devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

netfilter分析1-钩子函数在内核的初始化_nf_hook_state

作者：从前慢现在也慢 | 2024-02-28 17:14:18

赞

踩

nf_hook_state

Linux内核中网络防火墙是通过NF_HOOK宏调用钩子函数进行报文处理，本文基于内核版本4.4对钩子函数的初始化流程进行描述。

以过滤本地报文的钩子函数为例。本地报文过滤钩子函数调用宏：
NF_HOOK(NFPROTO_IPV4, NF_INET_LOCAL_IN,

       net, NULL, skb, skb->dev, NULL,

       ip_local_deliver_finish);

这个宏在文件/include/linux/netfilter.h中定义：

  1. static inline int
  2.  
  3. NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,
  4.  
  5. struct net_device *in, struct net_device *out,
  6.  
  7. int (*okfn)(struct net *, struct sock *, struct sk_buff *))
  8.  
  9. {
  10.  
  11. return NF_HOOK_THRESH(pf, hook, net, sk, skb, in, out, okfn, INT_MIN);
  12.  
  13. }
  14.  
  15.  
  16.  
  17. static inline int
  18.  
  19. NF_HOOK_THRESH(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
  20.  
  21.        struct sk_buff *skb, struct net_device *in,
  22.  
  23.        struct net_device *out,
  24.  
  25.        int (*okfn)(struct net *, struct sock *, struct sk_buff *),
  26.  
  27.        int thresh)
  28.  
  29. {
  30.  
  31. int ret = nf_hook_thresh(pf, hook, net, sk, skb, in, out, okfn, thresh);
  32.  
  33. if (ret == 1)
  34.  
  35. ret = okfn(net, sk, skb);
  36.  
  37. return ret;
  38.  
  39. }
  40.  
  41.  
  42.  
  43. static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
  44.  
  45.  struct net *net,
  46.  
  47.  struct sock *sk,
  48.  
  49.  struct sk_buff *skb,
  50.  
  51.  struct net_device *indev,
  52.  
  53.  struct net_device *outdev,
  54.  
  55.  int (*okfn)(struct net *, struct sock *, struct sk_buff *),
  56.  
  57.  int thresh)
  58.  
  59. {
  60.  
  61. struct list_head *hook_list = &net->nf.hooks[pf][hook];
  62.  
  63.  
  64.  
  65. if (nf_hook_list_active(hook_list, pf, hook)) {
  66.  
  67. struct nf_hook_state state;
  68.  
  69.  
  70.  
  71. nf_hook_state_init(&state, hook_list, hook, thresh,
  72.  
  73.    pf, indev, outdev, sk, net, okfn);
  74.  
  75. return nf_hook_slow(skb, &state);
  76.  
  77. }
  78.  
  79. return 1;
  80.  
  81. }

最终通过链表头struct list_head *hook_list = &net->nf.hooks[pf][hook]，这个链表头实际就是所谓的挂载点，后面钩子函数是通过链表的形式挂载到这个链表头下面。

例如过滤本地报文通过遍历执行钩子函数挂载点net->nf.hooks [NFPROTO_IPV4][NF_INET_LOCAL_IN]上的所有钩子函数来实现对报文的过滤处理。

net->nf.hooks [NFPROTO_IPV4][NF_INET_LOCAL_IN]挂载点钩子函数是通过定义在：
net/ipv4/netfilter/iptable_netfilter.c文件中定义的iptable_filter_init进行初始化的

  1. static int __init iptable_filter_init(void)
  2.  
  3. {
  4.  
  5.     int ret;
  6.  
  7.  
  8.  
  9.     ret = register_pernet_subsys(&iptable_filter_net_ops);
  10.  
  11.     if (ret < 0)
  12.  
  13.     return ret;
  14.  
  15.  
  16.  
  17.     /* Register hooks */
  18.  
  19.     filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);
  20.  
  21.     if (IS_ERR(filter_ops)) {
  22.  
  23.         ret = PTR_ERR(filter_ops);
  24.  
  25.         unregister_pernet_subsys(&iptable_filter_net_ops);
  26.  
  27.      }
  28.  
  29.  
  30.  
  31.     return ret;
  32.  
  33. }

