netfilter连接跟踪主要数据结构

linux协议栈中netfiler框架对数据包做过滤处理基本上都是基于连接跟踪来做的，比如snat、dnat等，连接跟踪就是记录数据流在协议栈中的两个方向，不同的协议有不同的特征，tcp/udp就是五元组（源ip、目的Ip、源端口、目的端口、协议号）,icmp协议就是ip、id、type、code。

1、struct nf_conn

struct nf_conn结构体是连接跟踪的抽象结构，其中最重要的元素是struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX]记录了条连接的特征信息，根据这个结构中的信息可以确定唯一的一条连接，还有是连接的状态unsigned long status，各元素的详解如下。

struct nf_conn {
	/* Usage count in here is 1 for hash table/destruct timer, 1 per skb,
           plus 1 for any connection(s) we are `master' for */
       /*连接跟踪引用计数*/
	struct nf_conntrack ct_general;

	spinlock_t lock;

	/* XXX should I move this to the tail ? - Y.K */
	/* These are my tuples; original and reply */
	/*记录连接跟踪的信息，比如tcp/udp协议就是五元组来确定一个
	条连接，icmp协议通过ip、type、id、type来确定一条连接有两个方向*/
	struct nf_conntrack_tuple_hash tuplehash[IP_CT_DIR_MAX];

	/* Have we seen traffic both ways yet? (bitset) */
	/*连接的状态*/
	unsigned long status;

	/* If we were expected by an expectation, this will be it */
	/*如果是一条子连接，就指向它的主连接*/
	struct nf_conn *master;

	/* Timer function; drops refcnt when it goes off. */
	/*超时*/
	struct timer_list timeout;

#if defined(CONFIG_NF_CONNTRACK_MARK)
	/*用来标记一条连接*/
	u_int32_t mark;
#endif

#ifdef CONFIG_NF_CONNTRACK_SECMARK
	u_int32_t secmark;
#endif

	/* Storage reserved for other modules: */
	/*保存不同协议的私有数据*/
	union nf_conntrack_proto proto;

	/* Extensions */
	/*扩展结构*/
	struct nf_ct_ext *ext;
#ifdef CONFIG_NET_NS
	struct net *ct_net;
#endif
};

2、数据包连接状态

数据包的连接状态定义在枚举变量ip_conntrack_info中

enum ip_conntrack_info {
	/* Part of an established connection (either direction). */
	/*表示两个方向都有了数据包*/
	IP_CT_ESTABLISHED,

	/* Like NEW, but related to an existing connection, or ICMP error
	   (in either direction). */
	   /*数据包对应的连接还没有reply方向的数据包
	关联了一个已有连接，是他的一个子连接*/
	IP_CT_RELATED,

	/* Started a new connection to track (only
           IP_CT_DIR_ORIGINAL); may be a retransmission. */
        /*reply方向还没有数据包*/
	IP_CT_NEW,

	/* >= this indicates reply direction */
    /*数据包是reply方向*/
	IP_CT_IS_REPLY,

	/* Number of distinct IP_CT types (no NEW in reply dirn). */
	IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
};

3、连接跟踪状态

enum ip_conntrack_status {
	/* It's an expected connection: bit 0 set.  This bit never changed */
	/*表示是个子连接*/
	IPS_EXPECTED_BIT = 0,
	IPS_EXPECTED = (1 << IPS_EXPECTED_BIT),

	/* We've seen packets both ways: bit 1 set.  Can be set, not unset. */
	/*连接双向上都有数据*/
	IPS_SEEN_REPLY_BIT = 1,
	IPS_SEEN_REPLY = (1 << IPS_SEEN_REPLY_BIT),

	/* Conntrack should never be early-expired. */
	/*tcp三次握手后设定这个标志，udp
	双向都有数据后设定这个标志*/
	IPS_ASSURED_BIT = 2,
	IPS_ASSURED = (1 << IPS_ASSURED_BIT),

