[netfilter]--arp的主要流程

本文主要简单介绍arp的收包流程,以及钩子点的使用.

arp的收包主要有两个流程,

1,arp_rcv,主要收包到本地,涉及到的钩子点NF_ARP_IN,NF_ARP_OUT,

2,通过桥接转发,__br_forward最后遍历hook函数,如果是arp包,找到br_nf_forward_arp,

2.1,br_nf_forward_arp,遍历NFPROTO_ARP,NF_ARP_FORWARD找到对应hook

注册 NFPROTO_ARP,NF_ARP_IN钩子arp_hook的堆栈情况

[  807.704613]  arp_hook+0x4e/0x200 [ARP_HOOK]
[  807.704619]  nf_hook_slow+0x43/0xb0
[  807.704625]  arp_rcv+0x156/0x1c0
[  807.704629]  ? arp_req_set+0x260/0x260
[  807.704634]  __netif_receive_skb_one_core+0x56/0x80
[  807.704637]  __netif_receive_skb+0x18/0x60
[  807.704641]  netif_receive_skb_internal+0x3c/0xc0
[  807.704644]  napi_gro_receive+0x79/0xa0
[  807.704654]  igb_poll+0x472/0xeb0 [igb]
[  807.704659]  ? __this_cpu_preempt_check+0x13/0x20
[  807.704664]  net_rx_action+0x141/0x360
[  807.704670]  __do_softirq+0xf0/0x236
[  807.704675]  irq_exit+0xac/0xc0
[  807.704680]  do_IRQ+0x8f/0xf0
[  807.704684]  common_interrupt+0xf/0xf
[  807.704686]  </IRQ>

注册 NFPROTO_ARP,NF_ARP_FORWARD钩子arp_hook的堆栈情况

[75864.040640]  arp_hook+0x4e/0x200 [ARP_HOOK]
[75864.040649]  ? nf_hook_slow+0x43/0xb0
[75864.040653]  nf_hook_slow+0x43/0xb0
[75864.040659]  br_nf_forward_arp+0x238/0x290 [br_netfilter]
[75864.040663]  ? br_nf_hook_thresh+0xf0/0xf0 [br_netfilter]
[75864.040667]  nf_hook_slow+0x43/0xb0
[75864.040677]  __br_forward+0xb4/0x1c0 [bridge]
[75864.040685]  ? br_dev_queue_push_xmit+0x1a0/0x1a0 [bridge]
[75864.040692]  deliver_clone+0x32/0x50 [bridge]
[75864.040700]  br_forward+0x6b/0x80 [bridge]
[75864.040707]  br_handle_frame_finish+0x296/0x400 [bridge]
[75864.040715]  br_handle_frame+0x1e1/0x300 [bridge]
[75864.040722]  ? br_pass_frame_up+0x110/0x110 [bridge]
[75864.040729]  ? br_handle_frame_finish+0x400/0x400 [bridge]
[75864.040734]  __netif_receive_skb_core+0x298/0xc60
[75864.040740]  __netif_receive_skb_one_core+0x39/0x80
[75864.040743]  ? __netif_receive_skb_one_core+0x39/0x80
[75864.040746]  __netif_receive_skb+0x18/0x60
[75864.040749]  netif_receive_skb_internal+0x3c/0xc0
[75864.040753]  napi_gro_receive+0x79/0xa0
[75864.040762]  igb_poll+0x472/0xeb0 [igb]
[75864.040767]  ? __this_cpu_preempt_check+0x13/0x20
[75864.040771]  net_rx_action+0x141/0x360
[75864.040776]  __do_softirq+0xf0/0x236
[75864.040783]  irq_exit+0xac/0xc0
[75864.040787]  do_IRQ+0x8f/0xf0