该函数中通过xt_hook_link初始化钩子函数，该函数定义在文件：

net/netfilter/x_tables.c

  1. struct nf_hook_ops *xt_hook_link(const struct xt_table *table, nf_hookfn *fn)
  2.  
  3. {
  4.  
  5.      unsigned int hook_mask = table->valid_hooks;
  6.  
  7.     uint8_t i, num_hooks = hweight32(hook_mask);
  8.  
  9.     uint8_t hooknum;
  10.  
  11.     struct nf_hook_ops *ops;
  12.  
  13.     int ret;
  14.  
  15.  
  16.  
  17.     ops = kmalloc(sizeof(*ops) * num_hooks, GFP_KERNEL);
  18.  
  19.     if (ops == NULL)
  20.  
  21.     return ERR_PTR(-ENOMEM);
  22.  
  23.  
  24.  
  25.     for (i = 0, hooknum = 0; i < num_hooks && hook_mask != 0;hook_mask >>= 1, ++hooknum)                 
  26.     {
  27.  
  28.         if (!(hook_mask & 1))
  29.  
  30.         continue;
  31.  
  32.         ops[i].hook     = fn;
  33.  
  34.         ops[i].pf       = table->af;
  35.  
  36.         ops[i].hooknum  = hooknum;
  37.  
  38.         ops[i].priority = table->priority;
  39.  
  40.         ++i;
  41.     }
  42.  
  43.  
  44.  
  45.     ret = nf_register_hooks(ops, num_hooks);
  46.  
  47.     if (ret < 0) {
  48.  
  49.         kfree(ops);
  50.  
  51.         return ERR_PTR(ret);
  52.  
  53.     }
  54.  
  55.  
  56.  
  57.     return ops;
  58. }

参数table是对应的filter表，为了不偏离主题，本文只对钩子函数初始化用到的部分进行简单说明，不对表内容展开详细描述，filter表初始化申明如下：

  1. static const struct xt_table packet_filter = {
  2.  
  3. .name = "filter",
  4.  
  5. .valid_hooks = FILTER_VALID_HOOKS,
  6.  
  7. .me = THIS_MODULE,
  8.  
  9. .af = NFPROTO_IPV4,
  10.  
  11. .priority = NF_IP_PRI_FILTER,
  12.  
  13. };

.priority = NF_IP_PRI_FILTER,对钩子函数优先级进行设置。

.valid_hooks = FILTER_VALID_HOOKS,钩子函数会在以下几个点进行挂载：

#define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \

    (1 << NF_INET_FORWARD) | \

    (1 << NF_INET_LOCAL_OUT))

参数fn是要注册的钩子函数指针，定义如下：

  1. static unsigned int
  2.  
  3. iptable_filter_hook(void *priv, struct sk_buff *skb,
  4.  
  5.     const struct nf_hook_state *state)
  6.  
  7. {
  8.  
  9.     if (state->hook == NF_INET_LOCAL_OUT &&
  10.  
  11.     (skb->len < sizeof(struct iphdr) ||
  12.  
  13.      ip_hdrlen(skb) < sizeof(struct iphdr)))
  14.  
  15.     /* root is playing with raw sockets. */
  16.  
  17.     return NF_ACCEPT;
  18.  
  19.  
  20.  
  21.     return ipt_do_table(skb, state, state->net->ipv4.iptable_filter);
  22.  
  23. }

该函数最终通过ipt_do_table用filter表中的规则对报文进行处理。本文不对表处理进行描述。针对filter表，初始化是只注册了一个相同的钩子函数iptable_filter_hook，该钩子函数注册到了NF_INET_LOCAL_IN、NF_INET_FORWARD、NF_INET_LOCAL_OUT三个挂载点。

钩子函数先存储到struct nf_hook_ops *ops结构中的hook成员，该结构定义如下：

  1. struct nf_hook_ops {
  2.  
  3. struct list_head list;
  4.  
  5.  
  6.  
  7. /* User fills in from here down. */
  8.  
  9. nf_hookfn *hook;
  10.  
  11. struct net_device *dev;
  12.  
  13. void *priv;
  15. u_int8_t pf;
  16.  
  17. unsigned int hooknum;
  18.  
  19. /* Hooks are ordered in ascending priority. */
  20.  
  21. int priority;
  22.  
  23. };

然后nf_register_hooks函数通过结构中的list将钩子函数分别挂载到上面说的

net->nf.hooks [NFPROTO_IPV4][NF_INET_LOCAL_IN]、

net->nf.hooks [NFPROTO_IPV4][ NF_INET_FORWARD]、

net->nf.hooks [NFPROTO_IPV4][ NF_INET_LOCAL_OUT]、

钩子挂载点。

nf_register_hooks定义在文件/net/netfiler/core.c中

  1. int nf_register_hooks(struct nf_hook_ops *reg, unsigned int n)
  2.  
  3. {
  4.  
  5.     unsigned int i;
  6.  
  7.     int err = 0;
  8.  
  9.  
  10.  
  11.     for (i = 0; i < n; i++) {
  12.  
  13.         err = nf_register_hook(®[i]);
  14.  
  15.         if (err)
  16.  
  17.         goto err;
  18.  
  19.     }
  20.  
  21.     return err;
  22.  
  23.  
  24.  
  25.     err:
  26.  
  27.     if (i > 0)
  28.  
  29.     nf_unregister_hooks(reg, i);
  30.  
  31.     return err;
  32.  
  33. }

