[转]Linux: ubuntu 9.10 10.04 下 安装 Dr.com 上网

想正式地试用一下ubuntu，装了9.10 ，分10G的空间，勉强足够，为了搭建一个PHP开发平台。

学校是电子科技大学中山学院，上网的方式是dr.com认证，windows下的版本是3.46，我自己改了一下，可以用内网。

wubi安装方式，上网搜索的教程，发现需要安装build-essential 来编译dr.com，后来找到了这个网站：

www.drcom-client.org

发现有带gui的，就下载安装。

先下载了drcom-client PUM v1.0
，deb包，直接安装，GUI可以出来，填好后点登录，出错，提示没有运行drcom的内核。

只好再下载drcom-client v1.4.8.2
命令行方式的来安装。

解压后，控制台下进入目录，输入

make

提示出错，后来再google讨论组里找到一个主题，也是有人讨论这个问题，貌似是因为新内核的原因。帖子里有
人修改了kmod目录下的drcom.c文件

，
并提供下载。下载覆盖后

make

sudo make install

一切正常，提示修改/etc/drcom.conf文件，配置登陆器。

drcom.conf文件在安装之后要手动设置，其中我们学校的设置就是如下

username=上网帐号

password=密码

nic0=你的IP

dnsp=这里是DNS1

dnss=这里是DNS2

hostip=这里填登陆学校Dr.com的服务器IP 不是windows系统中的1.1.1.1而是192.168.6.241

配置好后就可以了，打开GUI填好帐号密码登录就好。

---------------------------------------------------------------------------------------------------------------------------

