devbox
羊村懒王
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Linux netfilter hook源码分析（基于内核代码版本4.18.0-80）

作者：羊村懒王 | 2024-02-28 17:18:36

赞

踩

Linux netfilter hook源码分析（基于内核代码版本4.18.0-80）

Netfilter在网络层实现的详细分析见下面文章：

linux Netfilter在网络层的实现详细分析（iptables）_yg@hunter的博客-CSDN博客

本文分析的源码版本为4.18.0-80。

4.3以下的内核版本是通过nf_register_hook来注册，nf_unregister_hook来注销；

4.3-4.13之间版本，nf_register_hook里面会调用nf_register_net_hook来逐个net命名空间注册，此时可以使用这俩函数中的任一个来注册，注销对应nf_unregister_hook/nf_unregister_net_hook；

4.13及以上版本内核是通过nf_register_net_hook/nf_unregister_net_hook来注册/注销，删掉了nf_register_hook函数。

我画了张图，描述了netfilter hook的整个过程所涉及的数据结构(基于内核代码版本4.18.0-80)：

目录

1、钩子函数的注册

2、自定义hook钩子函数的调用链

①内核网络协议栈中安装的钩子

②调用nf_hook函数

③调用nf_hook_slow函数

④调用内联函数nf_hook_entry_hookfn

⑤最终就调用到hook_entry的hook回调函数

⑥钩子函数的返回值

3、钩子函数的注销

⑴nf_unregister_net_hook

⑵__nf_unregister_net_hook

①nf_remove_net_hook

②__nf_hook_entries_try_shrink

③nf_queue_nf_hook_drop

④nf_hook_entries_free

1、钩子函数的注册

nf_register_net_hook函数的源码如下：

net\netfilter\core.c

  1. int nf_register_net_hook(struct net *net, const struct nf_hook_ops *reg)
  2. {
  3. 	int err;
  4.  
  5. 	if (reg->pf == NFPROTO_INET) { // inet协议包含ipv4、ipv6
  6. 		err = __nf_register_net_hook(net, NFPROTO_IPV4, reg);
  7. 		if (err < 0)
  8. 			return err;
  9.  
  10. 		err = __nf_register_net_hook(net, NFPROTO_IPV6, reg);
  11. 		if (err < 0) {
  12. 			__nf_unregister_net_hook(net, NFPROTO_IPV4, reg);
  13. 			return err;
  14. 		}
  15. 	} else {
  16. 		err = __nf_register_net_hook(net, reg->pf, reg);
  17. 		if (err < 0)
  18. 			return err;
  19. 	}
  20.  
  21. 	return 0;
  22. }
  23. EXPORT_SYMBOL(nf_register_net_hook);

对于注册的hook协议类型为NFPROTO_INET的话，会先后注册ipv4、ipv6的hook，然后会根据注册的协议类型调用__nf_register_net_hook函数：

