
平臺(tái) 論壇博客文庫

› 論壇 › 程序設(shè)計(jì) › 內(nèi)核源碼 › netfilter 求救

[內(nèi)核模塊] netfilter 求救 [復(fù)制鏈接]

jewson

白手起家

論壇徽章:: 0

電梯直達(dá)

1樓 [收藏(0)] [報(bào)告]

發(fā)表于 2014-08-21 11:11 |只看該作者 |倒序?yàn)g覽

大家好，小弟最近學(xué)習(xí)netfilter遇到問題，希望CU的兄弟可以幫到我，先謝謝大家了。
先貼代碼，原文可以在：http://hi.baidu.com/widebright/item/0c6c94b44e749c9619469784 看到
下面的代碼僅僅在原文進(jìn)行修改測試。
運(yùn)行測試環(huán)境:rehl5.4 虛擬機(jī) 內(nèi)核2.6.32

/*
* widebright.c
*
* Created on: 2009-10-13
* Author: widebright
*/
#include <linux/module.h>
#include <linux/moduleparam.h>
#include <linux/kernel.h>
#include <linux/skbuff.h>
#include <linux/ip.h>
#include <linux/tcp.h>
#include <net/tcp.h>
#include <net/udp.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <net/sock.h>
#include <net/netfilter/nf_nat.h>
#include <net/netfilter/nf_nat_helper.h>
#include <net/netfilter/nf_nat_rule.h>
#include <net/netfilter/nf_conntrack.h>
#include <net/netfilter/nf_conntrack_helper.h>
#include <net/netfilter/nf_conntrack_expect.h>
MODULE_LICENSE("GPL"); //用了nf_conntrack_tcp_update 函數(shù)要用這個(gè)遵守GPL開放協(xié)議才能編譯通
typedef unsigned int uint32;
typedef unsigned char uchar8;
typedef struct app_detection_module_struct {
uint32 sport;
uint32 dport;
uint32 saddr;
uint32 daddr;
uint32 plen;//the len not include ip header and (tcp/udp)header
uchar8* payload;//packet not include ip header and (tcp/udp)header
} APP_DATA;
static void hex_dump(const unsigned char *buf, size_t len) {
size_t i;
for (i = 0; i < len; i++) {
if (i && !(i % 16))
printk("\n");
printk("%02x ", *(buf + i));
}
printk("\n");
}
char * is_mp3_request(char * start) {
char data[4] = ".mp3";
char * i = start;
i += 4; //跳過 GET
while (*i != ' ' && *i != '\n')
i++; //查找網(wǎng)絡(luò)地址最后的位置
if (*(int *) (i - 4) == *(int *) data)
return i;
else
return NULL;
}
unsigned int check_link_address(unsigned int hooknum, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, int(*okfn)(
struct sk_buff *)) {
struct iphdr *iph = NULL;
struct tcphdr *tcph = NULL;
struct tcphdr *udph = NULL;
uint32 i = 0;
APP_DATA* app_data = NULL;
int oldlen, datalen;
struct rtable *rt = skb->rtable;
enum ip_conntrack_info ctinfo;
iph = ip_hdr(skb);
app_data = (APP_DATA* )kmalloc(sizeof(APP_DATA), GFP_ATOMIC);
if(app_data == NULL)
return NF_ACCEPT;
app_data->saddr = iph->saddr;
app_data->daddr = iph->daddr;
//Note that the connection tracking subsystem
//is invoked after the raw table has been processed, but before the mangle table.