Edit 2010-3-15

鉴于有读者在本文下面的评论中表示很需要kmod下的drcom.c文件， 我现在把它贴在下面，在此感谢为我们修改这份代码的朋友。

请把文件取名为drcom.c，并放在kmod文件下。

/*drcom.c*/
/*
* (C) 2008 Zeng Zhaorong
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 as
* published by the Free Software Foundation.
*/
/*
* Derived from linux netfilter conntrack codes
*/
#ifndef LINUX_VERSION_CODE
#include <linux/version.h>
#endif
#include <linux/module.h>
#include <linux/kmod.h>
#include <linux/sched.h>
#include <linux/kernel.h>
#include <linux/netdevice.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/tcp.h>
#include <net/ip.h>
#include <net/tcp.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,25)
#define nf_proto_csum_replace4	inet_proto_csum_replace4
#define NF_IP_PRE_ROUTING	NF_INET_PRE_ROUTING
#define NF_IP_POST_ROUTING	NF_INET_POST_ROUTING
#endif
#include "daemon_kernel.h"
#define TCPTRACK_VERSION "0.0.1"
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Wheelz");
MODULE_DESCRIPTION("Drcom-Kernel " TCPTRACK_VERSION);
enum tcp_state {
TCP_STATE_NONE = 0,
TCP_STATE_SYN_SENT,
TCP_STATE_SYN_RECV,
TCP_STATE_ESTABLISHED,
TCP_STATE_FIN_WAIT,
TCP_STATE_TIME_WAIT,
TCP_STATE_CLOSE,
TCP_STATE_CLOSE_WAIT,
TCP_STATE_LAST_ACK,
TCP_STATE_LISTEN,
TCP_STATE_MAX
};
#define SECS *HZ
#define MINS * 60 SECS
#define HOURS * 60 MINS
#define DAYS * 24 HOURS
static unsigned long tcp_timeouts[]
= { 30 MINS,    /*      TCP_STATE_NONE, */
2 MINS,     /*      TCP_STATE_SYN_SENT,     */
60 SECS,    /*      TCP_STATE_SYN_RECV,     */
5 DAYS,     /*      TCP_STATE_ESTABLISHED,  */
2 MINS,     /*      TCP_STATE_FIN_WAIT,     */
2 MINS,     /*      TCP_STATE_TIME_WAIT,    */
10 SECS,    /*      TCP_STATE_CLOSE,	*/
60 SECS,    /*      TCP_STATE_CLOSE_WAIT,   */
30 SECS,    /*      TCP_STATE_LAST_ACK,     */
2 MINS,     /*      TCP_STATE_LISTEN,       */
};
#define sNO TCP_STATE_NONE
#define sES TCP_STATE_ESTABLISHED
#define sSS TCP_STATE_SYN_SENT
#define sSR TCP_STATE_SYN_RECV
#define sFW TCP_STATE_FIN_WAIT
#define sTW TCP_STATE_TIME_WAIT
#define sCL TCP_STATE_CLOSE
#define sCW TCP_STATE_CLOSE_WAIT
#define sLA TCP_STATE_LAST_ACK
#define sLI TCP_STATE_LISTEN
#define sIV TCP_STATE_MAX
static enum tcp_state tcp_states[2][5][TCP_STATE_MAX] = {
{
/*      ORIGINAL */
/*	sNO, sSS, sSR, sES, sFW, sTW, sCL, sCW, sLA, sLI      */
/*syn*/ {sSS, sSS, sSR, sES, sSS, sSS, sSS, sSS, sSS, sLI },
/*fin*/ {sTW, sSS, sTW, sFW, sFW, sTW, sCL, sTW, sLA, sLI },
/*ack*/ {sES, sSS, sES, sES, sFW, sTW, sCL, sCW, sLA, sES },
/*rst*/ {sCL, sSS, sCL, sCL, sCL, sTW, sCL, sCL, sCL, sCL },
/*none*/{sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
},
{
/*      REPLY */
/*	sNO, sSS, sSR, sES, sFW, sTW, sCL, sCW, sLA, sLI      */
/*syn*/ {sSR, sSR, sSR, sES, sSR, sSR, sSR, sSR, sSR, sSR },
/*fin*/ {sCL, sSS, sTW, sCW, sTW, sTW, sCL, sCW, sLA, sLI },
/*ack*/ {sCL, sSS, sSR, sES, sFW, sTW, sCL, sCW, sCL, sLI },
/*rst*/ {sCL, sCL, sCL, sCL, sCL, sCL, sCL, sCL, sLA, sLI },
/*none*/{sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV, sIV }
}
};
struct tcp_tuple
{
__be32	src_ip;
__be32	dst_ip;
__be16	src_port;
__be16	dst_port;
u_int8_t	dir;
};
struct tcp_tuplehash
{
struct list_head 	list;
struct tcp_tuple	tuple;
};
struct tcp_seq
{
u_int32_t	syn_seq;
u_int32_t	correction_pos;
int16_t 	offset_before, offset_after;
};
struct tcp_conn
{
struct tcp_tuplehash	tuplehash[2];
atomic_t 		ref;
struct timer_list	timeout;
u_int8_t		flags;
enum tcp_state		state;
struct tcp_seq		seq[2];
};
#define CONN_F_NEW	0x01
#define CONN_F_AUTHSENT	0x02
#define TODO_NONE	0x00
#define TODO_ADJUST_SEQ	0x01
#define TODO_SEND_ACK	0x02
#define TODO_SEND_AUTH	0x04
#define CONN_DIR_ORIG	0
#define CONN_DIR_REPLY	1
#define TCP_CONN_HASH_SIZE	32
static pid_t	conn_pid = 0;
static int	conn_autologout = 0;
static struct timer_list conn_keepalive_timer;
static unsigned char conn_auth_data[CONN_AUTH_DATA_LEN];
static struct list_head		tcp_conn_hash[TCP_CONN_HASH_SIZE];
static atomic_t	tcp_conn_count = ATOMIC_INIT(0);
static struct net_device 	*track_dev = NULL;
static struct e_address		*conn_e_addr = NULL;
static int conn_e_count = 0;
static int track_mode = CONN_MODE_NONE;
static DEFINE_RWLOCK(mode_lock);
static DEFINE_RWLOCK(hash_lock);
static DEFINE_RWLOCK(state_lock);
#if 0
#define DEBUGP printk
#else
#define DEBUGP(format, args...)
#endif
#if 0
static const char *tcp_state_names[] = {
"NONE",
"SYN_SENT",
"SYN_RECV",
"ESTABLISHED",
"FIN_WAIT",
"TIME_WAIT",
"CLOSE",
"CLOSE_WAIT",
"LAST_ACK",
"LISTEN"
};
#endif
static inline int tuple_equal(struct tcp_tuple *t1, struct tcp_tuple *t2)
{
return (t1->src_ip == t2->src_ip && t1->dst_ip == t2->dst_ip
&& t1->src_port == t2->src_port && t1->dst_port == t2->dst_port);
}
static inline u_int32_t hash_conn(const struct tcp_tuple *tuple)
{
return (ntohl(tuple->src_ip + tuple->dst_ip + tuple->src_port + tuple->dst_port)
+ ntohs(tuple->src_port)) % TCP_CONN_HASH_SIZE;
}
static inline struct tcp_conn *tuplehash_to_conn(const struct tcp_tuplehash *hash)
{
return container_of(hash, struct tcp_conn, tuplehash[hash->tuple.dir]);
}
static inline void conn_get(struct tcp_conn *conn)
{
if (conn)
atomic_inc(&conn->ref);
}
static inline void conn_put(struct tcp_conn *conn)
{
if (conn && atomic_dec_and_test(&conn->ref)) {
kfree(conn);
atomic_dec(&tcp_conn_count);
}
}
/* under state_lock */
static void __conn_refresh_timer(struct tcp_conn *conn, unsigned long timeout)
{
unsigned long newtime;
if (conn->flags & CONN_F_NEW) {
conn->flags &= ~CONN_F_NEW;
conn->timeout.expires = jiffies + timeout;
add_timer(&conn->timeout);
} else {
newtime = jiffies + timeout;
if (newtime - conn->timeout.expires >= HZ && del_timer(&conn->timeout)) {
conn->timeout.expires = newtime;
add_timer(&conn->timeout);
}
}
}
static void death_by_timeout(unsigned long ul_conn)
{
struct tcp_conn *conn = (struct tcp_conn*)ul_conn;
write_lock_bh(&hash_lock);
list_del(&conn->tuplehash[CONN_DIR_ORIG].list);
list_del(&conn->tuplehash[CONN_DIR_REPLY].list);
write_unlock_bh(&hash_lock);
conn_put(conn);
}
static void conn_tuple_init(struct tcp_conn *conn, struct tcp_tuple *tuple)
{
struct tcp_tuple *t;
t = &conn->tuplehash[CONN_DIR_ORIG].tuple;
t->src_ip = tuple->src_ip;
t->dst_ip = tuple->dst_ip;
t->src_port = tuple->src_port;
t->dst_port = tuple->dst_port;
t->dir = CONN_DIR_ORIG;

