Mangling sk_buff data in a Netfilter module

0
votes

I am building a module that does massive mangling of the protocol contained within. I am only mangling Layer 4 packets. I convert them back on the other end to how they should be. The packet size is still 1:1, so there really isn't a need to reallocate skb...

That said, I change skb->data, and then return NF_ACCEPT from my NF_IP_LOCAL_OUT hook. I have another hook that shows me that the sk_buff is passed to NF_IP_POST_ROUTING, but the packet never actually leaves the host (as in I don't see it in Wireshark). I can't figure out what is going on. Is the packet being dropped somewhere? I am not using any other kernel hooks other than the netfilter hooks and I am not manipulating the destination, so it should leave the machine without question.

Any ideas what might be causing it? Do I need to register my custom IPPROTO with the kernel? I have it in /etc/protocols I figured that would be enough. Or am I just going down the wrong path entirely? I tried working with the ESP and AH code that's in the kernel for IPsec, since it also mangles the packets, but all the transform code is more complicated than I need for what I am doing.

1
networkingnetfilter
I haven't followed all your post, so just one point: the kernel doesn't even read /etc/protocols, and anyway that's only a database that relates names with numbers. That file is irrelevant to any kernel programming. – Gilles 'SO- stop being evil'
I thought that was the case. The only thing I found that had anything to do with /etc/protocols is the netdb.h header. I will update my answer later after I get a blog post together with further details of what I and how I did it so that others could learn more. – sparticvs

1 Answers

0
votes

Resolution

It would seem I was doing everything correctly with a single exception. I wasn't recalculating the IP header's checksum (since I was changing the protocol id itself, this is mandatory).

Code

iph->check = 0;
iph->check = ip_fast_csum(iph, iph->ihl);

And presto it worked.