//所以下面要指定.priority = NF_IP_PRI_MANGLE nf_ct_get 才會(huì)返回有效的值
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
if (iph->protocol == IPPROTO_TCP) {
tcph = (void *) iph + iph->ihl * 4;
app_data->sport = ntohs(tcph->source); //Src端口
app_data->dport = ntohs(tcph->dest); //Dest端口
app_data->payload = (char*)iph+(iph->ihl*4) + tcph->doff*4; //從data里面偏移出前面的ip包頭和tcp包頭
app_data->plen = ntohs(iph->tot_len)-(iph->ihl*4) - tcph->doff*4; //TCP包長度
if(ntohs(app_data->dport) == 80)
{
printk("src: %u.%u.%u.%u:%u <===> dst: %u.%u.%u.%u:%u \n",NIPQUAD(app_data->saddr),ntohs(app_data->sport),NIPQUAD(app_data->daddr),ntohs(app_data->dport));
return NF_ACCEPT;
}
// printk("tcp packet to : %u.%u.%u.%u:%u\n",NIPQUAD(daddr),ntohs(dport));
// printk("---------ip total len =%d--------\n", ntohs(iph->tot_len));
// printk("---------tcph->doff =%d--------\n", tcph->doff*4);
/* skb_linearize - convert paged skb to linear one
* If there is no free memory -ENOMEM is returned, otherwise zero
* is returned and the old skb data released.
＊這一步很關(guān)鍵，否則后面根據(jù) 包頭偏移計(jì)算出來payload 得到東西不是正確的包結(jié)構(gòu)
＊2.6內(nèi)核需要這么做。因?yàn)樾碌南到y(tǒng)可能為了提高性能，一個(gè)網(wǎng)絡(luò)包的內(nèi)容是分成幾個(gè) fragments來保存的
* 這時(shí) 單單根據(jù) skb->data得到的只是包的第一個(gè) fragments的東西。我見到我系統(tǒng)上的就是tcp頭部和 tcp的payload
* 是分開保存在不同的地方的。可能ip,tcp頭部等是后面系統(tǒng)層才加上的，和應(yīng)用程序的payload來源不一樣，使用不同的fragments就
* 可以避免復(fù)制數(shù)據(jù)到新緩沖區(qū)的操作提高性能。skb_shinfo(skb)->nr_frags 屬性指明了這個(gè)skb網(wǎng)絡(luò)包里面包含了多少塊 fragment了。
* 具體可以看《Linux Device Drivers, 3rd Editio》一書的17.5.3. Scatter/Gather I/O小節(jié)
* 《Understanding_Linux_Network_Internals》一書 Chapter 21. Internet Protocol Version 4 (IPv4): Transmission 一章有非常詳細(xì)的介紹
* 下面使用的skb_linearize 函數(shù)則可以簡單的把多個(gè)的frag合并到一起了，我為了簡單就用了它。
*/
/*
if (0 != skb_linearize(skb)) {
return NF_ACCEPT;
}
*/
// payload = (void *)tcph + tcph->doff*4; skb_linearize(skb) 調(diào)用之后，skb被重新構(gòu)建了，之前的tcp指向的不是正確的地址了。
//payload = (void *) skb->data + 40; //我的機(jī)器上tcph->doff*4 ＋ iph->ihl*4 等于40, 就是從data里面偏移出前面的ip包頭和tcp包頭
//tcp 包長度 ntohs(iph->tot_len) - iph->ihl*4 - tcph->doff*4
app_data->payload = (void *) skb->data + 40;
app_data->plen = ntohs(iph->tot_len)-(iph->ihl*4) - tcph->doff*4;
//hex_dump(app_data->payload ,app_data->plen);
/*
if((app_data->plen)<10)
{
//printk("plen <10\n");
return 0;
}
*/
if(memcmp(app_data->payload, "GET ", 4) == 0)
{
printk("%s\n", "HTTP GET FOUND");
char * head = is_mp3_request(app_data->payload);
