应用层创建socket，内核模块通过该socket发送数据包

声明：欢迎转载和引用，转载请注明出处。引用代码请保证代码完整性。
本博文将讲解一种内核态通过应用层创建的socket发送数据包的方法。


首先应用层创建socket，并且调用connect。


如图所示，向192.168.0.86的8000端口建立udp连接。获取到进程pid=9707，对应的socket的文件句柄fd=3。

在192.168.0.86机器上开启netcat

内核层根据进程pid和文件句柄fd，获取到对应的socket结构体，然后通过该socket发送数据包。


这个时候在192.168.0.86上就可以看到通过应用层创建的socket发送的数据包




应用层代码：

点击(此处)折叠或打开

1. #include <sys/types.h>
   
2. #include <sys/socket.h>
   
3. #include <arpa/inet.h>
   
4. #include <stdio.h>
   
5. #include <string.h>
   
6. #include <stdarg.h>
   
7. #include <stdlib.h>
   
8. #include <errno.h>
   
9. #include <pthread.h>
   
10. #define MAXLINE 100
    
11. struct thread_info {
    
12.     unsigned long long packet;
    
13.     unsigned long long bytes;
    
14. };
    
15. void err_quit(char * fmt,...)
    
16. {
    
17.     char buf[MAXLINE+1];
    
18.     va_list ap;
    
19.     va_start(ap,fmt);
    
20.     vsnprintf(buf,sizeof(buf),fmt,ap);
    
21.     va_end(ap);
    
22.     fputs(buf,stdout);
    
23.     fputs("\n",stdout);
    
24.     exit(1);
    
25. }
    
26. void dg_cli(int sockfd,const struct sockaddr *servaddr,socklen_t serlen)
    
27. {
    
28.     int n;
    
29.     int pret;
    
30.     pthread_t id;
    
31.     struct thread_info info;
    
32.     char sendline[MAXLINE],recvline[MAXLINE];
    
33.     info.packet=0;
    
34.     info.bytes=0;
    
35.     bzero(sendline,MAXLINE);
    
36.     strcpy(sendline,"TEST BOY\n");
    
37. restart:
    
38.     connect(sockfd, servaddr, serlen);
    
39.     while(1) {
    
40.         sleep(10);
    
41.     }
    
42.     while(1){
    
43.         pret = send(sockfd,sendline,strlen(sendline),0);
    
44.         if(pret < 0){
    
45.             //printf("errno=%d, errstr=%s\n", errno, strerror(errno));
    
46.             if(errno == 111){
    
47.                 printf("I received udp port unreachable packet\n");
    
48.                 sleep(1);
    
49.                 goto restart;
    
50.             }
    
51.         }else{
    
52.             printf("OK\n");
    
53.         }
    
54.         sleep(1);
    
55.     }
    
56. }
    
57. int main(int argc,char **argv)
    
58. {
    
59.     int sockfd;
    
60.     struct sockaddr_in servaddr;
    
61.     if(argc!=3)
    
62.         err_quit("usage:client ");
    
63.     bzero(&servaddr,sizeof(servaddr));;
    
64.     servaddr.sin_family=AF_INET;
    
65.     servaddr.sin_port=htons(atoi(argv[2]));
    
66.     inet_pton(AF_INET,argv[1],&servaddr.sin_addr);
    
67.     if((sockfd=socket(AF_INET,SOCK_DGRAM,0))<0)
    
68.         err_quit("socket error");
    
69.     dg_cli(sockfd,(struct sockaddr*)&servaddr,sizeof(servaddr));
    
70.     exit(0);
    
71. }

内核层代码：

点击(此处)折叠或打开

1. /*
   
2.  * Kernel Send Udp packet Use userspace socket!
   
3.  *
   
4.  * This program is free software; you can redistribute it and/or modify
   
5.  * it under the terms of the GNU General Public License as published by
   
6.  * the Free Software Foundation; either version 2 of the License, or
   
7.  * (at your option) any later version.
   
