Question

I have to write a vpn module. First of all, I have wrote a kernel module that modifies all the incoming and outgoing TCP packets. It uses netfilter hooks. For the incoming packets, I have modified the bytes between (struct sk_buff)->data and (struct sk_buff)->tail pointers by incrementing them by one. For the outgoing packets, I have modified the bytes between (struct sk_buff)->data and (struct sk_buff)->tail pointers by decrementing them by one.

However, I tried to establish a TCP connection between localhost and localhost (by means of netcat) and I had not succeeded. Can you tell me what I am doing wrong? Need I modify some other fields from the struct sk_buff structure?

Is it possible to implement my simple vpn module only from kernel space?(thus without using special libraies such as libnetfilter_queue)?

Thank you.

Answer 1

Yes, you can do this without using libnetfilter. But given the limited information that you ve provided about your project it s hard to give a good recommendation as to how to go about fixing your issue. Here s some references that should help.

1) I would recommend you take a look at the TUN/TAP interface driver APIs. This will allow you to implement your code in application space rather than kernel. See openvpn for a great example of this type of VPN.

If you re interested in doing more advanced kernel space hooking...
2) Check this article out on hooking into netfilter netfilter kernel hooks

友情链接