t = &conn->tuplehash[CONN_DIR_REPLY].tuple;
t->src_ip = tuple->dst_ip;
t->dst_ip = tuple->src_ip;
t->src_port = tuple->dst_port;
t->dst_port = tuple->src_port;
t->dir = CONN_DIR_REPLY;
}
static inline struct tcp_conn *get_new_conn(struct tcp_tuple *tuple)
{
struct tcp_conn *conn;
conn = kmalloc(sizeof(struct tcp_conn), GFP_ATOMIC);
if (conn == NULL)
return NULL;
memset(conn, 0, sizeof(struct tcp_conn));
conn->flags = CONN_F_NEW;
conn_tuple_init(conn, tuple);
setup_timer(&conn->timeout, death_by_timeout, (unsigned long)conn);
return conn;
}
static int is_syn_pkt(struct sk_buff *skb)
{
unsigned int nhoff = skb_network_offset(skb);
struct iphdr *iph, _iph;
struct tcphdr *tcph, _tcph;
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
if (iph == NULL)
return 0;
tcph = skb_header_pointer(skb, nhoff + (iph->ihl << 2), sizeof(_tcph), &_tcph);
if (tcph == NULL)
return 0;
return (tcph->syn && !tcph->ack);
}
static int tcp_get_tuple(struct sk_buff *skb, struct tcp_tuple *tuple)
{
struct iphdr _iph, *iph;
struct tcphdr _hdr, *hp;
unsigned int nhoff = skb_network_offset(skb);
unsigned int thoff;
memset(tuple, 0, sizeof(struct tcp_tuple));
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
if (iph == NULL)
return 0;
tuple->src_ip = iph->saddr;
tuple->dst_ip = iph->daddr;
thoff = nhoff + (iph->ihl << 2);
hp = skb_header_pointer(skb, thoff, 8, &_hdr);
if (hp == NULL)
return 0;
tuple->src_port = hp->source;
tuple->dst_port = hp->dest;
return 1;
}
static inline void __add_new_hash(struct tcp_tuplehash *hash)
{
u_int32_t h = hash_conn(&hash->tuple);
struct list_head *head = &tcp_conn_hash[h];
list_add_tail(&hash->list, head);
}
static struct tcp_tuplehash *__hash_find(struct tcp_tuple *tuple)
{
struct tcp_tuplehash *tuplehash;
struct list_head *head, *pos;
u_int32_t h;
h = hash_conn(tuple);
head = &tcp_conn_hash[h];
list_for_each(pos, head) {
tuplehash = list_entry(pos, struct tcp_tuplehash, list);
if (tuple_equal(&tuplehash->tuple, tuple))
return tuplehash;
}
return NULL;
}
static struct tcp_tuplehash *resolve_tcp_conn(struct sk_buff *skb)
{
struct tcp_tuple tuple;
struct tcp_conn *conn;
struct tcp_tuplehash *hash;
if (!tcp_get_tuple(skb, &tuple))
return NULL;
read_lock_bh(&hash_lock);
hash = __hash_find(&tuple);
if (hash != NULL) {
conn = tuplehash_to_conn(hash);
conn_get(conn);
read_unlock_bh(&hash_lock);
return hash;
}
read_unlock_bh(&hash_lock);
/* OK, This is a new connection, let's create a conn */
/* the first packet must be SYN && !ACK */
if (!is_syn_pkt(skb))
return NULL;
conn = get_new_conn(&tuple);
if (conn == NULL)
return NULL;
conn_get(conn);/* for this packet */
conn_get(conn);/* for hash list */
write_lock_bh(&hash_lock);
hash = __hash_find(&tuple);
if (hash != NULL) { /* already added by someone else, but is it possible?  */
struct tcp_conn *conn2 = tuplehash_to_conn(hash);
conn_get(conn2);
write_unlock_bh(&hash_lock);
conn_put(conn); /* for hash list */
conn_put(conn); /* for this packet */
return hash;
}
__add_new_hash(&conn->tuplehash[CONN_DIR_ORIG]);
__add_new_hash(&conn->tuplehash[CONN_DIR_REPLY]);

