应用层创建socket，内核模块通过该socket发送数据包

1780阅读　0评论2013-09-23　joepayne
分类：LINUX

声明：欢迎转载和引用，转载请注明出处。引用代码请保证代码完整性。
本博文将讲解一种内核态通过应用层创建的socket发送数据包的方法。


首先应用层创建socket，并且调用connect。


如图所示，向192.168.0.86的8000端口建立udp连接。获取到进程pid=9707，对应的socket的文件句柄fd=3。

在192.168.0.86机器上开启netcat

内核层根据进程pid和文件句柄fd，获取到对应的socket结构体，然后通过该socket发送数据包。


这个时候在192.168.0.86上就可以看到通过应用层创建的socket发送的数据包




应用层代码：

点击(此处)折叠或打开

  1. #include <sys/types.h>
  2. #include <sys/socket.h>
  3. #include <arpa/inet.h>
  4. #include <stdio.h>
  5. #include <string.h>
  6. #include <stdarg.h>
  7. #include <stdlib.h>
  8. #include <errno.h>
  9. #include <pthread.h>
  10. #define MAXLINE 100
  11. struct thread_info {
  12.     unsigned long long packet;
  13.     unsigned long long bytes;
  14. };
  15. void err_quit(char * fmt,...)
  16. {
  17.     char buf[MAXLINE+1];
  18.     va_list ap;
  19.     va_start(ap,fmt);
  20.     vsnprintf(buf,sizeof(buf),fmt,ap);
  21.     va_end(ap);
  22.     fputs(buf,stdout);
  23.     fputs("\n",stdout);
  24.     exit(1);
  25. }
  26. void dg_cli(int sockfd,const struct sockaddr *servaddr,socklen_t serlen)
  27. {
  28.     int n;
  29.     int pret;
  30.     pthread_t id;
  31.     struct thread_info info;
  32.     char sendline[MAXLINE],recvline[MAXLINE];
  33.     info.packet=0;
  34.     info.bytes=0;
  35.     bzero(sendline,MAXLINE);
  36.     strcpy(sendline,"TEST BOY\n");
  37. restart:
  38.     connect(sockfd, servaddr, serlen);
  39.     while(1) {
  40.         sleep(10);
  41.     }
  42.     while(1){
  43.         pret = send(sockfd,sendline,strlen(sendline),0);
  44.         if(pret < 0){
  45.             //printf("errno=%d, errstr=%s\n", errno, strerror(errno));
  46.             if(errno == 111){
  47.                 printf("I received udp port unreachable packet\n");
  48.                 sleep(1);
  49.                 goto restart;
  50.             }
  51.         }else{
  52.             printf("OK\n");
  53.         }
  54.         sleep(1);
  55.     }
  56. }
  57. int main(int argc,char **argv)
  58. {
  59.     int sockfd;
  60.     struct sockaddr_in servaddr;
  61.     if(argc!=3)
  62.         err_quit("usage:client ");
  63.     bzero(&servaddr,sizeof(servaddr));;
  64.     servaddr.sin_family=AF_INET;
  65.     servaddr.sin_port=htons(atoi(argv[2]));
  66.     inet_pton(AF_INET,argv[1],&servaddr.sin_addr);
  67.     if((sockfd=socket(AF_INET,SOCK_DGRAM,0))<0)
  68.         err_quit("socket error");
  69.     dg_cli(sockfd,(struct sockaddr*)&servaddr,sizeof(servaddr));
  70.     exit(0);
  71. }
内核层代码：

点击(此处)折叠或打开

  1. /*
  2.  * Kernel Send Udp packet Use userspace socket!
  3.  *
  4.  * This program is free software; you can redistribute it and/or modify
  5.  * it under the terms of the GNU General Public License as published by
  6.  * the Free Software Foundation; either version 2 of the License, or
  7.  * (at your option) any later version.
  8.  *
  9.  * This program is distributed in the hope that it will be useful,
  10.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  12.  * GNU General Public License for more details.
  13.  *
  14.  * You should have received a copy of the GNU General Public License
  15.  * along with this program; if not, write to the Free Software
  16.  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  17.  *
  18.  * Copyright(C) Tony <tingw.liu@gmail.com> 2007-2013
  19.  *        2013-07-04 08:09:07 CST
  20.  */

  22. #include <linux/module.h>
  23. #include <linux/moduleparam.h>
  24. #include <linux/netfilter.h>
  25. #include <linux/ip.h>
  26. #include <net/tcp.h>
  27. #include <net/udp.h>
  28. #include <net/icmp.h>
  29. #include <linux/skbuff.h>
  30. #include <net/sock.h>
  31. #include <linux/net.h>
  32. #include <linux/inetdevice.h>
  33. #include <linux/in.h>
  34. #include <linux/kernel.h>
  35. #include <linux/types.h>
  36. #include <asm/unaligned.h>
  37. #include <linux/kthread.h>
  38. #include <linux/fdtable.h>
  39. #include <linux/file.h>

  41. MODULE_LICENSE("GPL");
  42. MODULE_AUTHOR("Tony ");

  44. char *buffer = "Tony test from kernel!\n";
  45. module_param(buffer, charp, 0644);
  46. MODULE_PARM_DESC(buffer, "Packet content");

  48. pid_t pidnr = 1000;
  49. module_param(pidnr, int, 0644);
  50. MODULE_PARM_DESC(pidnr, "Process pid");