	/* Connection is confirmed: originating packet has left box */
	/*连接已经添加到net->ct.hash表中*/
	IPS_CONFIRMED_BIT = 3,
	IPS_CONFIRMED = (1 << IPS_CONFIRMED_BIT),

	/* Connection needs src nat in orig dir.  This bit never changed. */
	/*postrouting处当reply tuple完成设置该标志*/
	IPS_SRC_NAT_BIT = 4,
	IPS_SRC_NAT = (1 << IPS_SRC_NAT_BIT),

	/* Connection needs dst nat in orig dir.  This bit never changed. */
	/*prerouting处reply tuple完成设置该标志*/
	IPS_DST_NAT_BIT = 5,
	IPS_DST_NAT = (1 << IPS_DST_NAT_BIT),

	/* Both together. */
	IPS_NAT_MASK = (IPS_DST_NAT | IPS_SRC_NAT),

	/* Connection needs TCP sequence adjusted. */
	IPS_SEQ_ADJUST_BIT = 6,
	IPS_SEQ_ADJUST = (1 << IPS_SEQ_ADJUST_BIT),

	/* NAT initialization bits. */
	/*postrouting处已经做完了snat并添加到bysource链中*/
	IPS_SRC_NAT_DONE_BIT = 7,
	IPS_SRC_NAT_DONE = (1 << IPS_SRC_NAT_DONE_BIT),

	/*prerouting处已经做完了dnat并添加到bysource链中*/
	IPS_DST_NAT_DONE_BIT = 8,
	IPS_DST_NAT_DONE = (1 << IPS_DST_NAT_DONE_BIT),

	/* Both together */
	IPS_NAT_DONE_MASK = (IPS_DST_NAT_DONE | IPS_SRC_NAT_DONE),

	/* Connection is dying (removed from lists), can not be unset. */
	/*连接被释放*/
	IPS_DYING_BIT = 9,
	IPS_DYING = (1 << IPS_DYING_BIT),

	/* Connection has fixed timeout. */
	/*固定连接超时*/
	IPS_FIXED_TIMEOUT_BIT = 10,
	IPS_FIXED_TIMEOUT = (1 << IPS_FIXED_TIMEOUT_BIT),

	/* Conntrack is a template */
	/*ct的target设置只能设置在raw表中*/
	IPS_TEMPLATE_BIT = 11,
	IPS_TEMPLATE = (1 << IPS_TEMPLATE_BIT),
};

4、struct nf_conntrack_tuple_hash

hnnode是一个链表，主要是struct nf_conntrack_tuple

/* Connections have two entries in the hash table: one for each way */
struct nf_conntrack_tuple_hash {
	struct hlist_nulls_node hnnode;
	/*不同协议的特征*/
	struct nf_conntrack_tuple tuple;
};

struct nf_conntrack_tuple这个结构保存了连接不同协议的特征信息，u是一个联合体，不同协议有不同特征，tcp/udp协议的五元组，icmp协议的type、code、id

/* This contains the information to distinguish a connection. */
/*一条连接的信息tcp/udp就是五元组*/
struct nf_conntrack_tuple {
    /*保存三层、四层一些信息*/
	struct nf_conntrack_man src;

	/* These are the parts of the tuple which are fixed. */
	struct {
		union nf_inet_addr u3;
        /*联合体*/
		union {
			/* Add other protocols here. */
			__be16 all;

			struct {
				__be16 port;
			} tcp;
			struct {
				__be16 port;
			} udp;
            /*icmp协议的type code*/
			struct {
				u_int8_t type, code;
			} icmp;
			struct {
				__be16 port;
			} dccp;
			struct {
				__be16 port;
			} sctp;
			struct {
				__be16 key;
			} gre;
		} u;

		/* The protocol. */
		/*协议号*/
		u_int8_t protonum;

		/* The direction (for tuplehash) */
		/*连接方向是origin还是reply*/
		u_int8_t dir;
	} dst;
};

struct nf_conntrack_man主要保存三层ip和四层端口

/* The manipulable part of the tuple. */
struct nf_conntrack_man {
	/*三层ip*/	
	union nf_inet_addr u3;
	/*四层端口号*/
	union nf_conntrack_man_proto u;
	/* Layer 3 protocol三层协议号 */
	u_int16_t l3num;
};

