OSLab
Operating Systems Lab Resources

         IP: Netfilter Configuration  ---> 

We will create a filter named "cs577" and load it via the iptables command. To do this, first build a modified iptables:

• add cs577 to the PF_EXT_SLIB variable in the same directory
• run make.
• Note - if you do this on your VM, then you can run make install to install the modified version in the /usr/local directory:

    # make install
        ....
    # PATH=/usr/local/sbin:$PATH

Next we modify the following netfilter skeleton: ipt_cs577.c and modify the match() function to track packet statistics as specified above.

Finally you should be able to install the module and connect it to inputs and outputs as follows:

    insmod ipt_cs577.ko
    iptables -t filter -A INPUT  --match cs577 -j ACCEPT
    iptables -t filter -A OUTPUT --match cs577 -j ACCEPT

For testing, it should be sufficient to ping a number of different machines - for instance to show that after ping -c 10 host.foo.com the counts for packets to and from host.foo.com incremented by 10.

• start with the iptables source linked to above, and add this file - libipt_cs577.c to the iptables-11.27.06/extensions/ directory.

• start with the iptables source linked to above, and add this file - to the iptables-11.27.06/extensions/ directory.

[-- include <getopt.h> include <iptables.h>

[-- [@

1. include <getopt.h>

[@ #include <getopt.h>

@]

[-- [= #include <getopt.h>

}=] --]

Note that you will need to enable iptables and IPv4 packet filtering support in the kernel - the options for this are [@

IP: Netfilter Configuration --->

     <*> IP tables support (required for filtering/masq/NAT)
             ....
     <*>   Packet filtering@]

Iptables / netfilter overview

Implementation and Testing

We will create a filter named "cs577" and load it via the iptables command. To do this:

• start with the iptables source linked to above, and add the following as the file iptables-11.27.06/extensions/libipt_cs577.c:

 #include <getopt.h>
#include <iptables.h>

static void init(struct ipt_entry_match *m, unsigned int *nfcache)
{
    /* Can't cache this */
    *nfcache |= NFC_UNKNOWN;
}

static int parse(int c, char **argv, int invert, unsigned int *flags,
                 const struct ipt_entry *entry,
                 unsigned int *nfcache, struct ipt_entry_match **match)
{ 
    return 0; 
}

static void final_check(unsigned int flags) { }

static struct option opts[] = { { .name = 0 } };

static struct iptables_match cs577 = {
    .name            = "cs577",
    .version         = IPTABLES_VERSION,
    .init            = &init,
    .parse           = &parse,
    .final_check     = &final_check,
    .extra_opts      = opts
};

void _init(void)
{
   register_match(&cs577);
}

NOTE (Mon 11/27) - for now, it's OK to just use insmod to load the module. I'll give some detailed directions on using iptables to load the module when I figure it out.

The LinuxFocus article has sample code for a simple netfilter that does packet matching on IP address, as well as the corresponding iptables module. To build the iptables module, the easiest method is to get the iptables distribution (you can get the latest snapshot here: iptables-11.27.06.tgz) and add your module to the extensions directory; it will then get built when you run make. Note that to build the LinuxFocus code you will have to copy the .h file to include/linux/netfilter_ipv4/.

IPTables integration

Even though this module doesn't really do filtering, matching, or packet mangling, we are going to install it in the same way as other netfilter modules - via the iptables command.

First, some definitions:

• netfilter module - a kernel module which interfaces with the packet filter mechanism
• iptables module - a user space loadable library which is loaded at runtime by the iptables command. Typically this library corresponds to a netfilter module, and understands how to specify arguments to the kernel module.

Each netfilter module has a name, which is specified when it registers with the netfilter framework. I don't think this name has to be the same as the module name.

Each iptables module has a name and can be loaded via the -m option; i.e. module "xyz" can be loaded by adding the option -m xyz to the iptables command line. If that name is "xyz", the the module must be found in the library libipt_xyz.so in either the default directory (/usr/local/lib/iptables) or the directory specified by the environment variable IPTABLES_LIB_DIR.

The LinuxFocus article has sample code for a simple netfilter that does packet matching on IP address, as well as the corresponding iptables module. To build the iptables module, the easiest method is to get the iptables distribution (you can get the latest snapshot here: Attach:iptables-11.27.06.tgz) and add your module to the extensions directory; it will then get built when you run make. Note that to build the LinuxFocus code you will have to copy the .h file to include/linux/netfilter_ipv4/.

           Networking options  ---> @]

           IP: Netfilter Configuration  ---> @]

           Networking options  ---> @]

           IP: Netfilter Configuration  ---> @]

     [*] Network packet filtering (replaces ipchains)  ---> 

[*] Network packet filtering (replaces ipchains) --->

[@ [ ] Network packet filtering debugging

[@ < > Connection tracking (required for masq/NAT)

           Networking options  ---> @]

     [*] Network packet filtering (replaces ipchains)  ---> 

[@

           IP: Netfilter Configuration  ---> @]

[@

           Networking options  ---> @]

     [*] Network packet filtering (replaces ipchains)  ---> 
[@

           IP: Netfilter Configuration  ---> @][@

     [*] Networking support 
           Networking options  ---> 

     [*] Network packet filtering (replaces ipchains)  ---> 

     [ ]   Network packet filtering debugging 
           Core Netfilter Configuration  ---> 
           IP: Netfilter Configuration  ---> 

     < > Connection tracking (required for masq/NAT)
     < > IP Userspace queueing via NETLINK (OBSOLETE)
     <*> IP tables support (required for filtering/masq/NAT)

• KernelCorner: Writing your own netfilter match
• Linux netfilter Hacking HOWTO

Netfilters

Assigned: 11/27/06 Due: 12/08/06

Objective

In this lab you will write a simple netfilter module which tracks packets but does not modify or reroute them. In particular, your module will need to do the following:

• examine all packets entering and leaving the system
• keep a list of all external IP addresses seen. (Note that this list may grow without bounds, so you need a mechanism to throw out entries)
• for each external address, keep counts of the number of packets received from that address and the number sent to it
• provide a /proc file interface that allows the current IP list and corresponding counters to be retrieved.

Documentation and Resources:

Some resources which might be helpful are:

• http://www.linuxfocus.org/English/February2005/article367.shtml
• http://www.netfilter.org/documentation/HOWTO/netfilter-hacking-HOWTO.html

Implementation and Testing

NOTE (Mon 11/27) - for now, it's OK to just use insmod to load the module. I'll give some detailed directions on using iptables to load the module when I figure it out.

Submission

Please submit via email the source code for the module, a test log (e.g. use script to capture the terminal session while testing manually, or put the commands in a script file and run it with sh -x), and a short writeup of your design.