write_unlock_bh(&hash_lock);
atomic_inc(&tcp_conn_count);
hash = &conn->tuplehash[CONN_DIR_ORIG];
return hash;
}
static void sack_adjust(struct sk_buff *skb, struct tcphdr *tcph,
unsigned int sackoff, unsigned int sackend, struct tcp_seq *seq)
{
while (sackoff < sackend) {
struct tcp_sack_block_wire *sack;
__be32 new_start_seq, new_end_seq;
sack = (void *)skb->data + sackoff;
if (after(ntohl(sack->start_seq) - seq->offset_before, seq->correction_pos))
new_start_seq = htonl(ntohl(sack->start_seq) - seq->offset_after);
else
new_start_seq = htonl(ntohl(sack->start_seq) - seq->offset_before);
if (after(ntohl(sack->end_seq) - seq->offset_before, seq->correction_pos))
new_end_seq = htonl(ntohl(sack->end_seq) - seq->offset_after);
else
new_end_seq = htonl(ntohl(sack->end_seq) - seq->offset_before);
DEBUGP("sack_adjust: start_seq: %d->%d, end_seq: %d->%d/n",
ntohl(sack->start_seq), ntohl(new_start_seq), ntohl(sack->end_seq), ntohl(new_end_seq));
nf_proto_csum_replace4(&tcph->check, skb, sack->start_seq, new_start_seq, 0);
nf_proto_csum_replace4(&tcph->check, skb, sack->end_seq, new_end_seq, 0);
sack->start_seq = new_start_seq;
sack->end_seq = new_end_seq;
sackoff += sizeof(*sack);
}
}
static int tcp_sack_adjust(struct tcp_conn *conn, int dir, struct sk_buff *skb, struct tcphdr *tcph)
{
unsigned int optoff, optend;
optoff = ip_hdrlen(skb) + sizeof(struct tcphdr);
optend = ip_hdrlen(skb) + tcph->doff * 4;
if (!skb_make_writable(skb, optend))
return 0;
while (optoff < optend) {
/* Usually: option, length. */
unsigned char *op = skb->data + optoff;
switch (op[0]) {
case TCPOPT_EOL:
return 1;
case TCPOPT_NOP:
optoff++;
continue;
default:
/* no partial options */
if (optoff + 1 == optend || optoff + op[1] > optend || op[1] < 2)
return 0;
if (op[0] == TCPOPT_SACK && op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
sack_adjust(skb, tcph, optoff+2, optoff+op[1], &conn->seq[!dir]);
optoff += op[1];
}
}
return 1;
}
static int tcp_adjust_seq(struct sk_buff *skb, struct tcp_tuplehash *hash)
{
struct tcp_conn *conn = tuplehash_to_conn(hash);
int dir = hash->tuple.dir;
struct tcphdr *tcph;
__be32 newseq, newack;
struct tcp_seq *this_way, *other_way;
int ret = 0;
read_lock_bh(&state_lock);
this_way = &conn->seq[dir];
other_way = &conn->seq[!dir];
if (!skb_make_writable(skb, ip_hdrlen(skb) + sizeof(*tcph)))
goto out;
tcph = (void *)skb->data + ip_hdrlen(skb);
if (after(ntohl(tcph->seq), this_way->correction_pos))
newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
else
newseq = htonl(ntohl(tcph->seq) + this_way->offset_before);
if (after(ntohl(tcph->ack_seq) - other_way->offset_before, other_way->correction_pos))
newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after);
else
newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
if (newseq != tcph->seq) {
nf_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
tcph->seq = newseq;
}
if (newack != tcph->ack_seq) {
nf_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
tcph->ack_seq = newack;
if (!tcp_sack_adjust(conn, dir, skb, tcph))
goto out;
}
ret = 1;
out:
read_unlock_bh(&state_lock);
return ret;
}
static unsigned int get_state_index(const struct tcphdr *tcph)
{
if (tcph->rst) {return 3;}
else if (tcph->syn) {return 0;}
else if (tcph->fin) {return 1;}
else if (tcph->ack) {return 2;}
else {return 4;}
}
/* return what to do */
static unsigned int check_tcp_packet(struct sk_buff *skb, struct tcp_tuplehash *hash)
{
enum tcp_state newstate, oldtcpstate;
struct tcp_conn *conn = tuplehash_to_conn(hash);