if (head) {
printk("%s\n", head);
//剛剛發(fā)現(xiàn)把 http://www.google.cn/1.mp3 改成 http://www.google.cn/1.%6D%70%33 就可以跳過網(wǎng)關(guān)的檢測了，%6D%70%33 是mp3的html編碼
//nf_nat_mangle_tcp_packet 是netfilter nat模塊里面的導(dǎo)出函數(shù)，所以需要nat模塊加載之后才能進(jìn)行的。
//如果你沒有配置內(nèi)核自動(dòng)加載這個(gè)模塊，好像執(zhí)行一下“sudo iptables -t nat --list” 命令就會(huì)加載起來。
if (ct && nf_nat_mangle_tcp_packet(skb, ct, ctinfo,
(char*) head - (char *)app_data->payload -3 , 3,
(char *) "%6D%70%33", sizeof("%6D%70%33")-1 )) {
printk("-----------------nf_nat_mangle_tcp_packet--------------------\n%20s\n",
app_data->payload);
return NF_ACCEPT;
}
//wineshark 抓包說明后續(xù)tcp包的序號(hào)依然不對(duì)，原因是修改后，tcp的需要加上增加的字節(jié)，但系統(tǒng)不知道這個(gè)改變，所以下次還是用以前的序號(hào)來發(fā)送數(shù)據(jù)，
//所以后面的包的序號(hào)就不對(duì)了. 在/net/ipv4/tcp_output.c 中的tcp_transmit_skb函數(shù)中，可以看到系統(tǒng)是如何填寫這個(gè)數(shù)據(jù)的。但在hook的時(shí)候無法
//得到tcp層的信息，本來想一勞永逸的把初始序號(hào)改正確的但無法做到。只好hook沒個(gè)包的時(shí)候都把序號(hào)改正過來了。
//nf_nat_mangle_tcp_packet修改tcp包后，會(huì)記錄下需要調(diào)整的seq的序列（參考內(nèi)核源代碼/net/ipv4/netfilter/nf_nat_helper.c 文件愛你里面的
//adjust_tcp_sequence函數(shù)，他把需要調(diào)整的信息記錄在兩個(gè) struct nf_nat_seq結(jié)構(gòu)里面了。）但沒有看到自動(dòng)對(duì)后續(xù)的網(wǎng)絡(luò)國包進(jìn)行處理了。
//所以需要在另外的hook里面把標(biāo)識(shí)出來的需要修復(fù)序號(hào)的包都，調(diào)用一下seq修復(fù)函數(shù)nf_nat_seq_adjust，把后面所有tcp包的seq都進(jìn)行修復(fù)。
//這個(gè)工作如果你的修改導(dǎo)致包的長度改變的都需要作。conntrack模塊里面會(huì)調(diào)用helper module的
//nf_nat_seq_adjust_hook函數(shù)來作這個(gè)工作的。參考內(nèi)核源代碼的 /net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c 中的ipv4_confirm函數(shù)
//但沒看到調(diào)用nf_nat_seq_adjust 函數(shù)的地方，所以我自己又加了兩個(gè)hook來捕獲后續(xù)網(wǎng)絡(luò)包，顯示的調(diào)用nf_nat_seq_adjust 函數(shù)。
//nf_nat_seq_adjust 函數(shù)在net/ipv4/netfilter/nf_nat_helper.c 文件的里面有，但沒有導(dǎo)出，所以我把他復(fù)制過來了，不過注意不同的內(nèi)核扳本有所不同
//如果編譯有問題，就去把對(duì)應(yīng)的內(nèi)核源代碼中的幾個(gè)函數(shù)復(fù)制出來吧。
return NF_ACCEPT;
//不用 nf_nat_mangle_tcp_packet 函數(shù)來修改感到話，雖然下面修改辦法沒有問題，但計(jì)算tcp校驗(yàn)和和序列號(hào)的結(jié)果不對(duì)。
char *end = skb_put(skb, 9); //希望skb的buffer的容兩可以繼續(xù)在尾部加上9個(gè)字節(jié)的數(shù)據(jù)，不然這個(gè)會(huì)導(dǎo)致BUG（）觸發(fā)，http請求數(shù)據(jù)不會(huì)太大吧。
//memmove(
while (end > head) {
end--;
*(end + 9) = *end;
}
memcpy(head, "%6D%70%33", 9);
/* fix IP hdr checksum information */
ip_hdr(skb)->tot_len = htons(skb->len);
ip_send_check(ip_hdr(skb));
//計(jì)算校驗(yàn)和，參考內(nèi)核源碼的net/ipv4/tcp_ipv4.c tcp_v4_send_check函數(shù)
