Extracting info from frag packet in pre route hook

Extracting info from frag packet in pre route hook

[vivek rajagopalan]

Hi,

I wrote an LKM and I am trying to get UDP port information from the
first fragmented packet received in PRE_ROUTING hook as follows

struct iphdr *iph = (struct iphdr*) skb_network_header(skb);
struct udphdr *udph = (struct udphdr *)(iph + (iph->ihl)*4); //or
(struct udphdr *)(skb->data + (iph->ihl)*4) and other such methods

However ntohs(udph->source) is always returning 0. This method works
for a non-fragmented packet. I am wondering if PRE_ROUTING is a good
place to do this at all or LOCAL_IN is the correct place. Or is it
that i am trying to fetch the payload from the wrong data pointers?

I am using 2.6.35 kernel

Thanks
Vivek

Re: Extracting info from frag packet in pre route hook

[Jan Engelhardt]

On Thursday 2012-01-05 06:31, vivek rajagopalan wrote:

>Hi,
>
>I wrote an LKM and I am trying to get UDP port information from the
>first fragmented packet received in PRE_ROUTING hook as follows
>
>struct iphdr *iph = (struct iphdr*) skb_network_header(skb);

You want: struct iphdr *iph = ip_hdr(skb);

>struct udphdr *udph = (struct udphdr *)(iph + (iph->ihl)*4); //or
>(struct udphdr *)(skb->data + (iph->ihl)*4) and other such methods

You need

  struct udphdr *udph = skb_header_pointer(...)

Re: Extracting info from frag packet in pre route hook

[vivek rajagopalan]

On Thu, Jan 5, 2012 at 1:21 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
> You need
>
>  struct udphdr *udph = skb_header_pointer(...)
>

This solved the problem, what offset to use was not clear to me
initially but it eventually turned out to be 20. Thanks so much

Vivek

Re: Extracting info from frag packet in pre route hook

[Jan Engelhardt]

On Saturday 2012-01-07 03:36, vivek rajagopalan wrote:

>On Thu, Jan 5, 2012 at 1:21 PM, Jan Engelhardt <jengelh@medozas.de> wrote:
>> You need
>>
>>  struct udphdr *udph = skb_header_pointer(...)
>>
>
>This solved the problem, what offset to use was not clear to me
>initially but it eventually turned out to be 20. Thanks so much

The offset to use is of course ip_hdrlen(skb), not 20.