8.  *
   
9.  * This program is distributed in the hope that it will be useful,
   
10.  * but WITHOUT ANY WARRANTY; without even the implied warranty of
    
11.  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    
12.  * GNU General Public License for more details.
    
13.  *
    
14.  * You should have received a copy of the GNU General Public License
    
15.  * along with this program; if not, write to the Free Software
    
16.  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
    
17.  *
    
18.  * Copyright(C) Tony <[e-mail]> 2007-2013
    
19.  *        2013-07-04 08:09:07 CST
    
20.  */
    
21. 
    
22. #include <linux/module.h>
    
23. #include <linux/moduleparam.h>
    
24. #include <linux/netfilter.h>
    
25. #include <linux/ip.h>
    
26. #include <net/tcp.h>
    
27. #include <net/udp.h>
    
28. #include <net/icmp.h>
    
29. #include <linux/skbuff.h>
    
30. #include <net/sock.h>
    
31. #include <linux/net.h>
    
32. #include <linux/inetdevice.h>
    
33. #include <linux/in.h>
    
34. #include <linux/kernel.h>
    
35. #include <linux/types.h>
    
36. #include <asm/unaligned.h>
    
37. #include <linux/kthread.h>
    
38. #include <linux/fdtable.h>
    
39. #include <linux/file.h>
    
40. 
    
41. MODULE_LICENSE("GPL");
    
42. MODULE_AUTHOR("Tony ");
    
43. 
    
44. char *buffer = "Tony test from kernel!\n";
    
45. module_param(buffer, charp, 0644);
    
46. MODULE_PARM_DESC(buffer, "Packet content");
    
47. 
    
48. pid_t pidnr = 1000;
    
49. module_param(pidnr, int, 0644);
    
50. MODULE_PARM_DESC(pidnr, "Process pid");
    
51. 
    
52. int fd = 4;
    
53. module_param(fd, int, 0644);
    
54. MODULE_PARM_DESC(fd, "Socket file fd");
    
55. 
    
56. long timeout = 1;
    
57. module_param(timeout, long, 0644);
    
58. MODULE_PARM_DESC(timeout, "Interval between send packets, default 1(unit second)");
    
59. 
    
60. 
    
61. static struct task_struct *kthreadtask = NULL;
    
62. 
    
63. struct file *sockfile = NULL;
    
64. 
    
65. 
    
66. struct threadinfo{
    
67.     struct socket *sock;
    
68.     char *buffer;
    
69. };
    
70. 
    
71. static struct socket *sock_from_file(struct file *file, int *err)
    
72. {
    
73.     /* FIXME: Warning....
    
74.      Because socket_file_ops is a static variable, so
    
75.      we can't check if the file is a socket like kernel
    
76.      function sock_from_file.
    
77.      So..., we doesn't check if the file is a socket and kernel
    
78.      will panic if the file is not a socket
    
79.      */
    
80. 
    
81. 
    
82.     //if (file->f_op == &socket_file_ops)
    
83.         return file->private_data;    /* set in sock_map_fd */
    
84. 
    
85.     *err = -ENOTSOCK;
    
86.     return NULL;
    
87. }
    
88. 
    
89. 
    
90. static struct socket *find_sock_by_pid_fd(pid_t pidnr, int fd, int *err)
    
91. {
    
92.     struct task_struct *p;
    
93.     struct file *file;
    
94.     struct files_struct *files;
    
95.     struct socket *sock;
    
96.     struct pid *pid;
    
97.     pid = find_get_pid(pidnr);
    
98.     p = get_pid_task(pid, PIDTYPE_PID);
    
99.     if (!p) {
    
100.         printk(KERN_ALERT "find_task_by_vpid error!\n");
     
101.         return NULL;
     
102.     }
     
103. 
     
104. 
     
