linux 内核协议栈 ip_rcv_finish,Linux内核协议栈学习笔记（二）--netfilter框架

Linux netfilter提供了五个hook的注册点，分别为NF_INET_PRE_ROUTING、NF_INET_LOCAL_IN、NF_INET_FORWARD、NF_INET_LOCAL_OUT、NF_INET_POST_ROUTING。这五个hook点在Linux协议栈中调用之处如下：

NF_INET_PRE_ROUTING --> ip_rcv():

点击(此处)折叠或打开

return NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING, skb, dev, NULL,

ip_rcv_finish)

NF_INET_LOCAL_IN  -->  ip_local_deliver():

点击(此处)折叠或打开

return NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_IN, skb, skb->dev, NULL,

ip_local_deliver_finish)

NF_INET_FORWARD --> ip_forward():

点击(此处)折叠或打开

return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD, skb, skb->dev,

rt->dst.dev, ip_forward_finish);

NF_INET_LOCAL_OUT --> __ip_local_out():

点击(此处)折叠或打开

return nf_hook(NFPROTO_IPV4, NF_INET_LOCAL_OUT, skb, NULL,

skb_dst(skb)->dev, dst_output);

NF_INET_POST_ROUTING --> ip_output():

点击(此处)折叠或打开

return NF_HOOK_COND(NFPROTO_IPV4, NF_INET_POST_ROUTING, skb, NULL, dev,

ip_finish_output,

!(IPCB(skb)->flags & IPSKB_REROUTED));

内核中典型的钩子有：

点击(此处)折叠或打开

一、nf_nat_ipv4_ops

static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {

/* Before packet filtering, change destination */

{

.hook        = nf_nat_ipv4_in,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_PRE_ROUTING,

.priority    = NF_IP_PRI_NAT_DST,

},

/* After packet filtering, change source */

{

.hook        = nf_nat_ipv4_out,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_POST_ROUTING,

.priority    = NF_IP_PRI_NAT_SRC,

},

/* Before packet filtering, change destination */

{

.hook        = nf_nat_ipv4_local_fn,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_OUT,

.priority    = NF_IP_PRI_NAT_DST,

},

/* After packet filtering, change source */

{

.hook        = nf_nat_ipv4_fn,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP_PRI_NAT_SRC,

},

};

二、ipv4_synproxy_ops

static struct nf_hook_ops ipv4_synproxy_ops[] __read_mostly = {

{

.hook        = ipv4_synproxy_hook,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP_PRI_CONNTRACK_CONFIRM - 1,

},

{

.hook        = ipv4_synproxy_hook,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_POST_ROUTING,

.priority    = NF_IP_PRI_CONNTRACK_CONFIRM - 1,

},

};

三、ip_vs_ops

static struct nf_hook_ops ip_vs_ops[] __read_mostly = {

/* After packet filtering, change source only for VS/NAT */

{

.hook        = ip_vs_reply4,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP_PRI_NAT_SRC - 2,

},

/* After packet filtering, forward packet through VS/DR, VS/TUN,

* or VS/NAT(change destination), so that filtering rules can be

* applied to IPVS. */

{

.hook        = ip_vs_remote_request4,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP_PRI_NAT_SRC - 1,

},

/* Before ip_vs_in, change source only for VS/NAT */

{

.hook        = ip_vs_local_reply4,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_OUT,

.priority    = NF_IP_PRI_NAT_DST + 1,

},

/* After mangle, schedule and forward local requests */

{

.hook        = ip_vs_local_request4,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_OUT,

.priority    = NF_IP_PRI_NAT_DST + 2,

},

/* After packet filtering (but before ip_vs_out_icmp), catch icmp

* destined for 0.0.0.0/0, which is for incoming IPVS connections */

{

.hook        = ip_vs_forward_icmp,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_FORWARD,

.priority    = 99,

},

/* After packet filtering, change source only for VS/NAT */

{

.hook        = ip_vs_reply4,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_FORWARD,

.priority    = 100,

},

#ifdef CONFIG_IP_VS_IPV6

/* After mangle & nat fetch 2:nd fragment and following */

{

.hook        = ip_vs_preroute_frag6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV6,

.hooknum    = NF_INET_PRE_ROUTING,

.priority    = NF_IP6_PRI_NAT_DST + 1,

},

/* After packet filtering, change source only for VS/NAT */

{

.hook        = ip_vs_reply6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV6,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP6_PRI_NAT_SRC - 2,

},

/* After packet filtering, forward packet through VS/DR, VS/TUN,

* or VS/NAT(change destination), so that filtering rules can be

* applied to IPVS. */

{

.hook        = ip_vs_remote_request6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV6,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP6_PRI_NAT_SRC - 1,