int dir = hash->tuple.dir;
unsigned int nhoff = skb_network_offset(skb);
struct iphdr *iph, _iph;
struct tcphdr *tcph, _tcph;
unsigned int hdrlen;
struct tcp_seq *seq;
u_int8_t todo = TODO_NONE;
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
if (iph == NULL)
return TODO_NONE;
tcph = skb_header_pointer(skb, nhoff + (iph->ihl << 2), sizeof(_tcph), &_tcph);
if (tcph == NULL)
return TODO_NONE;
hdrlen = (iph->ihl + tcph->doff)*4;
if (skb->len < hdrlen) {/* we may not have the options */
DEBUGP("tcp_packet: Truncated packet./n");
return TODO_NONE;
}
write_lock_bh(&state_lock);
oldtcpstate = conn->state;
newstate = tcp_states[dir][get_state_index(tcph)][oldtcpstate];
if (newstate == TCP_STATE_MAX) { /* invalid */
DEBUGP("tcp_packet: Invalid dir=%i index=%u state=%s/n",
dir, get_state_index(tcph), tcp_state_names[conn->state]);
write_unlock_bh(&state_lock);
return TODO_NONE;
}
conn->state = newstate;
if (conn->flags & CONN_F_AUTHSENT) {
todo = TODO_ADJUST_SEQ;
goto out;
}
/* Handshake SYN */
if (oldtcpstate == TCP_STATE_NONE && dir == CONN_DIR_ORIG && tcph->syn && !tcph->ack) {
seq = &conn->seq[dir];
seq->syn_seq = ntohl(tcph->seq);
seq->correction_pos = seq->syn_seq;
seq->offset_before = 0;
seq->offset_after = CONN_AUTH_DATA_LEN;
todo = TODO_NONE;
goto out;
}
/* Handshake SYN-ACK */
if (oldtcpstate == TCP_STATE_SYN_SENT && dir == CONN_DIR_REPLY && tcph->syn && tcph->ack) {
seq = &conn->seq[dir];
seq->syn_seq = ntohl(tcph->seq);
seq->correction_pos = seq->syn_seq;
seq->offset_before = 0;
seq->offset_after = 0;
todo = TODO_NONE;
goto out;
}
/* Handshake pure ACK: we don't care this case actually */
/*
if (oldtcpstate == TCP_STATE_SYN_RECV && skb->len == hdrlen && dir == CONN_DIR_ORIG
&& tcph->ack && !tcph->syn && ntohl(tcph->ack_seq) == conn->seq[!dir].syn_seq+1)
{
todo = TODO_NONE;
goto out;
}
*/
/* Handshake ACK with data*/
if (oldtcpstate == TCP_STATE_SYN_RECV && skb->len > hdrlen && dir == CONN_DIR_ORIG
&& tcph->ack && !tcph->syn
&& (ntohl(tcph->ack_seq) == conn->seq[!dir].syn_seq+1)
&& (ntohl(tcph->seq) == conn->seq[dir].syn_seq+1)
&& !(conn->flags & CONN_F_AUTHSENT))
{
todo = TODO_SEND_ACK | TODO_SEND_AUTH | TODO_ADJUST_SEQ;
conn->flags |= CONN_F_AUTHSENT;
goto out;
}
/* The first data packet */
if (oldtcpstate == TCP_STATE_ESTABLISHED && skb->len > hdrlen && dir == CONN_DIR_ORIG
&& tcph->ack && !tcph->syn
/*    && (ntohl(tcph->ack_seq) == conn->seq[!dir].syn_seq+1) *//* ftp server will send first */
&& (ntohl(tcph->seq) == conn->seq[dir].syn_seq+1)
&& !(conn->flags & CONN_F_AUTHSENT))
{
todo = TODO_SEND_AUTH | TODO_ADJUST_SEQ;
conn->flags |= CONN_F_AUTHSENT;
goto out;
}
/*
* CONN_F_AUTHSENT not set,
* and not the case to set CONN_F_AUTHSENT,
* just bypass
*/
todo = TODO_NONE;
out:
__conn_refresh_timer(conn, tcp_timeouts[newstate]);
write_unlock_bh(&state_lock);
return todo;
}
static struct sk_buff *build_ack_skb(struct sk_buff *oskb)
{
struct iphdr *iph;
struct tcphdr *tcph;
struct sk_buff *skb;
/* FIXME: Can we avoid the copy here? */
skb = skb_copy(oskb, GFP_ATOMIC);
if (skb == NULL)
return NULL;
iph = ip_hdr(skb);
tcph = (void *)skb->data + ip_hdrlen(skb);
skb_trim(skb, (iph->ihl + tcph->doff) * 4);
skb_shinfo(skb)->gso_segs = 1;
skb_shinfo(skb)->gso_size = 0;
skb_shinfo(skb)->gso_type = 0;
skb->ip_summed = CHECKSUM_NONE;
skb->csum = 0;
tcph->check = 0;
tcph->check = tcp_v4_check(tcph->doff << 2, iph->saddr, iph->daddr,
csum_partial((char *)tcph, tcph->doff << 2, skb->csum));
iph->tot_len = htons(skb->len);
__ip_select_ident(iph, skb_dst(skb), 0);
ip_send_check(iph);
