本文主要简单介绍arp的收包流程,以及钩子点的使用.
arp的收包主要有两个流程,
1,arp_rcv,主要收包到本地,涉及到的钩子点NF_ARP_IN,NF_ARP_OUT,
2,通过桥接转发,__br_forward最后遍历hook函数,如果是arp包,找到br_nf_forward_arp,
2.1,br_nf_forward_arp,遍历NFPROTO_ARP,NF_ARP_FORWARD找到对应hook
注册 NFPROTO_ARP,NF_ARP_IN钩子arp_hook的堆栈情况
[ 807.704613] arp_hook+0x4e/0x200 [ARP_HOOK]
[ 807.704619] nf_hook_slow+0x43/0xb0
[ 807.704625] arp_rcv+0x156/0x1c0
[ 807.704629] ? arp_req_set+0x260/0x260
[ 807.704634] __netif_receive_skb_one_core+0x56/0x80
[ 807.704637] __netif_receive_skb+0x18/0x60
[ 807.704641] netif_receive_skb_internal+0x3c/0xc0
[ 807.704644] napi_gro_receive+0x79/0xa0
[ 807.704654] igb_poll+0x472/0xeb0 [igb]
[ 807.704659] ? __this_cpu_preempt_check+0x13/0x20
[ 807.704664] net_rx_action+0x141/0x360
[ 807.704670] __do_softirq+0xf0/0x236
[ 807.704675] irq_exit+0xac/0xc0
[ 807.704680] do_IRQ+0x8f/0xf0
[ 807.704684] common_interrupt+0xf/0xf
[ 807.704686] </IRQ>
注册 NFPROTO_ARP,NF_ARP_FORWARD钩子arp_hook的堆栈情况
[75864.040640] arp_hook+0x4e/0x200 [ARP_HOOK]
[75864.040649] ? nf_hook_slow+0x43/0xb0
[75864.040653] nf_hook_slow+0x43/0xb0
[75864.040659] br_nf_forward_arp+0x238/0x290 [br_netfilter]
[75864.040663] ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter]
[75864.040667] nf_hook_slow+0x43/0xb0
[75864.040677] __br_forward+0xb4/0x1c0 [bridge]
[75864.040685] ? br_dev_queue_push_xmit+0x1a0/0x1a0 [bridge]
[75864.040692] deliver_clone+0x32/0x50 [bridge]
[75864.040700] br_forward+0x6b/0x80 [bridge]
[75864.040707] br_handle_frame_finish+0x296/0x400 [bridge]
[75864.040715] br_handle_frame+0x1e1/0x300 [bridge]
[75864.040722] ? br_pass_frame_up+0x110/0x110 [bridge]
[75864.040729] ? br_handle_frame_finish+0x400/0x400 [bridge]
[75864.040734] __netif_receive_skb_core+0x298/0xc60
[75864.040740] __netif_receive_skb_one_core+0x39/0x80
[75864.040743] ? __netif_receive_skb_one_core+0x39/0x80
[75864.040746] __netif_receive_skb+0x18/0x60
[75864.040749] netif_receive_skb_internal+0x3c/0xc0
[75864.040753] napi_gro_receive+0x79/0xa0
[75864.040762] igb_poll+0x472/0xeb0 [igb]
[75864.040767] ? __this_cpu_preempt_check+0x13/0x20
[75864.040771] net_rx_action+0x141/0x360
[75864.040776] __do_softirq+0xf0/0x236
[75864.040783] irq_exit+0xac/0xc0
[75864.040787] do_IRQ+0x8f/0xf0