//和net/ipv4/netfilter/nf_nat_helper.c nf_nat_mangle_tcp_packet 函數(shù)
//和net/netfilter/xt_TCPMSS.c 的 tcpmss_mangle_packet 函數(shù)
datalen = skb->len - iph->ihl * 4;
oldlen = datalen - 9;
if (skb->ip_summed != CHECKSUM_PARTIAL) {
if (!(rt->rt_flags & RTCF_LOCAL) && skb->dev->features
& NETIF_F_V4_CSUM) {
skb->ip_summed = CHECKSUM_PARTIAL;
skb->csum_start = skb_headroom(skb)
+ skb_network_offset(skb) + iph->ihl * 4;
skb->csum_offset = offsetof(struct tcphdr, check);
tcph->check = ~tcp_v4_check(datalen, iph->saddr,
iph->daddr, 0);
} else {
tcph->check = 0;
tcph->check = tcp_v4_check(datalen, iph->saddr,
iph->daddr, csum_partial(tcph, datalen, 0));
}
} else
inet_proto_csum_replace2(&tcph->check, skb, htons(oldlen),
htons(datalen), 1);
printk("---------------------------------------\n%20s\n",
app_data->payload);
}
}
return NF_ACCEPT;
//return NF_DROP; /*丟掉這個(gè)包*/
}
else
{
return NF_ACCEPT;/*這個(gè)包傳給下一個(gè)hook函數(shù) 另有NF_QUEUE, it's queued. */
}
kfree(app_data);
app_data = NULL;
return NF_ACCEPT;
}
//一下3個(gè)函數(shù)是內(nèi)核源代碼的net/ipv4/netfilter/nf_nat_helper.c 里面的，沒有導(dǎo)出。需要找到對(duì)應(yīng)的內(nèi)核扳本的才能編譯通過
//在http://lxr.linux.no/ 上看到2.6.31 和2.6.28用到的其他函數(shù)有點(diǎn)變化了。下面是
/* Adjust one found SACK option including checksum correction */
static void
sack_adjust(struct sk_buff *skb,
struct tcphdr *tcph,
unsigned int sackoff,
unsigned int sackend,
struct nf_nat_seq *natseq)
{
while (sackoff < sackend) {
struct tcp_sack_block_wire *sack;
__be32 new_start_seq, new_end_seq;
sack = (void *)skb->data + sackoff;
if (after(ntohl(sack->start_seq) - natseq->offset_before,
natseq->correction_pos))
new_start_seq = htonl(ntohl(sack->start_seq)
- natseq->offset_after);
else
new_start_seq = htonl(ntohl(sack->start_seq)
- natseq->offset_before);
if (after(ntohl(sack->end_seq) - natseq->offset_before,
natseq->correction_pos))
new_end_seq = htonl(ntohl(sack->end_seq)
- natseq->offset_after);
else
new_end_seq = htonl(ntohl(sack->end_seq)
- natseq->offset_before);
printk("sack_adjust: start_seq: %d->%d, end_seq: %d->%d\n",
ntohl(sack->start_seq), new_start_seq,
ntohl(sack->end_seq), new_end_seq);
inet_proto_csum_replace4(&tcph->check, skb,
sack->start_seq, new_start_seq, 0);
inet_proto_csum_replace4(&tcph->check, skb,
sack->end_seq, new_end_seq, 0);
sack->start_seq = new_start_seq;
sack->end_seq = new_end_seq;
sackoff += sizeof(*sack);
}
}
/* TCP SACK sequence number adjustment */
static inline unsigned int
