From: Kesava Srinivas [mailto:vunnavafuture@gmail.com] Sent: Monday, November 21, 2011 11:32 AM To: Jeff Haran Cc: kernelnewbies@kernelnewbies.org Subject: Re: sock_buff is NULL ! Thanks Jeff for the reply. Yes; after changing the double pointer to a Normal Pointer., I can see that ., "if" block was skipped. -Thnx, VKS On Tue, Nov 22, 2011 at 12:50 AM, Jeff Haran <jharan@bytemobile.com> wrote: From: kernelnewbies-bounces@kernelnewbies.org [mailto:kernelnewbies-bounces@kernelnewbies.org] On Behalf Of Kesava Srinivas Sent: Monday, November 21, 2011 11:03 AM To: kernelnewbies@kernelnewbies.org Subject: sock_buff is NULL ! HI Team, Trying to make this code work; but some how it is entering the if condition mentioned below.sock_buff is still a NULL Pointer.I can see that Function was registered with the Ipv4 Hooks. Any ideas/scenarios where the sock_buff remains as NULL Pointer??? Testing this code by trying to do ssh with this machine. Any Help is really appreciated !! ######### static struct nf_hook_ops netfilter_ops; struct sk_buff *sock_buff; unsigned int main_hook(unsigned int hooknum,struct sk_buff **skb,const struct net_device *in,const struct net_device *out,int (*okfn)(struct sk_buff*)) { sock_buff = *skb; if(!sock_buff){ printk(KERN_ERR "Entered unexpected loop \n"); return NF_ACCEPT; }/* Check for sk_buff NULL */ } int init_module() { netfilter_ops.hook = (nf_hookfn *) main_hook; netfilter_ops.hooknum = NF_INET_PRE_ROUTING; netfilter_ops.pf = PF_INET; netfilter_ops.priority = NF_IP_PRI_FIRST; nf_register_hook(&netfilter_ops); } ###################### -Thnx, VKS Which kernel version are you using? The function prototype of a netfilter hook does vary from kernel version to kernel version, but in the kernels I’ve seen the skb parameter is a typed sk_buff *skb, not sk_buff **skb. In other words, you get passed a pointer to the sk_buff, not the address of a pointer to an sk_buff. Jeff Haran -- -VKS Masters,Computer Science&Engineering. I am a bit surprised that you didn’t get a compiler warning when you built this. Type checking is your friend. 8^) Jeff Haran