linux - ping 回复 header

Question

我使用钩子(Hook)函数制作了一个模块。它可以工作，但是当我使用 ping google.com 时，我得到 0045 作为 icmp 类型。但我认为它应该是 0 用于回显回复。我使用了以下打印命令:

unsigned int hook_func(unsigned int hooknum, struct sk_buff *skb1, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *))
{
struct sk_buff *sock_buff;
 struct iphdr *ip1;
 struct icmphdr *icmp1;
 sock_buff = skb1;
//printk("ihere we are::%s,%d\n",__func__,__LINE__);
   ip1 = (struct iphdr *)skb_network_header(sock_buff);
 printk(KERN_ALERT"proto:%d\n",ip1->protocol);
if(ip1->protocol==1)
{
 icmp1 = (struct icmphdr *)skb_transport_header(sock_buff);
printk(KERN_ALERT"reply type: %04X,,seq : %04X\n",icmp1->type,icmp1->un.echo.id);
       }
// kfree(sock_buff);
return NF_ACCEPT;

  }

icmp1->类型为 __be16。

Answer 1

将 icmp1 = (struct icmphdr *)skb_transport_header(sock_buff); 替换为

icmp1 = (struct icmphdr *)(skb_transport_header(sock_buff) + ip_hdrlen(sock_buff));

icmpheader->类型是无符号字符，尝试一下

printk(KERN_ALERT"回复类型:%u,,seq : %04X\n",icmp1->type,icmp1->un.echo.id);