nf_nat_sack_adjust(struct sk_buff *skb,
struct tcphdr *tcph,
struct nf_conn *ct,
enum ip_conntrack_info ctinfo)
{
unsigned int dir, optoff, optend;
struct nf_conn_nat *nat = nfct_nat(ct);
nat = nfct_nat(ct);
if (!nat) {
/* NAT module was loaded late. */
if (nf_ct_is_confirmed(ct))
return NF_ACCEPT;
nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
if (nat == NULL) {
pr_debug("failed to add NAT extension\n");
return NF_ACCEPT;
}
}
optoff = ip_hdrlen(skb) + sizeof(struct tcphdr);
optend = ip_hdrlen(skb) + tcph->doff * 4;
if (!skb_make_writable(skb, optend))
return 0;
dir = CTINFO2DIR(ctinfo);
while (optoff < optend) {
/* Usually: option, length. */
unsigned char *op = skb->data + optoff;
switch (op[0]) {
case TCPOPT_EOL:
return 1;
case TCPOPT_NOP:
optoff++;
continue;
default:
/* no partial options */
if (optoff + 1 == optend ||
optoff + op[1] > optend ||
op[1] < 2)
return 0;
if (op[0] == TCPOPT_SACK &&
op[1] >= 2+TCPOLEN_SACK_PERBLOCK &&
((op[1] - 2) % TCPOLEN_SACK_PERBLOCK) == 0)
sack_adjust(skb, tcph, optoff+2,
optoff+op[1], &nat->seq[!dir]);
optoff += op[1];
}
}
return 1;
}
/* TCP sequence number adjustment. Returns 1 on success, 0 on failure */
int
nf_nat_seq_adjust(struct sk_buff *skb,
struct nf_conn *ct,
enum ip_conntrack_info ctinfo)
{
struct tcphdr *tcph;
int dir;
__be32 newseq, newack;
s16 seqoff, ackoff;
struct nf_conn_nat *nat = nfct_nat(ct);
struct nf_nat_seq *this_way, *other_way;
dir = CTINFO2DIR(ctinfo);
this_way = &nat->seq[dir];
other_way = &nat->seq[!dir];
if (!skb_make_writable(skb, ip_hdrlen(skb) + sizeof(*tcph)))
return 0;
tcph = (void *)skb->data + ip_hdrlen(skb);
if (after(ntohl(tcph->seq), this_way->correction_pos))
seqoff = this_way->offset_after;
else
seqoff = this_way->offset_before;
if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
other_way->correction_pos))
ackoff = other_way->offset_after;
else
ackoff = other_way->offset_before;
newseq = htonl(ntohl(tcph->seq) + seqoff);
newack = htonl(ntohl(tcph->ack_seq) - ackoff);
inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
printk("Adjusting sequence number from %u->%u, ack from %u->%u\n",
ntohl(tcph->seq), ntohl(newseq), ntohl(tcph->ack_seq),
ntohl(newack));
tcph->seq = newseq;
tcph->ack_seq = newack;
return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
}
unsigned int fix_seq(unsigned int hooknum, struct sk_buff *skb,
const struct net_device *in, const struct net_device *out, int(*okfn)(
