// 协议/地址簇相关(include/linux/socket)
/* Supported address families */
#define AF_UNSPEC 0
#define AF_UNIX 1 /* Unix domain sockets */
#define AF_LOCAL 1 /* POSIX name for AF_UNIX */
#define AF_INET 2 /* Internet IP Protocol */
#define AF_AX25 3 /* Amateur Radio AX.25 */
...
/* protocol families, same as address families */
#define PF_UNSPEC AF_UNSPEC
#define PF_UNIX AF_UNIX
#define PF_LOCAL AF_LOCAL
#define PF_INET AF_INET
#define PF_AX25 AF_AX25
...
// hook函数的返回值
/* Response from hook functions */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP
// hook点及优先级相关(include/uapi/linux/netfilter_ipv4[6].h)
///< 以下宏定义为userspace中使用的 (include/uapi/linux/netfilter_ipv4.h)
/* IP Hooks */
/* After promisc drops, checksum checks. */
#define NF_IP_PRE_ROUTING 0
/* If the packet is destined for this box */
#define NF_IP_LOCCAL_IN 1
/* If the packet is destined for another interface */
#define NF_IP_FORWARD 2
/* Packets coming from a local process */
#define NF_IP_LOCCAL_OUT 3
/* Packets about to hit the wire */
#define NF_IP_POST_ROUTING 4
#define NF_IP_NUMHOOKS 5
///< 对于内核空间使用的Hook点的定义,使用如下的定义(include/uapi/linux/netfilter.h)
enum nf_inet_hooks {
NF_INET_PRE_ROUTING,
NF_INET_LOCAL_IN,
NF_INET_FORWARD,
NF_INET_LOCAL_OUT,
NF_INET_POST_ROUTING,
NF_INET_NUMHOOKS
};
///< 对于netdev的hook点的定义
enum nf_dev_hooks {
NF_NETDEV_INGRESS,
NF_NETDEV_NUMHOOKS
};
enum {
NFPROTO_UNSPEC = 0,
NFPROTO_INET = 1,
NFPROTO_IPV4 = 2,
NFPROTO_ARP = 3,
NFPROTO_NETDEV = 4,
NFPROTO_BRIDGE = 7,
NFPROTO_IPV6 = 10,
NFPROTO_DECNET = 12,
NFPROTO_NUMPROTO
};
///< (include/uapi/linux/netfilter_ipv4.h)
enum nf_ip_hook_priorities {
NF_IP_PRI_FIRST = INT_MIN,
NF_IP_PRI_CONNTRACK_DEFRAG = -400,
NF_IP_PRI_RAW = -300,
NF_IP_PRI_SELINUX_FIRST = -225,
NF_IP_PRI_CONNTRACK = -200,
NF_IP_PRI_MANGLE = -150,
NF_IP_PRI_NAT_DST = -100,
NF_IP_PRI_FILTER = 0,
NF_IP_PRI_SECURITY = 50,
NF_IP_PRI_NAT_SRC = 100,
NF_IP_PRI_SELINUX_LAST = 225,
NF_IP_PRI_CONNTRACK_HELPER = 300,
NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,
NF_IP_PRI_LAST = INT_MAX,
};
// Standard well-defined IP Protocols(include/uapi/linux/in.h)
/* Standard well-defined IP protocols */
enum {
IPPROTO_IP = 0, /* Dummy protocol for Tcp */
#define IPPROTO_IP IPPROTO_IP
IPPROTO_ICMP = 1, /* Internet control message protocol */
#define IPPROTO_ICMP IPPROTO_ICMP
...
IPPROTO_TCP = 6, /* Transmission control protocol */
#define IPPROTO_TCP IPPROTO_TCP
...
IPPROTO_UDP = 17, /* User Datagram protocol */
#define IPPROTO_UDP IPPROTO_UDP
...
}