如何修改struct sk_buff
我必须写一个VPN模块。首先，我编写了一个内核模块来修改所有传入和传出的 TCP 数据包。它使用 netfilter 挂钩。对于传入数据包，我修改了 (struct sk_buff)->data 和 (struct sk_buff)->tail 指针之间的字节，将它们增加 1。对于传出数据包，我修改了 (struct sk_buff)->data 和 (struct sk_buff)->tail 指针之间的字节，将它们减一。
但是，我尝试在 localhost 和 localhost 之间建立 TCP 连接（通过 netcat），但没有成功。你能告诉我我做错了什么吗？我需要修改 struct sk_buff 结构中的一些其他字段吗？
是否可以仅从内核空间实现我的简单 vpn 模块？（因此无需使用 libnetfilter_queue 等特殊库）？
谢谢。
I have to write a vpn module. First of all, I have wrote a kernel module that modifies all the incoming and outgoing TCP packets. It uses netfilter hooks. For the incoming packets, I have modified the bytes between (struct sk_buff)->data and (struct sk_buff)->tail pointers by incrementing them by one. For the outgoing packets, I have modified the bytes between (struct sk_buff)->data and (struct sk_buff)->tail pointers by decrementing them by one.
However, I tried to establish a TCP connection between localhost and localhost (by means of netcat) and I had not succeeded. Can you tell me what I am doing wrong? Need I modify some other fields from the struct sk_buff structure?
Is it possible to implement my simple vpn module only from kernel space?(thus without using special libraies such as libnetfilter_queue)?
Thank you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
是的，您可以在不使用 libnetfilter 的情况下执行此操作。但鉴于您提供的有关项目的信息有限，很难就如何解决问题提供良好的建议。以下是一些应该有所帮助的参考资料。
1) 我建议您查看 TUN/TAP 接口驱动程序 API。这将允许您在应用程序空间而不是内核中实现代码。有关此类 VPN 的一个很好的示例，请参阅 openvpn。
如果您有兴趣进行更高级的内核空间挂钩...
2) 查看这篇关于挂钩 netfilter netfilter 内核挂钩
Yes, you can do this without using libnetfilter. But given the limited information that you've provided about your project it's hard to give a good recommendation as to how to go about fixing your issue. Here's some references that should help.
1) I would recommend you take a look at the TUN/TAP interface driver APIs. This will allow you to implement your code in application space rather than kernel. See openvpn for a great example of this type of VPN.
If you're interested in doing more advanced kernel space hooking...
2) Check this article out on hooking into netfilter netfilter kernel hooks