return skb;
}
static struct sk_buff *build_auth_skb(struct sk_buff *oskb)
{
struct iphdr *iph;
struct tcphdr *tcph;
unsigned int hdrlen;
struct sk_buff *skb;
/* FIXME: Can we avoid the copy here? */
skb = skb_copy_expand(oskb, skb_headroom(oskb), CONN_AUTH_DATA_LEN, GFP_ATOMIC);
if (skb == NULL)
return NULL;
iph = ip_hdr(skb);
tcph = (void *)skb->data + ip_hdrlen(skb);
hdrlen = (iph->ihl + tcph->doff) * 4;
skb_trim(skb, hdrlen);
skb_put(skb, CONN_AUTH_DATA_LEN);
memcpy(skb->data + hdrlen, conn_auth_data, CONN_AUTH_DATA_LEN);
skb_shinfo(skb)->gso_segs = 1;
skb_shinfo(skb)->gso_size = 0;
skb_shinfo(skb)->gso_type = 0;
skb->ip_summed = CHECKSUM_NONE;
skb->csum = 0;
tcph->check = 0;
tcph->check = tcp_v4_check(skb->len-ip_hdrlen(skb), iph->saddr, iph->daddr,
csum_partial((char *)tcph, skb->len-ip_hdrlen(skb), skb->csum));
iph->tot_len = htons(skb->len);
__ip_select_ident(iph, skb_dst(skb), 0);
ip_send_check(iph);
return skb;
}
static inline int is_our_packet(struct sk_buff *skb)
{
struct iphdr *iph = ip_hdr(skb);
return (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP);
}
static inline int is_udp_packet(struct sk_buff *skb)
{
struct iphdr *iph = ip_hdr(skb);
return (iph->protocol == IPPROTO_UDP);
}
static void conn_do_udp(struct sk_buff *oskb, int (*okfn)(struct sk_buff *))
{
struct sk_buff *skb;
struct iphdr *iph;
struct udphdr *udph;
unsigned short len;
/* FIXME: Can we avoid the copy here? */
skb = skb_copy_expand(oskb, skb_headroom(oskb) + CONN_AUTH_DATA_LEN, 0, GFP_ATOMIC);
if (skb == NULL)
return;
kfree_skb(oskb);
iph = ip_hdr(skb);
udph = (void *)iph + ip_hdrlen(skb);
memcpy((void *)iph-CONN_AUTH_DATA_LEN, (void*)iph, ip_hdrlen(skb)+8);
memcpy((void*)udph+8-CONN_AUTH_DATA_LEN, conn_auth_data, CONN_AUTH_DATA_LEN);
skb_push(skb, CONN_AUTH_DATA_LEN);
skb_reset_network_header(skb);
iph = ip_hdr(skb);
udph = (void *)iph + ip_hdrlen(skb);
skb_shinfo(skb)->gso_segs = 1;
skb_shinfo(skb)->gso_size = 0;
skb_shinfo(skb)->gso_type = 0;
skb->ip_summed = CHECKSUM_NONE;
skb->csum = 0;
len = ntohs(udph->len) + CONN_AUTH_DATA_LEN;
udph->len = htons(len);
udph->check = 0;
udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr, len, IPPROTO_UDP,
csum_partial((unsigned char *)udph, len, 0));
/* ip stuff */
iph->tot_len = htons(skb->len);
ip_send_check(iph);
okfn(skb);
}
static int need_auth_input(struct sk_buff *skb)
{
u_int32_t saddr = ip_hdr(skb)->saddr;
int i;
for (i=0; i<conn_e_count; i++)
if ((conn_e_addr[i].mask & saddr) == conn_e_addr[i].addr)
return 0;
return 1;
}
static int need_auth_output(struct sk_buff *skb)
{
u_int32_t daddr = ip_hdr(skb)->daddr;
int i;
for (i=0; i<conn_e_count; i++)
if ((conn_e_addr[i].mask & daddr) == conn_e_addr[i].addr)
return 0;
return 1;
}
#define CONN_KEEPALIVE_TIMEOUT	(2*60*HZ)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2,6,27)
#define kill_proc(pid, sig, priv)	kill_pid(find_vpid(pid), sig, priv)
#endif
static void keepalive_func(unsigned long ul)
{
read_lock_bh(&mode_lock);
if (track_mode != CONN_MODE_NONE && conn_autologout && conn_pid)
kill_proc(conn_pid, SIGUSR1, 1);
read_unlock_bh(&mode_lock);
}
static void init_keepalive_timer(void)
{
read_lock_bh(&mode_lock);
if (track_mode != CONN_MODE_NONE && conn_autologout) {
setup_timer(&conn_keepalive_timer, keepalive_func, 0);
conn_keepalive_timer.expires = jiffies+CONN_KEEPALIVE_TIMEOUT;
add_timer(&conn_keepalive_timer);
}
read_unlock_bh(&mode_lock);
}
/* under mode_lock */
static void __refresh_keepalive_timer(void)
{
if (conn_autologout)
