实验防火墙代码编译出错,请大家帮忙看看,多谢了!

由 Dopilas 在 04-12-2004 20:32 发表:

实验防火墙代码编译出错,请大家帮忙看看,多谢了!

我想主要是头文件的顺序问题搞不定,就象hello模块的头文件必须把module.h方在kernel.h前一样.

谁能告诉我该怎么做啊?本人将非常感激.

代码如下:

//mytestfirewall.c 阻止某个特定IP对我机器的ftp服务器的访问

#define MODULE

#include

  1<linux module.h="">   
  2  
  3#define __KERNEL__   
  4  
  5#include <linux kernel.h="">   
  6  
  7#include <linux skbuff.h="">   
  8  
  9#include <linux ip.h=""> /* For IP header */   
 10  
 11#include <linux tcp.h=""> /* For TCP header */   
 12  
 13#include <linux netfilter.h="">   
 14  
 15#include <linux netfilter_ipv4.h="">   
 16  
 17  
 18  
 19/* 用于注册函数的数据结构 */   
 20  
 21static struct nf_hook_ops nfho;   
 22  
 23  
 24  
 25/* 丢弃的数据包来自的地址，网络字节序 */   
 26  
 27unsigned char *deny_ip = "\x7f\x00\x00\x01"; /* 127.0.0.1 */   
 28  
 29static int check_ip_packet(struct sk_buff *skb)   
 30  
 31{   
 32  
 33/* We don't want any NULL pointers in the chain to   
 34  
 35* the IP header. */   
 36  
 37if (!skb )return NF_ACCEPT;   
 38  
 39if (!(skb-&gt;nh.iph)) return NF_ACCEPT;   
 40  
 41if (skb-&gt;nh.iph-&gt;saddr == *(unsigned int *)deny_ip)   
 42  
 43{   
 44  
 45return NF_DROP;   
 46  
 47}   
 48  
 49return NF_ACCEPT;   
 50  
 51}   
 52  
 53/* 丢弃的数据包的目的端口，网络字节序 */   
 54  
 55unsigned char *deny_port = "\x00\x50"; /* port 80 */   
 56  
 57static int check_tcp_packet(struct sk_buff *skb)   
 58  
 59{   
 60  
 61struct tcphdr *thead;   
 62  
 63/* We don't want any NULL pointers in the chain   
 64  
 65* to the IP header. */   
 66  
 67if (!skb ) return NF_ACCEPT;   
 68  
 69if (!(skb-&gt;nh.iph)) return NF_ACCEPT;   
 70  
 71/* Be sure this is a TCP packet first */   
 72  
 73if (skb-&gt;nh.iph-&gt;protocol != IPPROTO_TCP)   
 74  
 75{   
 76  
 77return NF_ACCEPT;   
 78  
 79}   
 80  
 81thead = (struct tcphdr *)(skb-&gt;data+(skb-&gt;nh.iph-&gt;ihl * 4));   
 82  
 83/* Now check the destination port */   
 84  
 85if ((thead-&gt;dest) == *(unsigned short *)deny_port)   
 86  
 87{   
 88  
 89return NF_DROP;   
 90  
 91}   
 92  
 93return NF_ACCEPT;   
 94  
 95}   
 96  
 97  
 98  
 99  
100  
101/* 注册的hook函数的实现 */   
102  
103unsigned int hook_func(unsigned int hooknum,   
104  
105struct sk_buff **skb,   
106  
107const struct net_device *in,   
108  
109const struct net_device *out,   
110  
111int (*okfn)(struct sk_buff *))   
112  
113{   
114  
115struct sk_buff *sb = *skb;   
116  
117if((check_ip_packet(skb)==NF_ACCEPT)&amp;&amp;(check_tcp_packet(skb)==NF_ACCEPT))   
118  
119{   
120  
121return NF_ACCEP</linux></linux></linux></linux></linux></linux></linux>