Example of kernel dev_add_pack (scu.edu difeijing)

The following content assumes that you have a better understanding of the Linux kernel network and lkm.
Mechanism.
In the previous article, kernel sniffer is actually used for the function dev_add_pack (). Here
Let's give another example of using dev_add_pack () in the kernel. We should all know that,
It is a socket of the sock_packet type.
How does the sock_packet interface capture various types of packages?
It uses the sock_packet parameter to tell Linux when it is created.
There are some special operations. Okay, start here.


From the time of creation, it is sys_socketcall. All socket-related
The system calls sys_socketcall.
OK, sys_socketcall () is in socket. C,
Asmlinkage int sys_socketcall (INT call, unsigned long * ARGs)
See the following sentence in the switch of the judgment operation,
Case sys_socket:
Err = sys_socket (A0, A1, a [2]);
Break;
Let's take a look at sys_socket (), which is also in socket. C.
Asmlinkage int sys_socket (INT family, int type, int Protocol)
In the following sentence, retval = sock_create (family, type, protocol, & sock ),
It also used other functions. Continue. Sock_create () is also in socket. C,
Int sock_create (INT family, int type, int protocol, struct socket
** Res)
Take a look at the following statement,
If (I = net_families [Family]-> Create (sock, protocol) <0)
{
Sock_release (sock );
Return I;
}
Net_families is a global variable, which is defined
/*
* The protocol list. Each protocol is registered in here.
*/

Struct net_proto_family * net_families [nproto];
Have you noticed the above comments? It turns out that everyone is concentrated together. Each protocol family will
The registration information in this array, including the creation routine,... the following is the structure
Definition of struct net_proto_family:
Struct net_proto_family
{
Int family;
INT (* Create) (struct socket * sock, int Protocol );
/* These are counters for the number of different methods
Each we support */
Short authentication;
Short encryption;
Short encrypt_net;
};
The family value is defined in socket. H, such as pf_inet, pf_ipx, ip_packet ,......
Now you know the target, that is, the pf_packet protocol family in net_families
For the creation routine registered in, find... finally found the operation on net_families
It is also in socket. C, function ock_register (), very simple operation,
Int sock_register (struct net_proto_family * OPS)
{
If (OPS-> family> = nproto ){
Printk (kern_crit "protocol % d> = nproto (% d)/n", OPS-> fami
Ly, nproto );

Return-enobufs;
}
Net_families [OPS-> family] = OPS;
Return 0;
}
It can be seen from this that this is used by various protocol families for registration. Well, check where this is used.
Call count. As expected, the files using this function are the following,
Af_ax25.c (F:/linux-2.2.12/NET/ax25): sock_register (& ax25_family_ops );
Af_inet.c (F:/linux-2.2.12/NET/IPv4): (void)
Sock_register (& inet_family_ops );
Af_inet6.c (F:/linux-2.2.12/NET/IPv6): (void)
Sock_register (& inet6_family_ops );
Af_ipx.c (F:/linux-2.2.12/NET/IPX): (void)
Sock_register (& ipx_family_ops );
Af_irda.c (F:/linux-2.2.12/NET/IrDA): sock_register (& irda_family_ops );
Af_netlink.c (F:/linux-2.2.12/NET/Netlink ):
Sock_register (& netlink_family_ops );
Af_netrom.c (F:/linux-2.2.12/NET/netrom ):
Sock_register (& nr_family_ops );
Af_packet.c (F:/linux-2.2.12/NET/packet ):
Sock_register (& packet_family_ops );
Af_rose.c (F:/linux-2.2.12/NET/rose): sock_register (& rose_family_ops );
Af_unix.c (F:/linux-2.2.12/NET/Unix): sock_register (& unix_family_ops );
Af_x25.c (F:/linux-2.2.12/NET/x25): sock_register (& x25_family_ops );
DDP. C (F:/linux-2.2.12/NET/appletalk): (void)
Sock_register (& atalk_family_ops );
Econet. C (F:/linux-2.2.12/NET/econet ):
Sock_register (& econet_family_ops );
Now we know that each protocol family uses sock_register () to register themselves. What we care about is
Packet, so
View the file af_packet.c.
Int init_module (void)
{
Sock_register (& packet_family_ops );
Register_netdevice_notifier (& packet_netdev_notifier );
Return 0;
}
Continue to look at packet_family_ops, which is also in af_packet.c.
Static struct net_proto_family packet_family_ops =
{
Pf_packet,
Packet_create
};
The previous definition of struct net_proto_family is available. We know packet_family_ops.
The family value of is pf_packet, And the creation routine is packet_create. It is about to begin.
Packete_create () is also defined in af_packet.c. This function has a certain length, so it is unnecessary here.
All
Posted. In the first section, it is about some details, permission check, module count increase, and
Sock and
Some fields of struct socket are filled. The following are our concerns.
/*
* Attach a protocol Block
*/
Struct sock * SK;
SK-> protinfo. af_packet-> prot_hook.func = packet_rcv;
SK-> protinfo. af_packet-> prot_hook.data = (void *) SK;
If (Protocol ){
SK-> protinfo. af_packet-> prot_hook.type = protocol;
Dev_add_pack (& SK-> protinfo. af_packet-> prot_hook );
SK-> protinfo. af_packet-> running = 1;
}

You can see the sentence "dev_add_pack!
In fact, the implementation of sock_packet uses dev_add_pack (). We can
The function that knows the processing package it uses is packet_rcv (), hehe.