mod_timer(&conn_keepalive_timer, jiffies+CONN_KEEPALIVE_TIMEOUT);
}
static void del_keepalive_timer(void)
{
read_lock_bh(&mode_lock);
del_timer(&conn_keepalive_timer);
read_unlock_bh(&mode_lock);
}
static unsigned int preroute_hook(unsigned int hooknum,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct tcp_tuplehash *hash;
unsigned int todo;
read_lock_bh(&mode_lock);
if (track_mode == CONN_MODE_NONE)
goto out_unlock;
if (in != track_dev || !is_our_packet(skb))
goto out_unlock;
if (!need_auth_input(skb))
goto out_unlock;
__refresh_keepalive_timer();
if (is_udp_packet(skb)) {
/*
* we need do nothing here
*/
read_unlock_bh(&mode_lock);
return NF_ACCEPT;
}
hash = resolve_tcp_conn(skb);
if (hash == NULL)
goto out_unlock;
todo = check_tcp_packet(skb, hash);
if (todo & TODO_ADJUST_SEQ)
(void)tcp_adjust_seq(skb, hash);
conn_put(tuplehash_to_conn(hash));
out_unlock:
read_unlock_bh(&mode_lock);
return NF_ACCEPT;
}
static unsigned int postroute_hook(unsigned int hooknum,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct tcp_tuplehash *hash;
unsigned int todo;
struct sk_buff *skb2;
read_lock_bh(&mode_lock);
if (track_mode == CONN_MODE_NONE)
goto out_unlock;
if (out != track_dev || !is_our_packet(skb))
goto out_unlock;
if (!need_auth_output(skb))
goto out_unlock;
__refresh_keepalive_timer();
if (is_udp_packet(skb)) {
conn_do_udp(skb, okfn);
read_unlock_bh(&mode_lock);
return NF_STOLEN;
}
hash = resolve_tcp_conn(skb);
if (hash == NULL)
goto out_unlock;
todo = check_tcp_packet(skb, hash);
if (todo & TODO_SEND_ACK) {
skb2 = build_ack_skb(skb);
if (skb2 != NULL)
okfn(skb2);
}
if (todo & TODO_SEND_AUTH) {
skb2 = build_auth_skb(skb);
if (skb2 != NULL)
okfn(skb2);
}
if (todo & TODO_ADJUST_SEQ)
(void)tcp_adjust_seq(skb, hash);
conn_put(tuplehash_to_conn(hash));
out_unlock:
read_unlock_bh(&mode_lock);
return NF_ACCEPT;
}
static struct nf_hook_ops preroute_hook_ops = {
.hook = preroute_hook,
.owner = THIS_MODULE,
.pf = PF_INET,
.hooknum = NF_IP_PRE_ROUTING,
.priority = NF_IP_PRI_CONNTRACK_DEFRAG+1,
};
static struct nf_hook_ops postroute_hook_ops = {
.hook = postroute_hook,
.owner = THIS_MODULE,
.pf = PF_INET,
.hooknum = NF_IP_POST_ROUTING,
.priority = NF_IP_PRI_LAST,
};
static void conn_hash_cleanup(void)
{
struct tcp_conn *conn;
struct tcp_tuplehash *h;
int i;
/* free tcp_conn hash memory */
i_see_dead_people:
while (1) {
conn = NULL;
write_lock_bh(&hash_lock);
for (i=0; i<TCP_CONN_HASH_SIZE; i++) {
struct list_head *head = &tcp_conn_hash[i];
if (!list_empty(head)){
h = list_entry(head->next, struct tcp_tuplehash, list);
conn = tuplehash_to_conn(h);
conn_get(conn);
break;
}
}
write_unlock_bh(&hash_lock);
if (conn == NULL)
break;
if (del_timer(&conn->timeout)) {
death_by_timeout((unsigned long)conn);
conn_put(conn);
}
}
while (atomic_read(&tcp_conn_count) != 0) {
schedule();
goto i_see_dead_people;
}
}
static int conn_hooks_init(void)
{
int ret;
ret = nf_register_hook(&preroute_hook_ops);
if(ret < 0){
printk(KERN_ERR "PRE-ROUTE hook register failed/n");
goto out_err;
}
ret = nf_register_hook(&postroute_hook_ops);
if(ret < 0){
printk(KERN_ERR "POST-ROUTE hook register failed/n");
goto out_unregister_1;
}
return 0;
out_unregister_1:
nf_unregister_hook(&preroute_hook_ops);
out_err:
return ret;
}
static void conn_hooks_cleanup(void)
{
nf_unregister_hook(&postroute_hook_ops);
nf_unregister_hook(&preroute_hook_ops);
synchronize_net();
}
static int conn_set_params(struct sock *sk, int optname, void *optval, unsigned int optlen)
{
struct conn_param cp;
struct net_device *dev, *tmp_dev = NULL;