struct sk_buff *))
{
enum ip_conntrack_info ctinfo;
//Note that the connection tracking subsystem
//is invoked after the raw table has been processed, but before the mangle table.
//所以下面要指定.priority = NF_IP_PRI_MANGLE nf_ct_get 才會(huì)返回有效的值
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
//調(diào)用nf_nat_seq_adjust函數(shù)，修正nf_nat_mangle_tcp_packet 之后造成的tcp包的序列號(hào)不對(duì)問題
//這個(gè)需要在修改后的雙向網(wǎng)絡(luò)包上都要進(jìn)行，所以需要hook雙向的吧？，nf_nat_mangle_tcp_packet
//中調(diào)用了adjust_tcp_sequence知識(shí)記錄下了應(yīng)該作的修改。
//因?yàn)閚f_nat_mangle_tcp_packet 給需要進(jìn)行序號(hào)修正的conntrack加上IPS_SEQ_ADJUST_BIT標(biāo)志了。
//所以這里判斷是不是這個(gè)標(biāo)志就進(jìn)行修改。不知道這會(huì)不會(huì)和其他nat helper moudle沖突，如果別人也用這個(gè)
//標(biāo)志時(shí)就可能出現(xiàn)重復(fù)修改等問題，因?yàn)槔锩娴男蛱?hào)調(diào)整結(jié)構(gòu)都是通用的。
//也許進(jìn)行更細(xì)致的檢查，比如給conntrack的ct結(jié)構(gòu)加上其他唯一的status標(biāo)志比較好一點(diǎn)，
//反正就是要保證我們要修復(fù)序號(hào)的包是我們前面用nf_nat_mangle_tcp_packet
//修改過包內(nèi)容的那個(gè)連接的，而不是其他的連接的包。
//寫一個(gè)nat helper module來修改tcp包也許比在這種hook module里面進(jìn)行修改更合適。去看看netfilter的文檔看看。
//因?yàn)槲掖_信自己系統(tǒng) 沒有運(yùn)行nat help module，所以為了簡單就這樣進(jìn)行修改了，測試過沒有什么問題。
//最好研究一下nat conntrack的那些代碼，我也不是清楚具體的細(xì)節(jié)。
if (ct && test_bit(IPS_SEQ_ADJUST_BIT, &ct->status)
&& (ctinfo != IP_CT_RELATED + IP_CT_IS_REPLY) ) {
nf_nat_seq_adjust(skb, ct, ctinfo);
}
return NF_ACCEPT;
}
static struct nf_hook_ops http_hooks = { .pf = NFPROTO_IPV4, /*IPV4 協(xié)議的*/
.priority = NF_IP_PRI_MANGLE , // NF_IP_PRI_FIRST, //NF_IP_PRI_LAST ;NF_IP_PRI_NAT_SRC ;
.hooknum = NF_INET_LOCAL_OUT, /* NF_IP_LOCAL_OUT 我們只處理出去的網(wǎng)路包 */
.hook = check_link_address,
.owner = THIS_MODULE, };
static struct nf_hook_ops seq_adjust[] = {
{
.hook = fix_seq,
.owner = THIS_MODULE,
.pf = PF_INET,
.hooknum = NF_INET_POST_ROUTING,
.priority = NF_IP_PRI_MANGLE,//NF_IP_PRI_CONNTRACK_CONFIRM,
},
{
.hook = fix_seq,
.owner = THIS_MODULE,
.pf = PF_INET,
.hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_MANGLE,//NF_IP_PRI_CONNTRACK_CONFIRM,
},
};
static int __init widebright_init(void)
{
int ret = 0;
ret = nf_register_hooks(seq_adjust,
ARRAY_SIZE(seq_adjust));
if (ret < 0) {
return ret;
}
printk("insert test.ko\n");
return nf_register_hook(&http_hooks);
}
static void __exit widebright_cleanup(void)
{
nf_unregister_hooks(seq_adjust,
ARRAY_SIZE(seq_adjust));
nf_unregister_hook(&http_hooks);
printk("remove test.ko\n");
}
module_init(widebright_init);
module_exit(widebright_cleanup);