5、 struct nf_conntrack_l3proto

struct nf_conntrack_l2proto主要定义了一些三层Ip协议的操作函数，获取tuple结构三层协议相关的特征(源ip、目的ip)，nfnetlink格式和tuple格式的源ip、目的ip转换。

struct nf_conntrack_l3proto {
	/* L3 Protocol Family number. ex) PF_INET */
	/*三层协议号*/
	u_int16_t l3proto;

	/* Protocol name */
	/*协议名称*/
	const char *name;

	/*
	 * Try to fill in the third arg: nhoff is offset of l3 proto
         * hdr.  Return true if possible.
	 */
	 /*从数据包中计算处tuple结构体中的源ip、目的ip*/
	bool (*pkt_to_tuple)(const struct sk_buff *skb, unsigned int nhoff,
			     struct nf_conntrack_tuple *tuple);

	/*
	 * Invert the per-proto part of the tuple: ie. turn xmit into reply.
	 * Some packets can't be inverted: return 0 in that case.
	 */
	 /*根据orig方向的源ip、目的ip设置reply方向的源ip、目的ip，反过来*/
	bool (*invert_tuple)(struct nf_conntrack_tuple *inverse,
			     const struct nf_conntrack_tuple *orig);

	/* Print out the per-protocol part of the tuple. */
	/*输出源ip、目的ip*/
	int (*print_tuple)(struct seq_file *s,
			   const struct nf_conntrack_tuple *);

	/*
	 * Called before tracking. 
	 *	*dataoff: offset of protocol header (TCP, UDP,...) in skb
	 *	*protonum: protocol number
	 */
	 /*获取四层协议号*/
	int (*get_l4proto)(const struct sk_buff *skb, unsigned int nhoff,
			   unsigned int *dataoff, u_int8_t *protonum);
	/*tuple结构中的三层源ip、目的ip地址按照nfnetlink规定的形式进行填充*/
	int (*tuple_to_nlattr)(struct sk_buff *skb,
			       const struct nf_conntrack_tuple *t);

	/*
	 * Calculate size of tuple nlattr
	 */
	int (*nlattr_tuple_size)(void);
	/*将nfnetlink消息传递过来的变量，转换成tuple结构中的三层源ip、目的ip地址，*/
	int (*nlattr_to_tuple)(struct nlattr *tb[],
			       struct nf_conntrack_tuple *t);
	const struct nla_policy *nla_policy;

	size_t nla_size;

#ifdef CONFIG_SYSCTL
	struct ctl_table_header	*ctl_table_header;
	struct ctl_path		*ctl_table_path;
	struct ctl_table	*ctl_table;
#endif /* CONFIG_SYSCTL */

	/* Module (if any) which this is connected to. */
	struct module *me;
}

struct nf_conntrack_l3proto结构实例如下

struct nf_conntrack_l3proto nf_conntrack_l3proto_ipv4 __read_mostly = {
	.l3proto	 = PF_INET,
	.name		 = "ipv4",
	/*从skb获取源ip和目的ip保存到tuple中*/
	.pkt_to_tuple	 = ipv4_pkt_to_tuple,
	/*根据orig方向的源ip、目的ip设置reply方向的源ip、目的ip，反过来*/
	.invert_tuple	 = ipv4_invert_tuple,
	/*输出源ip、目的ip*/
	.print_tuple	 = ipv4_print_tuple,
	/*获取四层协议号*/
	.get_l4proto	 = ipv4_get_l4proto,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	/*tuple结构中的三层源ip、目的ip地址按照nfnetlink规定的形式进行填充*/
	.tuple_to_nlattr = ipv4_tuple_to_nlattr,
	.nlattr_tuple_size = ipv4_nlattr_tuple_size,
	/*将nfnetlink消息传递过来的变量，转换成tuple结构中的三层源ip、目的ip地址，*/
	.nlattr_to_tuple = ipv4_nlattr_to_tuple,
	.nla_policy	 = ipv4_nla_policy,
#endif
#if defined(CONFIG_SYSCTL) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
	.ctl_table_path  = nf_net_ipv4_netfilter_sysctl_path,
	.ctl_table	 = ip_ct_sysctl_table,
#endif
	.me		 = THIS_MODULE,
};

