a problem with netfilter

a problem with netfilter

[Bozeanu Andrei]

Hey all,

I am writing a linux firewall kernel module (something a bit specific)
using Netfilter, in C. I extract the
TCP header and the IP header using the functions tcp_hdr() and ip_hdr()
on the skb. I extract the source and
destination IPs without any problem, yet, when I try to see the source
port and the destination port i get wrong
values.

sport = ntohs(tcp_hdr(skb)->source);
dport= ntohs(tcp_hdr(skb)->dest);

I use printk to send the info to the syslog and
printk(KERN_INFO "got data on port %hu from source port %hu\n", dport,
sport);

the result i get is
"got data on port 17680 from port 84"
"got data on port 17680 from port 84"
"got data on port 17680 from port 100"

while netstat shows me that the right values for these ports are dport =
56188 and sport = 22.

I must be doing something wrong or missing something of the bigger
picture, I would apreciate any insight
on why this behavior is generated.

Thank you all,
A.

Re: a problem with netfilter

[U.Mutlu]

Bozeanu Andrei wrote, On 10/17/2012 02:34 PM:
> Hey all,
>
> I am writing a linux firewall kernel module (something a bit specific)
> using Netfilter, in C. I extract the
> TCP header and the IP header using the functions tcp_hdr() and ip_hdr()
> on the skb. I extract the source and
> destination IPs without any problem, yet, when I try to see the source
> port and the destination port i get wrong
> values.
>
> sport = ntohs(tcp_hdr(skb)->source);
> dport= ntohs(tcp_hdr(skb)->dest);

Just guessing: maybe ntohs has already been applied to source and dest, so try it w/o ntohs()...

> I use printk to send the info to the syslog and
> printk(KERN_INFO "got data on port %hu from source port %hu\n", dport,
> sport);
>
> the result i get is
> "got data on port 17680 from port 84"
> "got data on port 17680 from port 84"
> "got data on port 17680 from port 100"
>
> while netstat shows me that the right values for these ports are dport =
> 56188 and sport = 22.
>
> I must be doing something wrong or missing something of the bigger
> picture, I would apreciate any insight
> on why this behavior is generated.
>
> Thank you all,
> A.