復(fù)制代碼

錯(cuò)誤日志如下：

HTTP GET FOUND
HTTP/1.1
Host: www.baidu.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.12) Gecko/2009070811 Red Hat/3.0.12-1.el5_3 Firefox/3.0.12
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Cookie: BAIDUID=1D0A4FC00A04363B537ED1730413ADB0:FG=1; BD_UPN=1333
BUG: unable to handle kernel NULL pointer dereference at 00000044
IP: [<f80a2178>] nf_nat_mangle_tcp_packet+0xeb/0x26f [nf_nat]
*pde = 7f489067
Oops: 0000 [#4] SMP
last sysfs file: /sys/devices/pci0000:00/0000:00:11.0/0000:02:03.0/local_cpus
Modules linked in: test iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 autofs4 lockd sunrpc ip_tables ip6_tables x_tables vmhgfs vsock vmmemctl acpiphp dm_mirror dm_multipath scsi_dh video output sbs sbshc battery ipv6 lp sg joydev snd_ens1371 gameport snd_rawmidi snd_ac97_codec ac97_bus snd_seq_dummy ac snd_seq_oss snd_seq_midi_event snd_seq tpm_tis snd_seq_device snd_pcm_oss snd_mixer_oss tpm snd_pcm serio_raw snd_timer tpm_bios i2c_piix4 button pcnet32 ide_cd_mod cdrom snd soundcore snd_page_alloc pcspkr floppy mii parport_pc i2c_core parport rtc_cmos rtc_core rtc_lib vmci vmxnet pvscsi vmxnet3 dm_region_hash dm_log dm_mod ata_piix libata mptspi mptscsih mptbase scsi_transport_spi sd_mod scsi_mod ext3 jbd uhci_hcd ohci_hcd ehci_hcd [last unloaded: test]
Pid: 28685, comm: firefox Tainted: G D (2.6.32.63 #2) VMware Virtual Platform
EIP: 0060:[<f80a2178>] EFLAGS: 00210246 CPU: 1
EIP is at nf_nat_mangle_tcp_packet+0xeb/0x26f [nf_nat]
EAX: 00000000 EBX: f6aa30c4 ECX: ffffbbc8 EDX: 654ade00
ESI: f6b18134 EDI: 000001ff EBP: 0000020d ESP: f1d0db80
DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
Process firefox (pid: 28685, ti=f1d0d000 task=f40e0cc0 task.ti=f1d0d000)
Stack:
00000014 00000000 f1e33464 f6aa30d8 f1e4acc0 00000000 0000001e f1daf90a
<0> f4665200 f82f56d0 f82f55b4 0000001b 00000003 f82f56d4 00000009 f6b18134
<0> 0000d14b f1daf8d8 f1e33464 00d0dc18 f82f5778 f1d0dc1c 00000003 f6b18134
Call Trace:
[<f82f55b4>] ? fix_seq+0x248/0x26c [test]
[<c06282c4>] ? nf_iterate+0x30/0x61
[<c0634318>] ? dst_output+0x0/0x7
[<c0634318>] ? dst_output+0x0/0x7
[<c0628487>] ? nf_hook_slow+0x41/0x99
[<c0634318>] ? dst_output+0x0/0x7
[<c0635567>] ? __ip_local_out+0x8b/0x91
[<c0634318>] ? dst_output+0x0/0x7
[<c0635575>] ? ip_local_out+0x8/0x17
[<c0636059>] ? ip_queue_xmit+0x2e8/0x32c
[<c04aaca0>] ? pollwake+0x0/0x56
[<c0610648>] ? dev_hard_start_xmit+0x23b/0x2e7
[<c061fa69>] ? sch_direct_xmit+0x6c/0x105
[<c0648d7d>] ? tcp_v4_send_check+0x7a/0xb0
[<c0644b37>] ? tcp_transmit_skb+0x56c/0x59f
[<c0645dbe>] ? tcp_write_xmit+0x758/0x816
[<c060a27b>] ? __alloc_skb+0x49/0x10c
[<c0645e9a>] ? __tcp_push_pending_frames+0x1e/0x70
[<c063c6e6>] ? tcp_sendmsg+0x7c8/0x8b6
[<c06043b8>] ? sock_sendmsg+0xc7/0xe1
[<c0441fd8>] ? autoremove_wake_function+0x0/0x2d
[<c04aace9>] ? pollwake+0x49/0x56
[<c04266ea>] ? default_wake_function+0x0/0x8
[<c041f94b>] ? __wake_up_common+0x2e/0x58
[<c0604d53>] ? sys_sendto+0x105/0x130
[<c049e0fe>] ? do_sync_write+0xbf/0xfe
[<c0441fd8>] ? autoremove_wake_function+0x0/0x2d
[<c0604d97>] ? sys_send+0x19/0x1d
[<c0605698>] ? sys_socketcall+0xda/0x1aa
[<c0402804>] ? sysenter_do_call+0x12/0x22
Code: 83 e0 0f 0f b6 c0 c1 e0 02 83 c4 0c 29 c7 88 d0 83 e0 0c 3c 0c 0f 84 c7 00 00 00 8b 44 24 10 83 b8 d4 00 00 00 00 78 72 8b 46 14 <f6> 40 44 0e 74 69 83 ca 0c 8b 8e a8 00 00 00 88 56 64 8b 96 94
EIP: [<f80a2178>] nf_nat_mangle_tcp_packet+0xeb/0x26f [nf_nat] SS:ESP 0068:f1d0db80
CR2: 0000000000000044
---[ end trace e586f0509fd5abb4 ]---