/*
    https://zgao.top/%e5%bc%80%e5%8f%91ko%e5%86%85%e6%a0%b8%e6%a8%a1%e5%9d%97%ef%bc%8c%e6%97%a0%e4%be%9d%e8%b5%96%e5%ae%9e%e7%8e%b0%e7%9b%91%e6%8e%a7dns%e8%af%b7%e6%b1%82%e8%bf%9b%e7%a8%8b/

    make -C /lib/modules/$(uname -r)/build M=$(PWD) modules
    insmod dns_monitor.ko
    lsmod| grep dns
    dmesg -Tw
*/

#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/netfilter.h>
#include <linux/netfilter_ipv4.h>
#include <linux/ip.h>
#include <linux/udp.h>
#include <linux/skbuff.h>

static struct nf_hook_ops nfho;
struct dnshdr {
    uint16_t id;
    uint16_t flags;
    uint16_t qdcount;
    uint16_t ancount;
    uint16_t nscount;
    uint16_t arcount;
};
unsigned int hook_func(void *priv, struct sk_buff *skb, const struct nf_hook_state *state) {
    struct iphdr *iph;
    struct udphdr *udph;
    struct dnshdr *dnsh;
    unsigned char *data;
    char domain_name[256];
    int i = 0, len;
    if (!skb)
        return NF_ACCEPT;
    iph = ip_hdr(skb);
    if (iph->protocol == IPPROTO_UDP) {
        udph = udp_hdr(skb);
        if (ntohs(udph->dest) == 53) {
            dnsh = (struct dnshdr *)((unsigned char *)udph + sizeof(struct udphdr));
            data = (unsigned char *)(dnsh + 1);
            while (data[i] != 0) {
                len = data[i];
                i++;
                if (len == 0) break;
                if (i + len > 255) break;
                strncat(domain_name, data + i, len);
                strcat(domain_name, ".");
                i += len;
            }
            domain_name[strlen(domain_name) - 1] = '\0';
            printk(KERN_INFO "DNS Query for %s from PID %d (%s)\n", domain_name, current->pid, current->comm);
        }
    }
    return NF_ACCEPT;
}
int init_module() {
    nfho.hook = hook_func;
    nfho.hooknum = NF_INET_POST_ROUTING;
    nfho.pf = PF_INET;
    nfho.priority = NF_IP_PRI_FIRST;
    nf_register_net_hook(&init_net, &nfho);
    return 0;
}
void cleanup_module() {
    nf_unregister_net_hook(&init_net, &nfho);
}
MODULE_AUTHOR("https://zgao.top");
MODULE_DESCRIPTION("Extended DNS Request Monitor Module");
MODULE_LICENSE("GPL");