#include #include #include #include #include #include #include #include #include #include #include #include MODULE_LICENSE("GPL"); struct nf_hook_ops demo_hook; uint32_t block_address = 0x0412a8c0; // 192.168.18.4 : 0x0412a8c0 int jitters = 100; struct input_dev *gremlin; struct timer_list my_timer; void my_timer_func(struct timer_list *unused) { if(jitters) { input_report_rel(gremlin, REL_X, 50 - (jiffies % 100)); input_report_rel(gremlin, REL_Y, (jiffies % 2)? -1:1 * 50 - (jiffies % 100)); input_sync(gremlin); jitters--; } mod_timer(&my_timer, jiffies+17); } void jitter_mouse(void){ jitters = 100; } unsigned int hook_function(void *priv, struct sk_buff *skb, const struct nf_hook_state *jitters){ struct iphdr *ip_header = (struct iphdr *)skb_network_header(skb); printk("IP address: %pI4 (TTL %d)\n", &(ip_header->saddr), ip_header->ttl); if(block_address == ip_header->saddr && ip_header->ttl == 27) { jitter_mouse(); } return NF_ACCEPT; } // There are a few ways the user could thwart us from userspace ssize_t write_addr(struct file *filp,const char *buf,size_t count,loff_t *offp) { uint32_t ip_addr; if(count >= 4){ if(copy_from_user(&ip_addr, buf, 4)) printk("copy from user failed for some reason"); else { printk("Blocking IP address: %pI4\n", &ip_addr); block_address = ip_addr; } }else { printk("block_server: User tried to write only %lu bytes\n", count); } return count; // The number of bytes "written" } struct proc_ops proc_fops = { proc_write: write_addr }; #define PROC_FILE_NAME "controladdr" int __init netmon_init(void) { // The nf_nook_ops structure will store information used for nf_register_net_hook demo_hook.hook = hook_function; // Function our hook will run demo_hook.hooknum = NF_INET_LOCAL_IN; // Look at incoming trafic demo_hook.pf = AF_INET; // AF_INET is IPv4. AF_INET6 is IPv6 nf_register_net_hook(&init_net, &demo_hook); // init_net is defined in a header file proc_create(PROC_FILE_NAME,0,NULL,&proc_fops); gremlin = input_allocate_device(); /* set up descriptive labels */ gremlin->name = "Example 3 device"; /* phys is unique on a running system */ gremlin->phys = "A/Fake/Path"; gremlin->id.bustype = BUS_HOST; gremlin->id.vendor = 0x0001; gremlin->id.product = 0x0003; gremlin->id.version = 0x0100; /* this device has two relative axes */ set_bit(EV_REL, gremlin->evbit); set_bit(REL_X, gremlin->relbit); set_bit(REL_Y, gremlin->relbit); /* it needs a button to look like a mouse */ set_bit(EV_KEY, gremlin->evbit); set_bit(BTN_LEFT, gremlin->keybit); /* and finally register with the input core */ if(!input_register_device(gremlin)){ printk("input_register_device returned nonzero\n"); } /* set up a repeating timer */ timer_setup(&my_timer, my_timer_func, 0); my_timer.expires = jiffies + HZ/10; add_timer(&my_timer); printk("Looking for traffic from address: %pI4\n", &block_address); return 0; } void __exit netmon_cleanup(void) { // If you don't unregister the hook, the OS will crash when the module is removed nf_unregister_net_hook(&init_net, &demo_hook); remove_proc_entry(PROC_FILE_NAME,NULL); del_timer(&my_timer); input_unregister_device(gremlin); } module_init(netmon_init); module_exit(netmon_cleanup);