105.     /*
     
106.      Next code learn from fget()
     
107.      Because kernel fget() function use "current" variable,
     
108.      so rewrite
     
109.     */
     
110.     files = p->files;
     
111.     rcu_read_lock();
     
112.     file = fcheck_files(files, fd);
     
113.     if (file) {
     
114.         if (file->f_mode & FMODE_PATH || !atomic_long_inc_not_zero(&file->f_count))
     
115.             file = NULL;
     
116.     }
     
117.     rcu_read_unlock();
     
118.     if (!file) {
     
119.         printk(KERN_ALERT "Can't get file from fd\n");
     
120.         return NULL;
     
121.     }
     
122. 
     
123. 
     
124.     sockfile = file;
     
125.     sock = sock_from_file(sockfile, err);
     
126.     if (!sock) {
     
127.         fput(sockfile);
     
128.         sockfile = NULL;
     
129.     }
     
130.     return sock;
     
131. }
     
132. static int sendthread(void *data)
     
133. {
     
134.     struct kvec iov;
     
135.     struct threadinfo *tinfo = data;
     
136.     struct msghdr msg = {.msg_flags = MSG_DONTWAIT|MSG_NOSIGNAL};
     
137.     int len;
     
138.     while (!kthread_should_stop()) {
     
139.         iov.iov_base = (void *)tinfo->buffer;
     
140.         iov.iov_len = strlen(tinfo->buffer);
     
141.         len = kernel_sendmsg(tinfo->sock, &msg, &iov, 1, strlen(tinfo->buffer));
     
142.         if (len != strlen(buffer)) {
     
143.             printk(KERN_ALERT "kernel_sendmsg err, len=%d, buffer=%d\n",
     
144.                     len, (int)strlen(buffer));
     
145.             if (len == -ECONNREFUSED) {
     
146.                 printk(KERN_ALERT "Receive Port Unreachable packet!\n");
     
147.             }
     
148.             break;
     
149.         }
     
150.         schedule_timeout_interruptible(timeout * HZ);
     
151.     }
     
152.     kthreadtask = NULL;
     
153.     kfree(tinfo);
     
154. 
     
155.     return 0;
     
156. }
     
157. 
     
158. static int __init udp_send_init(void)
     
159. {
     
160.     int err = 0;
     
161.     struct socket *sock;
     
162.     struct threadinfo *tinfo;
     
163. 
     
164.     sock = find_sock_by_pid_fd(pidnr, fd, &err);    
     
165.     if (!sock) {
     
166.         printk(KERN_ALERT "find_sock error\n");
     
167.         goto find_error;
     
168.     }
     
169.     tinfo = kmalloc(sizeof(struct threadinfo), GFP_KERNEL);
     
170.     if (!tinfo) {
     
171.         printk(KERN_ALERT "kmalloc threadinfo err\n");
     
172.         goto kmalloc_error;
     
173.     }
     
174.     tinfo->sock = sock;
     
175.     tinfo->buffer = buffer;
     
176.     kthreadtask = kthread_run(sendthread, tinfo, "Tony-sendmsg");
     
177. 
     
178.     if (IS_ERR(kthreadtask)) {
     
179.         printk(KERN_ALERT "create sendmsg thread err, err=%ld\n",
     
180.                 PTR_ERR(kthreadtask));
     
181.         goto thread_error;
     
182.     }
     
183.     return 0;
     
184. 
     
185. thread_error:
     
186.     kfree(tinfo);
     
187. kmalloc_error:
     
188.     kthreadtask = NULL;
     
189. find_error:
     
190.     return -1;
     
191. }
     
192. 
     
193. static void __exit udp_send_exit(void)
     
194. {
     
195. 
     
196.     if (kthreadtask) {
     
197.         kthread_stop(kthreadtask);
     
198.     }
     
199. 
     
200.     if (sockfile) {
     
201.         fput(sockfile);
     
202.     }
     
203.     printk(KERN_ALERT "UDP send quit\n");
     
204. 
     
205.     return;
     
206. }
     
207. 
     
208. 
     
209. module_init(udp_send_init);
     
210. module_exit(udp_send_exit);