  1. static int __nf_register_net_hook(struct net *net, int pf,
  2. 				  const struct nf_hook_ops *reg)
  3. {
  4. 	struct nf_hook_entries *p, *new_hooks;
  5. 	struct nf_hook_entries __rcu **pp;
  6.  
  7.     //处理netdev层的ingress hook点
  8. 	if (pf == NFPROTO_NETDEV) {
  9. #ifndef CONFIG_NETFILTER_INGRESS
  10. 		if (reg->hooknum == NF_NETDEV_INGRESS)
  11. 			return -EOPNOTSUPP;
  12. #endif
  13. 		if (reg->hooknum != NF_NETDEV_INGRESS ||
  14. 		    !reg->dev || dev_net(reg->dev) != net)
  15. 			return -EINVAL;
  16. 	}
  17.     
  18.     //获取该协议下对应hook点的数组首地址
  19. 	pp = nf_hook_entry_head(net, pf, reg->hooknum, reg->dev);
  20. 	if (!pp)
  21. 		return -EINVAL;
  22.  
  23. 	mutex_lock(&nf_hook_mutex);
  24.  
  25. 	p = nf_entry_dereference(*pp);
  26.  
  27.     //将新reg插入到该数组，里面重新为该数组申请空间，然后会按priority排序好，重新插入所有的hook
  28. 	new_hooks = nf_hook_entries_grow(p, reg);
  29.  
  30. 	if (!IS_ERR(new_hooks))
  31. 		rcu_assign_pointer(*pp, new_hooks);
  32.  
  33. 	mutex_unlock(&nf_hook_mutex);
  34. 	if (IS_ERR(new_hooks))
  35. 		return PTR_ERR(new_hooks);
  36.  
  37. 	hooks_validate(new_hooks);
  38. #ifdef CONFIG_NETFILTER_INGRESS
  39. 	if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
  40. 		net_inc_ingress_queue();
  41. #endif
  42. #ifdef HAVE_JUMP_LABEL
  43. 	static_key_slow_inc(&nf_hooks_needed[pf][reg->hooknum]);
  44. #endif
  45. 	BUG_ON(p == new_hooks);
  46. 	nf_hook_entries_free(p);
  47. 	return 0;
  48. }

nf_hook_entries 获取对应协议的对应hook链的首地址：

  1. static struct nf_hook_entries __rcu **
  2. nf_hook_entry_head(struct net *net, int pf, unsigned int hooknum,
  3. 		   struct net_device *dev)
  4. {
  5. 	switch (pf) {
  6. 	case NFPROTO_NETDEV:
  7. 		break;
  8. #ifdef CONFIG_NETFILTER_FAMILY_ARP
  9. 	case NFPROTO_ARP:
  10. 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_arp) <= hooknum))
  11. 			return NULL;
  12. 		return net->nf.hooks_arp + hooknum;
  13. #endif
  14. #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
  15. 	case NFPROTO_BRIDGE:
  16. 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_bridge) <= hooknum))
  17. 			return NULL;
  18. 		return net->nf.hooks_bridge + hooknum;
  19. #endif
  20. 	case NFPROTO_IPV4:
  21. 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv4) <= hooknum))
  22. 			return NULL;
  23. 		return net->nf.hooks_ipv4 + hooknum;
  24. 	case NFPROTO_IPV6:
  25. 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_ipv6) <= hooknum))
  26. 			return NULL;
  27. 		return net->nf.hooks_ipv6 + hooknum;
  28. #if IS_ENABLED(CONFIG_DECNET)
  29. 	case NFPROTO_DECNET:
  30. 		if (WARN_ON_ONCE(ARRAY_SIZE(net->nf.hooks_decnet) <= hooknum))
  31. 			return NULL;
  32. 		return net->nf.hooks_decnet + hooknum;
  33. #endif
  34. 	default:
  35. 		WARN_ON_ONCE(1);
  36. 		return NULL;
  37. 	}
  38.  
  39. #ifdef CONFIG_NETFILTER_INGRESS
  40. 	if (hooknum == NF_NETDEV_INGRESS) {
  41. 		if (dev && dev_net(dev) == net)
  42. 			return &dev->nf_hooks_ingress;
  43. 	}
  44. #endif
  45. 	WARN_ON_ONCE(1);
  46. 	return NULL;
  47. }

