Jun 30 2001 - 21:00:18 EST