6、struct nf_conntrack_l4proto

struct nf_conntrack_l4proto结构主要是四层协议和tuple相关的操作函数，获取tuple结构四层协议相关的特征，tcp/udp协议就是源端口、目的端口，icmp协议是id、type、code，nfnetlink格式和tuple格式四层特性元素转换。

struct nf_conntrack_l4proto {
	/* L3 Protocol number. */
	u_int16_t l3proto;

	/* L4 Protocol number. */
	u_int8_t l4proto;

	/* Try to fill in the third arg: dataoff is offset past network protocol
           hdr.  Return true if possible. */
	bool (*pkt_to_tuple)(const struct sk_buff *skb, unsigned int dataoff,
			     struct nf_conntrack_tuple *tuple);

	/* Invert the per-proto part of the tuple: ie. turn xmit into reply.
	 * Some packets can't be inverted: return 0 in that case.
	 */
	bool (*invert_tuple)(struct nf_conntrack_tuple *inverse,
			     const struct nf_conntrack_tuple *orig);

	/* Returns verdict for packet, or -1 for invalid. */
	int (*packet)(struct nf_conn *ct,
		      const struct sk_buff *skb,
		      unsigned int dataoff,
		      enum ip_conntrack_info ctinfo,
		      u_int8_t pf,
		      unsigned int hooknum);

	/* Called when a new connection for this protocol found;
	 * returns TRUE if it's OK.  If so, packet() called next. */
	bool (*new)(struct nf_conn *ct, const struct sk_buff *skb,
		    unsigned int dataoff);

	/* Called when a conntrack entry is destroyed */
	void (*destroy)(struct nf_conn *ct);

	int (*error)(struct net *net, struct nf_conn *tmpl, struct sk_buff *skb,
		     unsigned int dataoff, enum ip_conntrack_info *ctinfo,
		     u_int8_t pf, unsigned int hooknum);

	/* Print out the per-protocol part of the tuple. Return like seq_* */
	int (*print_tuple)(struct seq_file *s,
			   const struct nf_conntrack_tuple *);

	/* Print out the private part of the conntrack. */
	int (*print_conntrack)(struct seq_file *s, struct nf_conn *);

	/* convert protoinfo to nfnetink attributes */
	int (*to_nlattr)(struct sk_buff *skb, struct nlattr *nla,
			 struct nf_conn *ct);
	/* Calculate protoinfo nlattr size */
	int (*nlattr_size)(void);

	/* convert nfnetlink attributes to protoinfo */
	int (*from_nlattr)(struct nlattr *tb[], struct nf_conn *ct);

	int (*tuple_to_nlattr)(struct sk_buff *skb,
			       const struct nf_conntrack_tuple *t);
	/* Calculate tuple nlattr size */
	int (*nlattr_tuple_size)(void);
	int (*nlattr_to_tuple)(struct nlattr *tb[],
			       struct nf_conntrack_tuple *t);
	const struct nla_policy *nla_policy;

	size_t nla_size;

#ifdef CONFIG_SYSCTL
	struct ctl_table_header	**ctl_table_header;
	struct ctl_table	*ctl_table;
	unsigned int		*ctl_table_users;
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	struct ctl_table_header	*ctl_compat_table_header;
	struct ctl_table	*ctl_compat_table;
#endif
#endif
	/* Protocol name */
	const char *name;

	/* Module (if any) which this is connected to. */
	struct module *me;
};

