Netfilter之协议族初始化--AF_INET

在笔记Netfilter之框架初始化与对外接口中，分析了Netfilter框架的初始化过程以及框架提供给各个协议族的一些标准接口。这篇笔记记录了AF_INET协议族是如何基于Netfilter框架完成自身和Netfilter相关的初始化的，涉及的代码文件如下：

代码路径	说明
net/ipv4/netfilter/ip_tables.c	IPv4 Netfilter核心文件

1. 初始化入口: ip_tables_init()

ip_tables_init()是AF_INET协议族初始化Netfilter子系统的入口函数。

static int __net_init ip_tables_net_init(struct net *net)
{
	//创建目录/proc/sys/net/netfilter/下面和IPv4相关的内容
	return xt_proto_init(net, AF_INET);
}
static struct pernet_operations ip_tables_net_ops = {
	.init = ip_tables_net_init,
	.exit = ip_tables_net_exit,
};
static int __init ip_tables_init(void)
{
	int ret;
	ret = register_pernet_subsys(&ip_tables_net_ops);
	if (ret < 0)
		goto err1;
	//注册2个target、1个match
	ret = xt_register_target(&ipt_standard_target);
	if (ret < 0)
		goto err2;
	ret = xt_register_target(&ipt_error_target);
	if (ret < 0)
		goto err3;
	//icmp相关的match，先忽略
	ret = xt_register_match(&icmp_matchstruct);
	if (ret < 0)
		goto err4;
	//注册getsockopt()和setsockopt()接口
	ret = nf_register_sockopt(&ipt_sockopts);
	if (ret < 0)
		goto err5;
	printk(KERN_INFO "ip_tables: (C) 2000-2006 Netfilter Core Team\n");
	return 0;
...
}
EXPORT_SYMBOL(ipt_register_table);
module_init(ip_tables_init);

1.1 标准target

/* Standard return verdict, or do jump. */
#define XT_STANDARD_TARGET ""
/* Standard return verdict, or do jump. */
#define IPT_STANDARD_TARGET XT_STANDARD_TARGET

/* The built-in targets: standard (NULL) and error. */
static struct xt_target ipt_standard_target __read_mostly = {
	.name		= IPT_STANDARD_TARGET,
	.targetsize	= sizeof(int),
	.family		= AF_INET,
#ifdef CONFIG_COMPAT
	.compatsize	= sizeof(compat_int_t),
	.compat_from_user = compat_standard_from_user,
	.compat_to_user	= compat_standard_to_user,
#endif
};

1.2 错误target

/* Error verdict. */
#define XT_ERROR_TARGET "ERROR"
/* Error verdict. */
#define IPT_ERROR_TARGET XT_ERROR_TARGET
static struct xt_target ipt_error_target __read_mostly = {
	.name		= IPT_ERROR_TARGET,
	.target		= ipt_error,
	.targetsize	= IPT_FUNCTION_MAXNAMELEN,
	.family		= AF_INET,
};