然后调用nf_hook_entries_grow将要注册的hook按优先级priority插入到该链中：

  1. static struct nf_hook_entries *
  2. nf_hook_entries_grow(const struct nf_hook_entries *old,
  3. 		     const struct nf_hook_ops *reg)
  4. {
  5. 	unsigned int i, alloc_entries, nhooks, old_entries;
  6. 	struct nf_hook_ops **orig_ops = NULL;
  7. 	struct nf_hook_ops **new_ops;
  8. 	struct nf_hook_entries *new;
  9. 	bool inserted = false;
  10.  
  11. 	alloc_entries = 1;
  12. 	old_entries = old ? old->num_hook_entries : 0;
  13.  
  14. 	if (old) {
  15. 		orig_ops = nf_hook_entries_get_hook_ops(old);
  16.  
  17. 		for (i = 0; i < old_entries; i++) {
  18. 			if (orig_ops[i] != &dummy_ops)
  19. 				alloc_entries++;
  20. 		}
  21. 	}
  22.  
  23. 	if (alloc_entries > MAX_HOOK_COUNT)
  24. 		return ERR_PTR(-E2BIG);
  25.  
  26. 	new = allocate_hook_entries_size(alloc_entries);
  27. 	if (!new)
  28. 		return ERR_PTR(-ENOMEM);
  29.  
  30. 	new_ops = nf_hook_entries_get_hook_ops(new);
  31.  
  32. 	i = 0;
  33. 	nhooks = 0;
  34. 	while (i < old_entries) {
  35. 		if (orig_ops[i] == &dummy_ops) {
  36. 			++i;
  37. 			continue;
  38. 		}
  39.  
  40. 		if (inserted || reg->priority > orig_ops[i]->priority) {
  41. 			new_ops[nhooks] = (void *)orig_ops[i];
  42. 			new->hooks[nhooks] = old->hooks[i];
  43. 			i++;
  44. 		} else {
  45. 			new_ops[nhooks] = (void *)reg;
  46. 			new->hooks[nhooks].hook = reg->hook;
  47. 			new->hooks[nhooks].priv = reg->priv;
  48. 			inserted = true;
  49. 		}
  50. 		nhooks++;
  51. 	}
  52.  
  53. 	if (!inserted) {
  54. 		new_ops[nhooks] = (void *)reg;
  55. 		new->hooks[nhooks].hook = reg->hook;
  56. 		new->hooks[nhooks].priv = reg->priv;
  57. 	}
  58.  
  59. 	return new;
  60. }

2、自定义hook钩子函数的调用链

  1. 内核网络协议栈的各hook点
  2. 	->NF_HOOK/NF_HOOK_COND
  3. 		->nf_hook()
  4. 			-> nf_hook_slow()
  5. 				-> nf_hook_entry_hookfn()
  6. 					-> entry->hook()

①内核网络协议栈中安装的钩子

会在相关位置调用NF_HOOK/NF_HOOK_COND宏，触发钩子函数：

include\linux\netfilter.h

  1. static inline int
  2. NF_HOOK_COND(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk,
  3. 	     struct sk_buff *skb, struct net_device *in, struct net_device *out,
  4. 	     int (*okfn)(struct net *, struct sock *, struct sk_buff *),
  5. 	     bool cond)
  6. {
  7. 	int ret;
  8.  
  9. 	if (!cond ||
  10. 	    ((ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn)) == 1))
  11. 		ret = okfn(net, sk, skb);
  12. 	return ret;
  13. }
  14.  
  15. static inline int
  16. NF_HOOK(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct sk_buff *skb,
  17. 	struct net_device *in, struct net_device *out,
  18. 	int (*okfn)(struct net *, struct sock *, struct sk_buff *))
  19. {
  20. 	int ret = nf_hook(pf, hook, net, sk, skb, in, out, okfn);
  21. 	if (ret == 1)
  22. 		ret = okfn(net, sk, skb);
  23. 	return ret;
  24. }