},

/* Before ip_vs_in, change source only for VS/NAT */

{

.hook        = ip_vs_local_reply6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_OUT,

.priority    = NF_IP6_PRI_NAT_DST + 1,

},

/* After mangle, schedule and forward local requests */

{

.hook        = ip_vs_local_request6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV6,

.hooknum    = NF_INET_LOCAL_OUT,

.priority    = NF_IP6_PRI_NAT_DST + 2,

},

/* After packet filtering (but before ip_vs_out_icmp), catch icmp

* destined for 0.0.0.0/0, which is for incoming IPVS connections */

{

.hook        = ip_vs_forward_icmp_v6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV6,

.hooknum    = NF_INET_FORWARD,

.priority    = 99,

},

/* After packet filtering, change source only for VS/NAT */

{

.hook        = ip_vs_reply6,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV6,

.hooknum    = NF_INET_FORWARD,

.priority    = 100,

},

#endif

};

四、ipv4_conntrack_ops

static struct nf_hook_ops ipv4_conntrack_ops[] __read_mostly = {

{

.hook        = ipv4_conntrack_in,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_PRE_ROUTING,

.priority    = NF_IP_PRI_CONNTRACK,

},

{

.hook        = ipv4_conntrack_local,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_OUT,

.priority    = NF_IP_PRI_CONNTRACK,

},

{

.hook        = ipv4_helper,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_POST_ROUTING,

.priority    = NF_IP_PRI_CONNTRACK_HELPER,

},

{

.hook        = ipv4_confirm,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_POST_ROUTING,

.priority    = NF_IP_PRI_CONNTRACK_CONFIRM,

},

{

.hook        = ipv4_helper,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP_PRI_CONNTRACK_HELPER,

},

{

.hook        = ipv4_confirm,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_LOCAL_IN,

.priority    = NF_IP_PRI_CONNTRACK_CONFIRM,

},

};

五、ipv4_defrag_ops

static struct nf_hook_ops ipv4_defrag_ops[] = {

{

.hook        = ipv4_conntrack_defrag,

.owner        = THIS_MODULE,

.pf        = NFPROTO_IPV4,

.hooknum    = NF_INET_PRE_ROUTING,

.priority    = NF_IP_PRI_CONNTRACK_DEFRAG,

},

{

.hook = ipv4_conntrack_defrag,

.owner = THIS_MODULE,

.pf = NFPROTO_IPV4,

.hooknum = NF_INET_LOCAL_OUT,

.priority = NF_IP_PRI_CONNTRACK_DEFRAG,

},

};

enum nf_ip_hook_priorities {

NF_IP_PRI_FIRST = INT_MIN,

NF_IP_PRI_CONNTRACK_DEFRAG = -400,

NF_IP_PRI_RAW = -300,

NF_IP_PRI_SELINUX_FIRST = -225,

NF_IP_PRI_CONNTRACK = -200,

NF_IP_PRI_MANGLE = -150,

NF_IP_PRI_NAT_DST = -100,

NF_IP_PRI_FILTER = 0,

NF_IP_PRI_SECURITY = 50,

NF_IP_PRI_NAT_SRC = 100,

NF_IP_PRI_SELINUX_LAST = 225,

NF_IP_PRI_CONNTRACK_HELPER = 300,

NF_IP_PRI_CONNTRACK_CONFIRM = INT_MAX,

NF_IP_PRI_LAST = INT_MAX,

};

NF_INET_PRE_ROUTING链：

ipv4_conntrack_in(-200)  ipv4_conntrack_defrag(-400) ip_vs_preroute_frag6(-99) nf_nat_ipv4_in(100)

NF_INET_LOCAL_IN链：

ip_vs_reply4(98) ip_vs_remote_request4(99) ip_vs_reply6(98)ip_vs_remote_request6(99) ipv4_helper(300) nf_nat_ipv4_fn(100) ipv4_synproxy_hook(INT_MAX-1) ipv4_confirm(INT_MAX)

NF_INET_FORWARD链：

ip_vs_forward_icmp(99)  ip_vs_forward_icmp_v6(99) ip_vs_reply4(100) ip_vs_reply6(100)

NF_INET_LOCAL_OUT链：

ipv4_conntrack_defrag(-400) ipv4_conntrack_local(-200) nf_nat_ipv4_local_fn(-100) ip_vs_local_reply4(-99) ip_vs_local_reply6(-99)ip_vs_local_request4(-98) ip_vs_local_request6(-98)

NF_INET_POST_ROUTING链：

nf_nat_ipv4_out(100)  ipv4_helper(300)ipv4_synproxy_hook(INT_MAX-1) ipv4_confirm(INT_MAX)

netfilter框架