  52. int fd = 4;
  53. module_param(fd, int, 0644);
  54. MODULE_PARM_DESC(fd, "Socket file fd");

  56. long timeout = 1;
  57. module_param(timeout, long, 0644);
  58. MODULE_PARM_DESC(timeout, "Interval between send packets, default 1(unit second)");


  61. static struct task_struct *kthreadtask = NULL;

  63. struct file *sockfile = NULL;


  66. struct threadinfo{
  67.     struct socket *sock;
  68.     char *buffer;
  69. };

  71. static struct socket *sock_from_file(struct file *file, int *err)
  72. {
  73.     /* FIXME: Warning....
  74.      Because socket_file_ops is a static variable, so
  75.      we can't check if the file is a socket like kernel
  76.      function sock_from_file.
  77.      So..., we doesn't check if the file is a socket and kernel
  78.      will panic if the file is not a socket
  79.      */


  82.     //if (file->f_op == &socket_file_ops)
  83.         return file->private_data;    /* set in sock_map_fd */

  85.     *err = -ENOTSOCK;
  86.     return NULL;
  87. }


  90. static struct socket *find_sock_by_pid_fd(pid_t pidnr, int fd, int *err)
  91. {
  92.     struct task_struct *p;
  93.     struct file *file;
  94.     struct files_struct *files;
  95.     struct socket *sock;
  96.     struct pid *pid;
  97.     pid = find_get_pid(pidnr);
  98.     p = get_pid_task(pid, PIDTYPE_PID);
  99.     if (!p) {
  100.         printk(KERN_ALERT "find_task_by_vpid error!\n");
  101.         return NULL;
  102.     }


  105.     /*
  106.      Next code learn from fget()
  107.      Because kernel fget() function use "current" variable,
  108.      so rewrite
  109.     */
  110.     files = p->files;
  111.     rcu_read_lock();
  112.     file = fcheck_files(files, fd);
  113.     if (file) {
  114.         if (file->f_mode & FMODE_PATH || !atomic_long_inc_not_zero(&file->f_count))
  115.             file = NULL;
  116.     }
  117.     rcu_read_unlock();
  118.     if (!file) {
  119.         printk(KERN_ALERT "Can't get file from fd\n");
  120.         return NULL;
  121.     }


  124.     sockfile = file;
  125.     sock = sock_from_file(sockfile, err);
  126.     if (!sock) {
  127.         fput(sockfile);
  128.         sockfile = NULL;
  129.     }
  130.     return sock;
  131. }
  132. static int sendthread(void *data)
  133. {
  134.     struct kvec iov;
  135.     struct threadinfo *tinfo = data;
  136.     struct msghdr msg = {.msg_flags = MSG_DONTWAIT|MSG_NOSIGNAL};
  137.     int len;
  138.     while (!kthread_should_stop()) {
  139.         iov.iov_base = (void *)tinfo->buffer;
  140.         iov.iov_len = strlen(tinfo->buffer);
  141.         len = kernel_sendmsg(tinfo->sock, &msg, &iov, 1, strlen(tinfo->buffer));
  142.         if (len != strlen(buffer)) {
  143.             printk(KERN_ALERT "kernel_sendmsg err, len=%d, buffer=%d\n",
  144.                     len, (int)strlen(buffer));
  145.             if (len == -ECONNREFUSED) {
  146.                 printk(KERN_ALERT "Receive Port Unreachable packet!\n");
  147.             }
  148.             break;
  149.         }
  150.         schedule_timeout_interruptible(timeout * HZ);
  151.     }
  152.     kthreadtask = NULL;
  153.     kfree(tinfo);

  155.     return 0;
  156. }

  158. static int __init udp_send_init(void)
  159. {
  160.     int err = 0;
  161.     struct socket *sock;
  162.     struct threadinfo *tinfo;

  164.     sock = find_sock_by_pid_fd(pidnr, fd, &err);    
  165.     if (!sock) {
  166.         printk(KERN_ALERT "find_sock error\n");
  167.         goto find_error;
  168.     }
  169.     tinfo = kmalloc(sizeof(struct threadinfo), GFP_KERNEL);
  170.     if (!tinfo) {
  171.         printk(KERN_ALERT "kmalloc threadinfo err\n");
  172.         goto kmalloc_error;
  173.     }
  174.     tinfo->sock = sock;
  175.     tinfo->buffer = buffer;
  176.     kthreadtask = kthread_run(sendthread, tinfo, "Tony-sendmsg");

  178.     if (IS_ERR(kthreadtask)) {
  179.         printk(KERN_ALERT "create sendmsg thread err, err=%ld\n",
  180.                 PTR_ERR(kthreadtask));
  181.         goto thread_error;
  182.     }
  183.     return 0;

  185. thread_error:
  186.     kfree(tinfo);
  187. kmalloc_error:
  188.     kthreadtask = NULL;
  189. find_error:
  190.     return -1;
  191. }

  193. static void __exit udp_send_exit(void)
  194. {

  196.     if (kthreadtask) {
  197.         kthread_stop(kthreadtask);
  198.     }

  200.     if (sockfile) {
  201.         fput(sockfile);
  202.     }
  203.     printk(KERN_ALERT "UDP send quit\n");

  205.     return;
  206. }


  209. module_init(udp_send_init);
  210. module_exit(udp_send_exit);

上一篇：关于const 和volatile的理解
下一篇：Linux系统中，read文件过程分析