conntrack删除链表

redwingz

于 2022-10-09 23:00:00 发布

阅读量951

点赞数

分类专栏： netfilter防火墙文章标签： conntrack

本文链接：https://blog.csdn.net/sinat_20184565/article/details/127231902

版权

netfilter防火墙专栏收录该内容

75 篇文章

订阅专栏

在删除conntrack时，首先设置IPS_DYING_BIT标志位，如果此位已经设置，表明conntrack正在被删除。

bool nf_ct_delete(struct nf_conn *ct, u32 portid, int report)
{
    struct nf_conn_tstamp *tstamp;

    if (test_and_set_bit(IPS_DYING_BIT, &ct->status))
        return false;


    nf_conntrack_ecache_work(nf_ct_net(ct));
    nf_ct_delete_from_lists(ct);
    nf_ct_put(ct);

将conntrack由全局的nf_conntrack_hash链表中删除，之后，添加到dying链表中。

static void nf_ct_delete_from_lists(struct nf_conn *ct)
{
    struct net *net = nf_ct_net(ct);
    unsigned int hash, reply_hash;
    unsigned int sequence;

    nf_ct_helper_destroy(ct);

    local_bh_disable();
    do {
        sequence = read_seqcount_begin(&nf_conntrack_generation);
        hash = hash_conntrack(net,
                      &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
        reply_hash = hash_conntrack(net,
                       &ct->tuplehash[IP_CT_DIR_REPLY].tuple);
    } while (nf_conntrack_double_lock(net, hash, reply_hash, sequence));

    clean_from_lists(ct);
    nf_conntrack_double_unlock(hash, reply_hash);

    nf_ct_add_to_dying_list(ct);

要删除的conntrack的原始方向的tuple添加到当前处理器对应的dying链表上。

static void nf_ct_add_to_dying_list(struct nf_conn *ct)
{
    struct ct_pcpu *pcpu;

    /* add this conntrack to the (per cpu) dying list */
    ct->cpu = smp_processor_id();
    pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu);

    spin_lock(&pcpu->lock);
    hlist_nulls_add_head(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
                 &pcpu->dying);
    spin_unlock(&pcpu->lock);

在conntrack引用计数减小到零时，由函数nf_conntrack_destroy进行销毁。

static inline void nf_conntrack_put(struct nf_conntrack *nfct)
{
    if (nfct && atomic_dec_and_test(&nfct->use))
        nf_conntrack_destroy(nfct);
}

最终，在函数destroy_conntrack中，将conntrack由dying链表中删除。

static void
destroy_conntrack(struct nf_conntrack *nfct)
{   
    struct nf_conn *ct = (struct nf_conn *)nfct;
    
    pr_debug("destroy_conntrack(%p)\n", ct);
    WARN_ON(atomic_read(&nfct->use) != 0);
    
    /* Expectations will have been removed in clean_from_lists,
     * except TFTP can create an expectation on the first packet,
     * before connection is in the list, so we need to clean here,
     * too.
     */
    nf_ct_remove_expectations(ct);
    
    nf_ct_del_from_dying_or_unconfirmed_list(ct);

将会话的原始方向的tuple结构由每处理器结构的dying链表中删除。这里的BUG_ON判断确保tuple处于某个链表上。

/* must be called with local_bh_disable */
static void nf_ct_del_from_dying_or_unconfirmed_list(struct nf_conn *ct)
{
    struct ct_pcpu *pcpu;

    /* We overload first tuple to link into unconfirmed or dying list.*/
    pcpu = per_cpu_ptr(nf_ct_net(ct)->ct.pcpu_lists, ct->cpu);

    spin_lock(&pcpu->lock);
    BUG_ON(hlist_nulls_unhashed(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode));
    hlist_nulls_del_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode);
    spin_unlock(&pcpu->lock);

内核版本 5.10