6.1 、nf_conntrack_l4proto_tcp4

tcp协议struct nf_conntrack_l4proto实例化是nf_conntrack_l4_proto_tcp4

struct nf_conntrack_l4proto nf_conntrack_l4proto_tcp4 __read_mostly =
{
	.l3proto		= PF_INET,
	.l4proto 		= IPPROTO_TCP,
	.name 			= "tcp",
	/*从tcp协议skb中获取一个tuple的源端口、目的端口*/
	.pkt_to_tuple 		= tcp_pkt_to_tuple,
	/*tcp协议把orig方向的源端口、目的端口赋值给reply方向的目的端口、源端口*/
	.invert_tuple 		= tcp_invert_tuple,
	/*打印输出tuple的源端口、目的端口*/
	.print_tuple 		= tcp_print_tuple,
	.print_conntrack 	= tcp_print_conntrack,
	.packet 		= tcp_packet,
	.new 			= tcp_new,
	.error			= tcp_error,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	/*tuple中的源端口、目的端口转换为nfnetlink格式填充*/
	.to_nlattr		= tcp_to_nlattr,
	.nlattr_size		= tcp_nlattr_size,
	/*nfnetlink格式的源端口、目的端口转换为tuple*/
	.from_nlattr		= nlattr_to_tcp,
	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
	.nlattr_tuple_size	= tcp_nlattr_tuple_size,
	.nla_policy		= nf_ct_port_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_users	= &tcp_sysctl_table_users,
	.ctl_table_header	= &tcp_sysctl_header,
	.ctl_table		= tcp_sysctl_table,
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	.ctl_compat_table	= tcp_compat_sysctl_table,
#endif
#endif
};

6.2 、nf_conntrack_l4proto_udp4

udp协议struct nf_conntrack_l4proto实例如下

struct nf_conntrack_l4proto nf_conntrack_l4proto_udp4 __read_mostly =
{
	.l3proto		= PF_INET,
	.l4proto		= IPPROTO_UDP,
	.name			= "udp",
	.pkt_to_tuple		= udp_pkt_to_tuple,
	.invert_tuple		= udp_invert_tuple,
	.print_tuple		= udp_print_tuple,
	.packet			= udp_packet,
	.new			= udp_new,
	.error			= udp_error,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr	= nf_ct_port_tuple_to_nlattr,
	.nlattr_to_tuple	= nf_ct_port_nlattr_to_tuple,
	.nlattr_tuple_size	= nf_ct_port_nlattr_tuple_size,
	.nla_policy		= nf_ct_port_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_users	= &udp_sysctl_table_users,
	.ctl_table_header	= &udp_sysctl_header,
	.ctl_table		= udp_sysctl_table,
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	.ctl_compat_table	= udp_compat_sysctl_table,
#endif
#endif

6.3、nf_conntrack_l4proto_icmp

imcp协议的struct nf_conntrack_l4proto的实例如下

struct nf_conntrack_l4proto nf_conntrack_l4proto_icmp __read_mostly =
{
	.l3proto		= PF_INET,
	.l4proto		= IPPROTO_ICMP,
	.name			= "icmp",
	.pkt_to_tuple		= icmp_pkt_to_tuple,
	.invert_tuple		= icmp_invert_tuple,
	.print_tuple		= icmp_print_tuple,
	.packet			= icmp_packet,
	.new			= icmp_new,
	.error			= icmp_error,
	.destroy		= NULL,
	.me			= NULL,
#if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
	.tuple_to_nlattr	= icmp_tuple_to_nlattr,
	.nlattr_tuple_size	= icmp_nlattr_tuple_size,
	.nlattr_to_tuple	= icmp_nlattr_to_tuple,
	.nla_policy		= icmp_nla_policy,
#endif
#ifdef CONFIG_SYSCTL
	.ctl_table_header	= &icmp_sysctl_header,
	.ctl_table		= icmp_sysctl_table,
#ifdef CONFIG_NF_CONNTRACK_PROC_COMPAT
	.ctl_compat_table	= icmp_compat_sysctl_table,
#endif
#endif
};