如何在内核模块开发下解析IP地址的Mac地址？

Question

我想在内核模块中构建一个tcp包，并使用函数dev_queue_xmit（skb）通过IP地址将其发送到另一个主机。但我不想手工填写Mac地址。以下是生产包装的代码。某些内核函数调用eth_rebuild_header（skb）重新构建Mac头。但是，就我而言，它在被调用后挂起了我的电脑。如果arp缓存中不包含该IP地址的条目，Google结果会回答arp_find会使操作系统崩溃。但我确定它存在于由arp -v命令打印的arp缓存中。

static int build_and_xmit_tcp(char * eth, u_char * smac, u_char * dmac, 
      u_long sip, u_long dip, 
      u_short sport, u_short dport, 
      u_char * pkt, int pkt_len, 
      int syn, int ack, int fin, 
      __be32 seq, __be32 seq_ack) 
{ 
    struct sk_buff * skb = NULL; 
    struct net_device * dev = NULL; 
    struct ethhdr * ethdr = NULL; 
    struct iphdr * iph = NULL; 
    struct tcphdr * tcph = NULL; 
    u_char * pdata = NULL; 
    if(NULL == smac || NULL == dmac) 
     goto out; 

    if(NULL == (dev= dev_get_by_name(&init_net, eth))) 
     goto out; 
    skb = alloc_skb(pkt_len + sizeof(struct iphdr) + sizeof(struct tcphdr) + LL_RESERVED_SPACE(dev), GFP_ATOMIC); 

    if(NULL == skb) 
     goto out; 
    skb_reserve(skb, LL_RESERVED_SPACE(dev)); 

    skb->dev = dev; 
    skb->pkt_type = PACKET_OTHERHOST; 
    skb->protocol = __constant_htons(ETH_P_IP); 
    skb->ip_summed = CHECKSUM_NONE; 
    skb->priority = 0; 
    skb_set_network_header(skb, 0); 
    skb_put(skb, sizeof(struct iphdr)); 
skb_set_transport_header(skb, sizeof(struct iphdr)); 
    skb_put(skb, sizeof(struct tcphdr)); 

    pdata = skb_put(skb, pkt_len); 
    { 
    if(NULL != pkt) 
     memcpy(pdata, pkt, pkt_len); 
    } 

    tcph = tcp_hdr(skb); 
    memset(tcph, 0, sizeof(struct tcphdr)); 
    tcph->source = sport; 
    tcph->dest = dport; 
    tcph->doff=5; 
    tcph->seq = htonl(seq); 
    tcph-> ack_seq= htonl(seq_ack); 
    tcph->psh = pkt_len>0? 1:0; 
    tcph ->fin = fin; 
    tcph->ack = ack; 
    tcph->syn=syn; 
    tcph->window=__constant_htons (65535); 
    skb->csum = 0; 
    tcph->check = 0; 
    iph = ip_hdr(skb); 
    iph->version = 4; 
    iph->ihl = sizeof(struct iphdr)>>2; 
    iph->frag_off = 0; 
    iph->protocol = IPPROTO_TCP; 
    iph->tos = 0; 
    iph->daddr = dip; 
    iph->saddr = sip; 
    iph->ttl = 0x40; 
    iph->tot_len = __constant_htons(skb->len); 
    iph->check = 0; 
    iph->check = ip_fast_csum((unsigned char *)iph,iph->ihl); 

    skb->csum = skb_checksum(skb, iph->ihl*4, skb->len - iph->ihl * 4, 0); 
    tcph->check = csum_tcpudp_magic(sip, dip, skb->len - iph->ihl * 4, IPPROTO_TCP, skb->csum); 
    skb_push(skb, 14); 
    skb_set_mac_header(skb, 0); 
    ethdr = (struct ethhdr *)eth_hdr(skb); 
// memcpy(ethdr->h_dest, dmac, ETH_ALEN); 
// memcpy(ethdr->h_source, smac, ETH_ALEN); 
    ethdr->h_proto = __constant_htons(ETH_P_IP); 

// arp_send(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr, 
//  dst_ha, dev->dev_addr, NULL); 
    eth_rebuild_header(skb);  // kernel hang.... 
    if(0 > dev_queue_xmit(skb)) { 
     dev_put (dev); 
     kfree_skb (skb); 
    } 
    return(NF_ACCEPT); 

out: 
     dev_put (dev); 
     kfree_skb (skb); 
    return(NF_ACCEPT); 
} 


static int __init myhook_init(void) 
{ 
    printk("=========insert module......\n"); 
    build_and_xmit_tcp(ETH_O, GWMAC_O, DMAC, in_aton(GWIP_O), in_aton(DIP), htons(8888), htons(DPORT), 
        "", 0, 
        1, 0, 0, 0, 0); 
} 

static void __exit myhook_fini(void) 
{ 
    printk("=========rmmod ......\n"); 
} 

module_init(myhook_init); 
module_exit(myhook_fini); 

谷歌给了我一些其他的解决办法。他们说arp_ioctl可以解析Mac地址。但事实是，arp_ioctl被静态编译为vmlinuz，而不会作为符号导出到其他模块。

int arp_get(char *ifname, char *ipStr) 
{ 
    struct arpreq req; 
    struct sockaddr_in *sin; 
    int ret = 0; 
    int sock_fd = 0; 
    struct net_device * dev = NULL; 
    printk("arp ---- \n"); 
    if(NULL == (dev= dev_get_by_name(&init_net, ifname))){ 
     dev_put (dev); 
     printk("error dev get \n"); 
     return -1; 
    } 
    struct net *net_arp = dev_net(dev); 
    memset(&req, 0, sizeof(struct arpreq)); 

    sin = (struct sockaddr_in *)&req.arp_pa; 
    sin->sin_family = AF_INET; 
    sin->sin_addr.s_addr = in_aton(ipStr); 


    strncpy(req.arp_dev, ifname, 15); 
    ret = arp_ioctl(net_arp, SIOCGARP, &req);  // can't be called 
    unsigned char *hw = (unsigned char *)req.arp_ha.sa_data; 
    printk("%#x-%#x-%#x-%#x-%#x-%#x\n", hw[0], hw[1], hw[2], hw[3], hw[4], hw[5]); 
    return 0; 
} 

也许我需要做一个套接字结构，并尝试一些基于套接字的上层功能。但如何做到这一点...

内核版本2.6.32 OS版本：Ubuntu 9.10的 gcc版本：4.41

Answer 1

int ip_xmit(struct sk_buff *skb) 
{ 
    struct iphdr *iph = ip_hdr(skb); 
    struct tcphdr *tcph = tcp_hdr(skb); 
    printk("dst is %d\n", skb->_skb_dst); 
    int err; 
// err = ip_route_input(skb, iph->daddr, iph->saddr, 0, skb->dev); 

    struct rtalbe *rt; 

    { 
     struct flowi fl = { .oif = 0, 
        .nl_u = { .ip4_u = 
          { .daddr = iph->daddr, 
         .saddr = iph->saddr, 
         .tos = 0 } }, 
        .proto = IPPROTO_TCP, 
        .flags = 0, 
        .uli_u = { .ports = 
          { .sport = tcph->source, 
         .dport = tcph->dest } } }; 

     if (err = ip_route_output_key(&init_net, &rt, &fl)) 
      return err; 
      printk("err is %d\n", err); 
    } 
    skb_dst_set(skb, rt); 
    if(0 > ip_local_out(skb)) { 
     printk("dev error\n"); 
     kfree_skb (skb); 
     return -1; 
    } 
    return 0; 
} 

功能ip_route_output_key可以得到路由目的地，ip_local_out了交付SKB 。