struct e_address *e_addr=NULL, *tmp_addr;
unsigned int e_len;
int i;
if (optlen < sizeof(struct conn_param))
return -EINVAL;
if (copy_from_user(&cp, optval, sizeof(struct conn_param)))
return -EFAULT;
if (cp.e_count < 0)
return -EINVAL;
if (cp.e_count > 0) {
e_len = cp.e_count * sizeof(struct e_address);
if (optlen < sizeof(struct conn_param) + e_len)
return -EINVAL;
e_addr = kmalloc(e_len, GFP_KERNEL);
if (e_addr == NULL)
return -ENOMEM;
if (copy_from_user(e_addr, optval+sizeof(struct conn_param), e_len)) {
kfree(e_addr);
return -EFAULT;
}
}
dev = dev_get_by_name(&init_net, cp.devname);
if (dev == NULL) {
if (e_addr)
kfree(e_addr);
return -ENODEV;
}
write_lock_bh(&mode_lock);
tmp_addr = conn_e_addr;
conn_e_count = cp.e_count;
if (conn_e_count != 0) {
conn_e_addr = e_addr;
for(i=0; i<conn_e_count; i++)
conn_e_addr[i].addr &= conn_e_addr[i].mask;
}
tmp_dev = track_dev;
track_dev = dev;
write_unlock_bh(&mode_lock);
if (tmp_addr)
kfree(tmp_addr);
if (tmp_dev)
dev_put(tmp_dev);
return 0;
}
static int conn_set_auth_cmd(struct sock *sk, int optname, void *optval, unsigned int optlen)
{
struct conn_auth_cmd cmd;
int hash_todo = 0;
if (optlen < sizeof(struct conn_auth_cmd))
return -EINVAL;
if (copy_from_user(&cmd, optval, sizeof(struct conn_auth_cmd)))
return -EFAULT;
rtnl_lock();
write_lock_bh(&mode_lock);
if (track_mode == CONN_MODE_NONE && cmd.cmd == CONN_MODE_AUTH) {
track_mode = cmd.cmd;
conn_pid = cmd.pid;
conn_autologout = cmd.autologout;
memcpy(conn_auth_data, cmd.auth_data, CONN_AUTH_DATA_LEN);
hash_todo = 1; /* conn_hooks_init() */
} else if (track_mode == CONN_MODE_AUTH && cmd.cmd == CONN_MODE_NONE) {
track_mode = cmd.cmd;
conn_pid = 0;
conn_autologout = 0;
memset(conn_auth_data, 0, CONN_AUTH_DATA_LEN);
hash_todo = 2; /* conn_hooks_cleanup */
} else {
DEBUGP("Same Auth Cmd/n");
}
write_unlock_bh(&mode_lock);
if (hash_todo == 1) {
init_keepalive_timer();
conn_hooks_init();
printk(KERN_INFO "Drcom-Kernel: Authentication Started./n");
} else if (hash_todo == 2) {
del_keepalive_timer();
conn_hooks_cleanup();
conn_hash_cleanup();
printk(KERN_INFO "Drcom-Kernel: Authentication Stopped./n");
}
rtnl_unlock();
return 0;
}
static int conn_set_sockopt(struct sock *sk, int optname, void *optval, unsigned int optlen)
{
switch (optname) {
case CONN_SO_SET_PARAMS: /* set addresses of no need to auth */
return conn_set_params(sk, optname, optval, optlen);
case CONN_SO_SET_AUTH_CMD: /* set auth data, and start auth */
return conn_set_auth_cmd(sk, optname, optval, optlen);
default:
return -ENOPROTOOPT;
}
return -ENOPROTOOPT;
}
static struct nf_sockopt_ops conn_so_ops = {
.pf	     = PF_INET,
.set_optmin     = CONN_SO_BASE_CTL,
.set_optmax     = CONN_SO_SET_MAX+1,
.set	    = &conn_set_sockopt,
.owner	  = THIS_MODULE,
};
static int __init init(void)
{
int ret;
int i;
for (i=0; i<TCP_CONN_HASH_SIZE; i++)
INIT_LIST_HEAD(&tcp_conn_hash[i]);
ret = nf_register_sockopt(&conn_so_ops);
if(ret != 0)
return ret;
printk(KERN_INFO "Drcom-Kernel " TCPTRACK_VERSION " module loaded/n");
return ret;
}
static void __exit fini(void)
{
int do_dirty_work=0;
nf_unregister_sockopt(&conn_so_ops);
rtnl_lock();
write_lock_bh(&mode_lock);
if (track_mode == CONN_MODE_AUTH)
do_dirty_work = 1;
track_mode = CONN_MODE_NONE;
write_unlock_bh(&mode_lock);
if (do_dirty_work) {
conn_hooks_cleanup();
conn_hash_cleanup();
}
rtnl_unlock();
if (conn_e_addr)
kfree(conn_e_addr);
if (track_dev)
dev_put(track_dev);
printk(KERN_INFO "Drcom-Kernel " TCPTRACK_VERSION " module unloaded/n");
}
module_init(init);
module_exit(fini);