My vm is x86 architecture:
# uname -m
x86pc
and my lsm library has the same permissions as lsm-pf-v4.so does:
# ls -l /lib/dll/lsm-libfilter.so
-rwxrwxr-x 1 root root 7384 Feb 13 14:43 /lib/dll/lsm-libfilter.so
# ls -l /lib/dll/lsm-pf-v4.so
-rwxrwxr-x 1 root root 239208 Feb 28 2017 /lib/dll/lsm-pf-v4.so
my code:
#include <sys/types.h>
#include <errno.h>
#include <sys/param.h>
#include <sys/conf.h>
#include <sys/socket.h>
#include <sys/mbuf.h>
#include <net/if.h>
#include <net/pfil.h>
#include <netinet/in.h>
#include <netinet/ip.h>
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/slog.h>
#include <sys/slogcodes.h>
#include "sys/io-pkt.h"
#include "nw_datastruct.h"
static int input_hook(void *arg, struct mbuf **m,
struct ifnet *ifp, int dir, int fib)
{
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR, "input");
return 0;
}
static int output_hook(void *arg, struct mbuf **m,
struct ifnet *ifp, int dir, int fib)
{
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR, "output");
return 0;
}
static int deinit_module(void);
static int iface_hook(void *arg, struct mbuf **m,
struct ifnet *ifp, int dir, int fib)
{
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR,"Iface hook called ... ");
if (m == (struct mbuf **)PFIL_IFNET_ATTACH) {
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR,"Interface attached\n");
} else if (m == (struct mbuf **)PFIL_IFNET_DETACH) {
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR,"Interface detached\n");
deinit_module();
}
return 0;
}
static int ifacecfg_hook(void *arg, struct mbuf **m,
struct ifnet *ifp, int dir, int fib)
{
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR,"Iface cfg hook called with 0x%p\n", m);
return 0;
}
static int deinit_module(void)
{
struct pfil_head *pfh_inet;
pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
if (pfh_inet == NULL) {
return ESRCH;
}
pfil_remove_hook(input_hook, NULL, PFIL_IN | PFIL_WAITOK,
pfh_inet);
pfil_remove_hook(output_hook, NULL, PFIL_OUT | PFIL_WAITOK,
pfh_inet);
pfh_inet = pfil_head_get(PFIL_TYPE_IFNET, 0);
if (pfh_inet == NULL) {
return ESRCH;
}
pfil_remove_hook(ifacecfg_hook, NULL, PFIL_IFNET, pfh_inet);
pfil_remove_hook(iface_hook, NULL, PFIL_IFNET | PFIL_WAITOK,
pfh_inet);
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR,
"Unloaded pfil hook\n");
return 0;
}
int pfil_entry(void *dll_hdl, struct _iopkt_self *iopkt,
char *options)
{
printf("pfil_entry+++++++++ enter\n");
struct pfil_head *pfh_inet;
pfh_inet = pfil_head_get(PFIL_TYPE_AF, AF_INET);
if (pfh_inet == NULL) {
return ESRCH;
}
pfil_add_hook(input_hook, NULL, PFIL_IN | PFIL_WAITOK,
pfh_inet);
pfil_add_hook(output_hook, NULL, PFIL_OUT | PFIL_WAITOK,
pfh_inet);
pfh_inet = pfil_head_get(PFIL_TYPE_IFNET,0);
if (pfh_inet == NULL) {
return ESRCH;
}
pfil_add_hook(iface_hook, NULL, PFIL_IFNET, pfh_inet);
pfil_add_hook(ifacecfg_hook, NULL, PFIL_IFADDR, pfh_inet);
slogf(_SLOG_SETCODE(_SLOGC_TEST, 2),
_SLOG_ERROR, "Loaded pfil hook\n");
return 0;
}
struct _iopkt_lsm_entry IOPKT_LSM_ENTRY_SYM(pfil) =
IOPKT_LSM_ENTRY_SYM_INIT(pfil_entry);
and Makefile:
ARTIFACT = libfilter_1.so
#Build architecture/variant string, possible...
View Full Message