进一步通过nf_register_hook对钩子函数进行注册，定义如下：

  1. int nf_register_hook(struct nf_hook_ops *reg)
  2.  
  3. {
  4.  
  5.     struct net *net, *last;
  6.  
  7.     int ret;
  8.  
  9.  
  10.  
  11.     rtnl_lock();
  12.  
  13.     for_each_net(net) {
  14.  
  15.         ret = nf_register_net_hook(net, reg);
  16.  
  17.         if (ret && ret != -ENOENT)
  18.  
  19.         goto rollback;
  20.  
  21.     }
  22.  
  23.     list_add_tail(®->list, &nf_hook_list);
  24.  
  25.     rtnl_unlock();
  26.  
  27.  
  28.  
  29.     return 0;
  30.  
  31.     rollback:
  32.  
  33.     last = net;
  34.  
  35.     for_each_net(net) {
  36.  
  37.         if (net == last)
  38.  
  39.         break;
  40.  
  41.         nf_unregister_net_hook(net, reg);
  42.  
  43.     }
  44.  
  45.     rtnl_unlock();
  46.  
  47.     return ret;
  48.  
  49. }

其中进一步通过nf_register_net_hook注册到net->nf.hooks[reg->pf][reg->hooknum]挂载点

  1. int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
  2.  
  3. {
  4.  
  5.     struct list_head *hook_list;
  6.  
  7.     struct nf_hook_entry *entry;
  8.  
  9.     struct nf_hook_ops *elem;
  10.  
  11.  
  12.  
  13.     entry = kmalloc(sizeof(*entry), GFP_KERNEL);
  14.  
  15.     if (!entry)
  16.  
  17.     return -ENOMEM;
  18.  
  19.  
  20.  
  21.     //将nf_hook_ops转存到entty中，这里之所以转存是为了后面方便删除。
  22.  
  23.     entry->orig_ops = reg;
  24.  
  25.     entry->ops = *reg;
  26.  
  27.  
  28.  
  29.     hook_list = nf_find_hook_list(net, reg);
  30.  
  31.     if (!hook_list) {
  32.  
  33.     kfree(entry);
  34.  
  35.     return -ENOENT;
  36.  
  37.     }
  38.  
  39.  
  40.  
  41.     mutex_lock(&nf_hook_mutex);
  42.  
  43.     list_for_each_entry(elem, hook_list, list) {
  44.  
  45.     if (reg->priority < elem->priority)
  46.  
  47.     break;
  48.  
  49.     }
  50.  
  51.     list_add_rcu(&entry->ops.list, elem->list.prev);
  52.  
  53.     mutex_unlock(&nf_hook_mutex);
  54.  
  55.  #ifdef CONFIG_NETFILTER_INGRESS
  56.  
  57.     if (reg->pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
  58.  
  59.     net_inc_ingress_queue();
  60.  
  61.  #endif
  62.  
  63.  #ifdef HAVE_JUMP_LABEL
  64.  
  65.  static_key_slow_inc(&nf_hooks_needed[reg->pf][reg->hooknum]);
  66.  
  67.  #endif
  68.  
  69.  return 0;
  70.  
  71. }

其中通过nf_find_hook_list找到挂载点，没错就是函数中的&net->nf.hooks[reg->pf][reg->hooknum]，终于又遇见你。

  1.  
  2. static struct list_head *nf_find_hook_list(struct net *net,
  3.  
  4.    const struct nf_hook_ops *reg)
  5.  
  6. {
  7.  
  8. struct list_head *hook_list = NULL;
  9.  
  10.  
  11.  
  12. if (reg->pf != NFPROTO_NETDEV)
  13.  
  14. hook_list = &net->nf.hooks[reg->pf][reg->hooknum];
  15.  
  16. else if (reg->hooknum == NF_NETDEV_INGRESS) {
  17.  
  18. #ifdef CONFIG_NETFILTER_INGRESS
  19.  
  20. if (reg->dev && dev_net(reg->dev) == net)
  21.  
  22. hook_list = ®->dev->nf_hooks_ingress;
  23.  
  24. #endif
  25.  
  26. }
  27.  
  28. return hook_list;
  29.  
  30. }

找到挂载点后就可以对钩子函数进行挂载了，挂载过程需要枷锁，然后挂载到对应优先级所在的位置，遍历执行钩子函数时是按优先级执行的，钩子函数中priority越小优先级越高，因此钩子函数也是按照优先级从低到高进行挂载。挂载过程很简单，如下所示：

  1. mutex_lock(&nf_hook_mutex);
  2.  
  3. list_for_each_entry(elem, hook_list, list) {
  4.  
  5. if (reg->priority < elem->priority)
  6.  
  7. break;
  8.  
  9. }
  10.  
  11. list_add_rcu(&entry->ops.list, elem->list.prev);
  12.  
  13. mutex_unlock(&nf_hook_mutex);

到此钩子函数初始化就结束了，通过上面的分析可以得出钩子函数、filter表关系如下图：

该图表示针对NF_INET_LOCAL_IN、NF_INET_FORWARD、NF_INET_LOCAL_OUT挂载点注册了优先级为NF_IP_PRI_FILTER 的钩子函数：iptable_filter_hook，该钩子函数通过对将报文根据filter表中的规则进行处理。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/160435
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号