static bool skip_rr(u8 *dns, size_t len, size_t *offset) {
u16 rdlength;
if (skip_name(dns, len, offset) && ((*offset) + 6) <= len ){
rdlength = dns[(*offset) + 4] << 8 | dns[(*offset) + 5];
debug_dump_buf(dns, len, *offset, "skip_rr");
NFDEBUG("rdlength: %d\n", rdlength);
if ((*offset) + 6 + rdlength < len) {
(*offset) += 6 + rdlength;
return true;
}
}
pr_warn("Skipping RR failed. offset: %zu, len: %zu\n", *offset, len);
return false;
}
static bool dns_mt(const struct sk_buff *skb, struct xt_action_param *par)
#endif
{
const struct xt_dns_info *info = par->matchinfo;
u8 *dns;
size_t len, offset;
bool is_match, invert;
u16 counts[4]; /* qdcount, ancount, nscount, arcount */
u16 udpsize;
int i;
/* skip fragments */
if (par->fragoff)
return false;
NFDEBUG("skb->len: %d, skb->data_len: %d, par->thoff: %d\n", skb->len, skb->data_len, par->thoff);
/* find UDP payload */
offset = par->thoff + sizeof(struct udphdr);
len = skb->len - offset;
if (len > sizeof(pktbuf)) {
pr_warn(KBUILD_MODNAME": Packet too big. Increase MAX_MTU (size %d)\n", skb->len);
return false;
}
dns = skb_header_pointer(skb, offset, len, pktbuf);
if (dns == NULL) {
pr_warn(KBUILD_MODNAME": skb_header_pointer failed!\n");
return false;
}
/* minimum DNS query payload is 17 bytes (for "." root zone) */
if (len < 17)
return false;
NFDEBUG("skb->len: %d, skb->data_len: %d, len: %zu\n", skb->len, skb->data_len, len);
debug_dump_buf(dns, len, 0, "ipt_dns");
/* check if we are dealing with DNS query */
if (info->flags & XT_DNS_QUERY) {
invert = ((info->invert_flags & XT_DNS_QUERY) != 0);
is_match = ((dns[2] & NS_QR) == NS_QR_QUERY);
if (is_match == invert)
return false;
}
/* check if we are dealing with DNS response */
if (info->flags & XT_DNS_RESPONSE) {
invert = ((info->invert_flags & XT_DNS_RESPONSE) != 0);
is_match = ((dns[2] & NS_QR) == NS_QR_RESPONSE);
if (is_match == invert)
return false;
}
/* fill counts[] with data from dns header */
for (i=0; i<4; i++) {
counts[i] = ntohs(((u16*)dns)[i+2]);
}
/* query type test */
if (info->flags & XT_DNS_QTYPE) {
NFDEBUG("Entering qtype match\n");
invert = ((info->invert_flags & XT_DNS_QTYPE) != 0);
is_match = counts[0] > 0; /* qdcount at least 1 */
if (!is_match)
goto qtype_out;
/* offset is set to the first question section */
offset = 12;
is_match = skip_name(dns, len, &offset);
if (!is_match)
goto qtype_out;
NFDEBUG("Matching qtype: %x %x %x %x\n", dns[offset-4], dns[offset-3], dns[offset-2], dns[offset-1]);
/* match if type=info->type, class IN */
is_match = (dns[offset-4] == 0x00) && (dns[offset-3] == info->qtype)
&& (dns[offset-2] == 0x00) && (dns[offset-1] == 0x01);
qtype_out:
if (is_match == invert)
return false;
}
/* check for EDNS0 */
if (info->flags & XT_DNS_EDNS0) {
invert = ((info->invert_flags & XT_DNS_EDNS0) != 0);
is_match = counts[3] > 0; /* arcount at least 1 */
offset = 12;
/* skip query sections */
for (i=0; i<counts[0]; i++) {
is_match &= skip_name(dns, len, &offset);
if (!is_match)
break;
}
if (!is_match)
goto edns0_out;
/* skip answer and authority sections */
for (i=0; i<(counts[1]+counts[2]); i++) {
is_match &= skip_rr(dns, len, &offset);
if (!is_match)
break;
}
if (!is_match)
goto edns0_out;
/* try to find EDNS0 pseudo-RR */
for (i=0; i<counts[3]; i++) {
if (dns[offset] == 0 && dns[offset+1] == 0 && dns[offset+2] == 41)
break;
is_match &= skip_rr(dns, len, &offset);
if (!is_match)
break;
}
if (!is_match || (i == counts[3])) {
is_match = false;
goto edns0_out;
}
/* EDNS0 found */
if (info->flags & XT_DNS_BUFSIZE) {
/* TODO: XT_DNS_BUFSIZE inversion not implemented */
udpsize = dns[offset+3] << 8 | dns[offset+4];
if (udpsize < info->bufsize[0] || udpsize > info->bufsize[1]) {
is_match = false;
goto edns0_out;
}
}
debug_dump_buf(dns, len, offset, "ipt_dns_edns0");
edns0_out:
if (is_match == invert)
return false;
}
/* Nothing stopped us so far, let's accept the packet */
return true;
}
/**
* \brief 测试子程序
*/
void test_func(void)
{
static uint16_t i=0;
NFDEBUG_("");
NFDEBUG("test_func %d", i++);
}
