首页 > 代码库 > netfilter-IPv4实现框架分析(一)
netfilter-IPv4实现框架分析(一)
基于Linux-2.6.30版本，具体实现net\ipv4\netfilter目录下，入口文件为net\ipv4\netfilter\iptable_filter.c，入口/出口函数为模块的init函数iptable_filter_init()和uninit函数iptable_filter_fini()
iptable_filter_init()函数流程如下
1、register_pernet_subsys(&iptable_filter_net_ops)，其作用初步看是用于注册报文匹配目标规则，暂不分析。
2、nf_register_hooks(ipt_ops, ARRAY_SIZE(ipt_ops)); 该调用既是将filter类型table的hook这侧到netfilter的核心框架中。其中ipt_ops既是记录了具体hook处理实现内容，如下
1 static struct nf_hook_ops ipt_ops[] __read_mostly = { 2 3 { 4 5 .hook = ipt_local_in_hook, 6 7 .owner = THIS_MODULE, 8 9 .pf = PF_INET,10 11 .hooknum = NF_INET_LOCAL_IN,12 13 .priority = NF_IP_PRI_FILTER,14 15 },16 17 {18 19 .hook = ipt_hook,20 21 .owner = THIS_MODULE,22 23 .pf = PF_INET,24 25 .hooknum = NF_INET_FORWARD,26 27 .priority = NF_IP_PRI_FILTER,28 29 },30 31 {32 33 .hook = ipt_local_out_hook,34 35 .owner = THIS_MODULE,36 37 .pf = PF_INET,38 39 .hooknum = NF_INET_LOCAL_OUT,40 41 .priority = NF_IP_PRI_FILTER,42 43 },44 45 };
以chain INPUT的实现为例，
hook成员即表示具体的hook处理函数，当报文匹配上本规则后，在报文向上层protocol layer上送之前，会被调用。具体见后面进一步分析。
pf即protocol family，表示处理报文的协议类型。
hooknum其实表示本pf下的hook类型，此处处理入方向的报文，与iptables命令工具中INPUT、FORWARD、OUTPUT基本相对应。
priority表示本条chain的优先级。
需要特别注意一下，后续实际注册chain处理规则时，既是利用pf、hooknum、priority将各个chain保存到nf_hooks中的对应位置。后续在netfilter的核心系统中，即根据pf/hooknum查找与之对应的hook，并按照priority指定的优先级一次调用各个hook函数。
现在看看具体filter hook函数是怎么调用的，对net/ipv4/中的代码进行grep，结果如下
1 [root@arch ipv4]# grep -n NF_HOOK *.c 2 3 arp.c:666: NF_HOOK(NFPROTO_ARP, NF_ARP_OUT, skb, NULL, skb->dev, dev_queue_xmit); 4 5 arp.c:934: return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process); 6 7 ip_forward.c:114: return NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, rt->u.dst.dev, 8 9 ip_input.c:268: return NF_HOOK(PF_INET, NF_INET_LOCAL_IN, skb, skb->dev, NULL,10 11 ip_input.c:440: return NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, dev, NULL,12 13 ip_output.c:272: NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb,14 15 ip_output.c:288: NF_HOOK(PF_INET, NF_INET_POST_ROUTING, newskb, NULL,16 17 ip_output.c:292: return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, skb->dev,18 19 ip_output.c:306: return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, dev,20 21 ipmr.c:1319: NF_HOOK(PF_INET, NF_INET_FORWARD, skb, skb->dev, dev,22 23 raw.c:375: err = NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,24 25 xfrm4_input.c:63: NF_HOOK(PF_INET, NF_INET_PRE_ROUTING, skb, skb->dev, NULL,26 27 xfrm4_output.c:89: return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb,28 29 [root@arch ipv4]# pwd30 31 /root/linux-2.6.30/net/ipv432 33 [root@arch ipv4]#
补充说明：NF_HOOK宏既是netfilter系统在报文处理的地方，插入hook的功能宏，其实现如下
1 #ifdef CONFIG_NETFILTER 2 3 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) 4 5 NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, INT_MIN) 6 7 #else 8 9 #define NF_HOOK(pf, hook, skb, indev, outdev, okfn) (okfn)(skb)10 11 #endif
在上面的grep结果中，ip_input.c对INPUT方向中，利用NF_HOOK放置的报文处理hook实现为
1 /* 2 3 * Deliver IP Packets to the higher protocol layers. 4 5 */ 6 7 int ip_local_deliver(struct sk_buff *skb) 8 9 {10 11 /*12 13 * Reassemble IP fragments.14 15 */16 17 18 19 if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {20 21 if (ip_defrag(skb, IP_DEFRAG_LOCAL_DELIVER))22 23 return 0;24 25 }26 27 28 29 return NF_HOOK(PF_INET, NF_INET_LOCAL_IN, skb, skb->dev, NULL,30 31 ip_local_deliver_finish);32 33 }34 35 NF_HOOK_THRESH宏实现如下36 37 #ifdef CONFIG_NETFILTER38 39 #define NF_HOOK_THRESH(pf, hook, skb, indev, outdev, okfn, thresh) 40 41 ({int __ret; 42 43 if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, thresh, 1)) == 1)44 45 __ret = (okfn)(skb); 46 47 __ret;})48 49 #endif
可见，协议栈是在将ip报文向上一层的协议处理层上送报文的时刻，调用netfilter的hook函数的，可见若系统没有配置netfilter，NF_HOOK实际将直接调用协议扎自身的上送函数，反之若配置了netfilter，则先经过netfilter处理之后再根据结果做区分处理。
Nf_hook_thresh()的实现又做了进一步区分实现，如下
