linux內核驅動編寫，讀取網絡數據包，加載到設備文件

作用：編寫linux內核驅動程序，驅動程序讀取網絡數據包，對數據包進行解析，將tcp五元組加載到設備文件中，對設備文件數據進行讀取寫入到臨時文件。

讀取tcp數據包源碼：

//print_tcp.c

#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <linux/udp.h>
#include <linux/icmp.h>
#include <linux/init.h>
#include <linux/fs.h>
#include <linux/cdev.h>
#include <linux/device.h>
#include <linux/slab.h>
#include <asm/uaccess.h>

//分解IP源地址、目的地址的宏
#define NIPQUAD(addr) \
((unsigned char *)&addr)[0], \
((unsigned char *)&addr)[1], \
((unsigned char *)&addr)[2], \
((unsigned char *)&addr)[3]

//設備文件大小，用於存儲讀取的網絡數據包
#define DEVICE_BUF 102400
#define DATA_BUF 1024
#define LOG_BUF 2048
#define TMP_BUF 2

static struct nf_hook_ops nfho;

static int major = 0;
static int minor = 0;

/*device data*/
static struct cdev cdev;
struct class *dev_class = NULL;

char data_buf[DEVICE_BUF] = "";
char log_file[LOG_BUF] = "";
char tcp_data[DATA_BUF] = "";

//內核態與用戶態交互函數，用戶態read時觸發，將data_buf數據寫入到設備文件中
ssize_t hello_dev_read(struct file* file, char __user* buf, size_t count, loff_t* offset)
{
    //copy_to_user函數將內核態數據寫入到用戶態
    if(!copy_to_user((char*)buf, data_buf, strlen(data_buf)))
    {
        memset(data_buf, '\0', sizeof(data_buf));
        return 0;
    }
    else
    {
        memset(data_buf, '\0', sizeof(data_buf));
        return -1;
    }
    //printk("data_buf:%s\n", data_buf);

}

//用戶態調用close時觸發
int static hello_dev_release(struct inode *inode, struct file *file)
{
    //printk("file release in hello_dev_release......finished!\n");
    return 0;
}

//用戶態調用open時觸發
int static hello_dev_open(struct inode *inode, struct file *file)
{
    //printk("file release in hello_dev_release......finished!\n");
    return 0;
}

//內核驅動掛載函數
//讀取網絡數據包
static unsigned int ptcp_hook_func(const struct nf_hook_ops *ops,
                                   struct sk_buff *skb,
                                   const struct net_device *in,
                                   const struct net_device *out,
                                   int (*okfn)(struct sk_buff *))
{
    struct iphdr *iph;          /* IPv4 header */
    struct tcphdr *tcph;        /* tcp header */
    unsigned char *user_data;   /* TCP data begin pointer */
    unsigned char *tail;        /* TCP data end pointer */
    unsigned char *it;          /* TCP data iterator */
    char tmp[TMP_BUF] = "";

    memset(tcp_data, '\0', sizeof(tcp_data)); 
    memset(log_file, '\0', sizeof(log_file)); 
    if (!skb)
        return NF_ACCEPT;

    iph = ip_hdr(skb);          /* get IP header */

    if (iph->protocol != IPPROTO_TCP)
        return NF_ACCEPT;

    tcph = tcp_hdr(skb);        /* get TCP header */
    
    //user_data爲tcp數據包數據部分
    user_data = (unsigned char *)((unsigned char *)tcph + (tcph->doff * 4));
    tail = skb_tail_pointer(skb);

    /* Print TCP packet data (payload) */
    for (it = user_data; it != tail; ++it) 
    {
        char c = *(char *)it;

        if (c == '\0')
            break;

        //printk("%c", c);
        memset(tmp, '\0', sizeof(tmp));
        sprintf(tmp, "%c", c);
        if(strlen(tcp_data) < DATA_BUF)
        {
            strcat(tcp_data, tmp);
        }
    }

    //sprintf(log_file, "protocol_type:%d, src address:%u.%u.%u.%u,dst address:%u.%u.%u.%u, src_port:%d, dst_port:%d, data:%s\n",
     //       iph->protocol, NIPQUAD(iph->saddr), NIPQUAD(iph->daddr), ntohs(tcph->source), ntohs(tcph->dest), tcp_data);

    sprintf(log_file, "protocol_type:%d, src address:%u.%u.%u.%u,dst address:%u.%u.%u.%u, src_port:%d, dst_port:%d\n",
            iph->protocol, NIPQUAD(iph->saddr), NIPQUAD(iph->daddr), ntohs(tcph->source), ntohs(tcph->dest));
    printk("data:%s\n", log_file);
    if(strlen(data_buf) < DEVICE_BUF)
    { 
        strcat(data_buf, log_file);
    }
    return NF_ACCEPT;
}

