linux下的Netfilter&iptables：注册连接跟踪函数流程分析1

最新推荐文章于 2024-02-18 10:31:25 发布

时光漫走

最新推荐文章于 2024-02-18 10:31:25 发布

阅读量260

点赞数

分类专栏： Linux 网络协议栈

本文链接：https://blog.csdn.net/asn1111/article/details/104113436

版权

Linux 网络协议栈专栏收录该内容

3 篇文章 0 订阅

订阅专栏

初始化函数如下

/* Connection tracking may drop packets, but never alters them, so
make it the first hook. */
static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {
   {
       .hook       = ipv4_conntrack_in,
       .owner       = THIS_MODULE,
       .pf       = NFPROTO_IPV4,
       .hooknum   = NF_INET_PRE_ROUTING,
       .priority   = NF_IP_PRI_CONNTRACK,
   },
   {
       .hook       = ipv4_conntrack_local,
       .owner       = THIS_MODULE,
       .pf       = NFPROTO_IPV4,
       .hooknum   = NF_INET_LOCAL_OUT,
       .priority   = NF_IP_PRI_CONNTRACK,
   },
   {
       .hook       = ipv4_helper,
       .owner       = THIS_MODULE,
       .pf       = NFPROTO_IPV4,
       .hooknum   = NF_INET_POST_ROUTING,
       .priority   = NF_IP_PRI_CONNTRACK_HELPER,
   },
   {
       .hook       = ipv4_confirm,
       .owner       = THIS_MODULE,
       .pf       = NFPROTO_IPV4,
       .hooknum   = NF_INET_POST_ROUTING,
       .priority   = NF_IP_PRI_CONNTRACK_CONFIRM,
   },
   {
       .hook       = ipv4_helper,
       .owner       = THIS_MODULE,
       .pf       = NFPROTO_IPV4,
       .hooknum   = NF_INET_LOCAL_IN,
       .priority   = NF_IP_PRI_CONNTRACK_HELPER,
   },
   {
       .hook       = ipv4_confirm,
       .owner       = THIS_MODULE,
       .pf       = NFPROTO_IPV4,
       .hooknum   = NF_INET_LOCAL_IN,
       .priority   = NF_IP_PRI_CONNTRACK_CONFIRM,
   },
};

static int __init nf_conntrack_l3proto_ipv4_init(void)
{
int ret = 0;

need_conntrack();
nf_defrag_ipv4_enable();

   ret = nf_register_sockopt(&so_getorigdst);
   if (ret < 0) {
       printk(KERN_ERR "Unable to register netfilter socket option\n");
       return ret;
   }

   ret = register_pernet_subsys(&ipv4_net_ops);
   if (ret < 0) {
       pr_err("nf_conntrack_ipv4: can't register pernet ops\n");
       goto cleanup_sockopt;
   }

/**************向钩子注册连接追踪函数******************/

   ret = nf_register_hooks(ipv4_conntrack_ops,
               ARRAY_SIZE(ipv4_conntrack_ops));
   if (ret < 0) {
       pr_err("nf_conntrack_ipv4: can't register hooks.\n");
       goto cleanup_pernet;
   }

   ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_tcp4);
   if (ret < 0) {
       pr_err("nf_conntrack_ipv4: can't register tcp4 proto.\n");
       goto cleanup_hooks;
   }

   ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_udp4);
   if (ret < 0) {
       pr_err("nf_conntrack_ipv4: can't register udp4 proto.\n");
       goto cleanup_tcp4;
   }

   ret = nf_ct_l4proto_register(&nf_conntrack_l4proto_icmp);
   if (ret < 0) {
       pr_err("nf_conntrack_ipv4: can't register icmpv4 proto.\n");
       goto cleanup_udp4;
   }

   ret = nf_ct_l3proto_register(&nf_conntrack_l3proto_ipv4);
   if (ret < 0) {
       pr_err("nf_conntrack_ipv4: can't register ipv4 proto.\n");
       goto cleanup_icmpv4;
   }

#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
   ret = nf_conntrack_ipv4_compat_init();
   if (ret < 0)
       goto cleanup_proto;
#endif
   return ret;
#if defined(CONFIG_PROC_FS) && defined(CONFIG_NF_CONNTRACK_PROC_COMPAT)
cleanup_proto:
   nf_ct_l3proto_unregister(&nf_conntrack_l3proto_ipv4);
#endif
cleanup_icmpv4:
   nf_ct_l4proto_unregister(&nf_conntrack_l4proto_icmp);
cleanup_udp4:
   nf_ct_l4proto_unregister(&nf_conntrack_l4proto_udp4);
cleanup_tcp4:
   nf_ct_l4proto_unregister(&nf_conntrack_l4proto_tcp4);
cleanup_hooks:
   nf_unregister_hooks(ipv4_conntrack_ops, ARRAY_SIZE(ipv4_conntrack_ops));
cleanup_pernet:
   unregister_pernet_subsys(&ipv4_net_ops);
cleanup_sockopt:
   nf_unregister_sockopt(&so_getorigdst);
   return ret;
}