1 #ifdef CONFIG_NETFILTER 2 3 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook, 4 5 struct sk_buff *skb, 6 7 struct net_device *indev, 8 9 struct net_device *outdev,10 11 int (*okfn)(struct sk_buff *), int thresh,12 13 int cond)14 15 {16 17 if (!cond)18 19 return 1;20 21 #ifndef CONFIG_NETFILTER_DEBUG22 23 if (list_empty(&nf_hooks[pf][hook]))24 25 return 1;26 27 #endif28 29 return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);30 31 }32 33 #else34 35 static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,36 37 struct sk_buff *skb,38 39 struct net_device *indev,40 41 struct net_device *outdev,42 43 int (*okfn)(struct sk_buff *), int thresh,44 45 int cond)46 47 {48 49 return okfn(skb);50 51 }52 53 #endif
可见最终在netfilter系统中，hook调用的入口是nf_hook_slow，其实现很直观，如下
1 /* Returns 1 if okfn() needs to be executed by the caller, 2 3 * -EPERM for NF_DROP, 0 otherwise. */ 4 5 int nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb, 6 7 struct net_device *indev, 8 9 struct net_device *outdev,10 11 int (*okfn)(struct sk_buff *),12 13 int hook_thresh)14 15 {16 17 struct list_head *elem;18 19 unsigned int verdict;20 21 int ret = 0;22 23 24 25 /* We may already have this, but read-locks nest anyway */26 27 rcu_read_lock();28 29 30 31 elem = &nf_hooks[pf][hook]; // pf -> NFPROTO_IPV4, NFPROTO_ARP,NFPROTO_BRIDGE,PF_INET etc32 33 next_hook: // hook -> 0~734 35 verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,36 37 outdev, &elem, okfn, hook_thresh);38 39 if (verdict == NF_ACCEPT || verdict == NF_STOP) {40 41 ret = 1;42 43 } else if (verdict == NF_DROP) {44 45 kfree_skb(skb);46 47 ret = -EPERM;48 49 } else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {50 51 if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,52 53 verdict >> NF_VERDICT_BITS))54 55 goto next_hook;56 57 }58 59 rcu_read_unlock();60 61 return ret;62 63 }
基本流程就是利用pf/hook在nf_hooks[][]中找到前期注册的hook，然后遍历调用hook中各个处理函数，根据hook处理函数返回结果，对当前报文做区分处理。其实按优先级进行遍历，不体现在调用的地方，而是在注册的地方，调用既是按照优先级排序好的顺序依次调用各个函数而已。nf_iterate()函数实现如下
1 unsigned int nf_iterate(struct list_head *head, 2 3 struct sk_buff *skb, 4 5 unsigned int hook, 6 7 const struct net_device *indev, 8 9 const struct net_device *outdev,10 11 struct list_head **i,12 13 int (*okfn)(struct sk_buff *),14 15 int hook_thresh)16 17 {18 19 unsigned int verdict;20 21 22 23 /*24 25 * The caller must not block between calls to this26 27 * function because of risk of continuing from deleted element.28 29 */30 31 list_for_each_continue_rcu(*i, head) {32 33 struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;34 35 36 37 if (hook_thresh > elem->priority)38 39 continue;40 41 42 43 /* Optimization: we don‘t need to hold module44 45 reference here, since function can‘t sleep. --RR */46 47 verdict = elem->hook(hook, skb, indev, outdev, okfn);48 49 if (verdict != NF_ACCEPT) {50 51 #ifdef CONFIG_NETFILTER_DEBUG52 53 if (unlikely((verdict & NF_VERDICT_MASK)54 55 > NF_MAX_VERDICT)) {56 57 NFDEBUG("Evil return from %p(%u).\n",58 59 elem->hook, hook);60 61 continue;62 63 }64 65 #endif66 67 if (verdict != NF_REPEAT)68 69 return verdict;70 71 *i = (*i)->prev;72 73 }74 75 }76 77 return NF_ACCEPT;78 79 }
注意红色部分，可以看出，仅当是每一个规则返回结果为NF_ACCEPT时，才继续处理本类型hook中下一个优先级的；若本次的hook函数返回NF_REPEAT，则将当前packet的在本次hook函数上再执行依次；其他情况直接返回hook函数执行结果。
Nf_iterate()返回到nf_hook_slow()函数之后，nf_hook_slow即根据执行结果，做区分处理， 若是ACCEPT或STOP，本packet在netfilter处理过程完毕，后续继续调用packet上报函数
若是DROP，本packet将被释放丢弃，不再调用packet上报函数
若包含QUEUE，则将packet送入当前chain对应的队列中，再做对应的处理，在iptables的命令帮助中，说明如下
QUEUE means to pass the packet to userspace. (How the packet can be received by a userspace process differs by the particular queue handler. 2.4.x and 2.6.x kernels up to 2.6.13 include the ip_queue queue handler. Kernels 2.6.14 and later additionally include the nfnetlink_queue queue handler. Packets with a target of QUEUE will be sent to queue number ‘0‘ in this case. Please also see the NFQUEUE target as described later in this man page.)
基本的报文处理流程既是如上面所述，接下来是具体过滤处理实现流程，以决定对应对packet的处理结果，以IPv4报文入方向过滤处理为例，具体既是
1 static struct nf_hook_ops ipt_ops[] __read_mostly = { 2 3 { 4 5 .hook = ipt_local_in_hook, 6 7 .owner = THIS_MODULE, 8 9 .pf = PF_INET,10 11 .hooknum = NF_INET_LOCAL_IN,12 13 .priority = NF_IP_PRI_FILTER,14 15 }16 17 ...18 19 };
即ipt_local_in_hook函数，其实现既将报文针对之前添加的规则，与packet做匹配检查，并返回预先设置的结果。