//設備文件定義，用於內核態與用戶態數據交互
static struct file_operations fops = {
        .owner = THIS_MODULE,
        .open = hello_dev_open,
        .release = hello_dev_release,
        .read = hello_dev_read,
        //.write = hello_dev_write,
};

//內核驅動初始化
//創建用於數據包寫入的設備文件
static int __init ptcp_init(void)
{
    int ret;
    dev_t devno;
    dev_t dev = 0; 

    int res;
    printk("ptcp_init...\n");

    nfho.hook = (nf_hookfn *)ptcp_hook_func;    /* hook function */
    nfho.hooknum = NF_INET_PRE_ROUTING;         /* received packets */
    nfho.pf = PF_INET;                          /* IPv4 */
    nfho.priority = NF_IP_PRI_FIRST;            /* max hook priority */

    res = nf_register_hook(&nfho);
    if (res < 0) {
        pr_err("print_tcp: error in nf_register_hook()\n");
        return res;
    }

    ret = alloc_chrdev_region(&dev, minor, 1, "hello_dev");
    if (ret < 0)
    {
        printk("register_chrdev_region failed!\n");
        return ret;
    }
    major = MAJOR(dev);
    minor = MINOR(dev);
    printk("major = %d, minor = %d\n", major, minor);

    devno = MKDEV(major, minor);  
    cdev_init(&cdev, &fops); 
    cdev_add(&cdev, devno, 1);

    dev_class = class_create(THIS_MODULE, "dev_class");
    if(IS_ERR(dev_class)){
        printk("class_create failed!\n");
        return -1;
    }

    device_create(dev_class, NULL, devno, NULL, "hello");

    return 0;
}

//驅動文件退出
//卸載設備文件
static void __exit ptcp_exit(void)
{
    dev_t devno;
    printk("ptcp_exit...\n");
    nf_unregister_hook(&nfho);

    devno = MKDEV(major, minor);

    cdev_del(&cdev);

    device_destroy(dev_class, devno);
    class_destroy(dev_class);

    unregister_chrdev_region(devno, 1);
    return;
}

module_init(ptcp_init);
module_exit(ptcp_exit);

MODULE_LICENSE("GPL");

//Makefile文件

ifneq ($(KERNELRELEASE),)
obj-m:=print_tcp.o
#obj-m:=hello.o
#obj-m:=print_udp.o
else
PWD:=$(shell pwd)
KDIR:=/usr/lib/modules/$(shell uname -r)/build
all:
	$(MAKE) -C $(KDIR) M=$(PWD)
clean:
	rm -rf *.o *.mod.c *.ko *.symvers *.order *.markers
endif

執行命令：

1、make clean; make

2、生成print_tcp.ko驅動文件

3、加載驅動

4、卸載驅動

數據包從驅動內核態讀取到設備文件代碼：

//main.c
#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <fcntl.h>
#include <string.h>

//設備文件名稱
#define DEVNAME "/dev/hello"
//讀取的內核態數據包大小
#define DEVICE_BUF 102400

int main()
{
    char buf[DEVICE_BUF] = "";
    int fd;
   
    while(1)
    {
        //讀取設備文件寫入到臨時文件
        FILE *file = fopen("/root/tmp/aaa.txt", "a+");
        if(file == NULL)
        {
            return -1;    
        }

        //打開設備文件，調用內核驅動中的hello_dev_open函數
        fd = open(DEVNAME, O_RDWR);
        if(fd == -1)
        {
              printf("file %s is opening......failure!", DEVNAME);
              sleep(10);
        }
        //讀取設備文件數據，調用內核驅動中的hello_dev_read
        read(fd, buf, DEVICE_BUF);
        //關閉設備文件，調用內核驅動中的hello_dev_release
        close(fd);

        fwrite(buf, strlen(buf), 1, file);
        //printf("%s\n", buf);

        memset(buf, '\0', sizeof(buf));
        //由於網絡數據包大小未知，將循環時間設置成0.1s，儘量不遺漏進來的數據包
        usleep(100000);
        fclose(file);
    }

    return 0;
}

1、編譯：gcc -o main main.c

2、執行：./main

3、查看臨時文件/root/tmp/aaa.txt