比如，net\ipv4\ip_input.c中，进入本地的网络数据包，会调用NF_HOOK触发NF_INET_LOCAL_IN钩子：

②调用nf_hook函数

实际执行时调用nf_hook函数，函数定义如下：

include\linux\netfilter.h

  1. /**
  2.  *	nf_hook - call a netfilter hook
  3.  *
  4.  *	Returns 1 if the hook has allowed the packet to pass.  The function
  5.  *	okfn must be invoked by the caller in this case.  Any other return
  6.  *	value indicates the packet has been consumed by the hook.
  7.  */
  8. static inline int nf_hook(u_int8_t pf, unsigned int hook, struct net *net,
  9. 			  struct sock *sk, struct sk_buff *skb,
  10. 			  struct net_device *indev, struct net_device *outdev,
  11. 			  int (*okfn)(struct net *, struct sock *, struct sk_buff *))
  12. {
  13. 	struct nf_hook_entries *hook_head = NULL;
  14. 	int ret = 1;
  15.  
  16. #ifdef HAVE_JUMP_LABEL
  17. 	if (__builtin_constant_p(pf) &&
  18. 	    __builtin_constant_p(hook) &&
  19. 	    !static_key_false(&nf_hooks_needed[pf][hook]))
  20. 		return 1;
  21. #endif
  22.  
  23. 	rcu_read_lock();
  24.  
  25.     //根据传入的协议类型，及hook点，获取对应hook链的数组首地址
  26. 	switch (pf) {
  27. 	case NFPROTO_IPV4:
  28. 		hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]);
  29. 		break;
  30. 	case NFPROTO_IPV6:
  31. 		hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]);
  32. 		break;
  33. 	case NFPROTO_ARP:
  34. #ifdef CONFIG_NETFILTER_FAMILY_ARP
  35. 		hook_head = rcu_dereference(net->nf.hooks_arp[hook]);
  36. #endif
  37. 		break;
  38. 	case NFPROTO_BRIDGE:
  39. #ifdef CONFIG_NETFILTER_FAMILY_BRIDGE
  40. 		hook_head = rcu_dereference(net->nf.hooks_bridge[hook]);
  41. #endif
  42. 		break;
  43. #if IS_ENABLED(CONFIG_DECNET)
  44. 	case NFPROTO_DECNET:
  45. 		hook_head = rcu_dereference(net->nf.hooks_decnet[hook]);
  46. 		break;
  47. #endif
  48. 	default:
  49. 		WARN_ON_ONCE(1);
  50. 		break;
  51. 	}
  52.  
  53. 	if (hook_head) {
  54. 		struct nf_hook_state state;
  55.  
  56. 		nf_hook_state_init(&state, hook, pf, indev, outdev,
  57. 				   sk, net, okfn);
  58.         
  59.         //最后进入nf_hook_slow函数流程
  60. 		ret = nf_hook_slow(skb, &state, hook_head, 0);
  61. 	}
  62. 	rcu_read_unlock();
  63.  
  64. 	return ret;
  65. }

③调用nf_hook_slow函数

根据传入的协议类型，及hook点，获取对应hook链的数组首地址后，最终调用nf_hook_slow函数：

net\netfilter\core.c

  1. /* Returns 1 if okfn() needs to be executed by the caller,
  2.  * -EPERM for NF_DROP, 0 otherwise.  Caller must hold rcu_read_lock. */
  3. int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state,
  4. 		 const struct nf_hook_entries *e, unsigned int s)
  5. {
  6. 	unsigned int verdict;
  7. 	int ret;
  8.  
  9. 	for (; s < e->num_hook_entries; s++) {
  10.         // 调用对应钩子函数 
  11. 		verdict = nf_hook_entry_hookfn(&e->hooks[s], skb, state);
  12.  
  13.         // 判断钩子函数的返回值,决定该数据包的后续处理流程
  14. 		switch (verdict & NF_VERDICT_MASK) {
  15. 		case NF_ACCEPT: // 允许数据包继续下一步
  16. 			break;
  17. 		case NF_DROP: // 丢弃该数据包，直接返回EPERM
  18. 			kfree_skb(skb);
  19. 			ret = NF_DROP_GETERR(verdict);
  20. 			if (ret == 0)
  21. 				ret = -EPERM;
  22. 			return ret;
  23. 		case NF_QUEUE: // 数据包加入用户队列，给用户程序处理，然后返回
  24. 			ret = nf_queue(skb, state, e, s, verdict);
  25. 			if (ret == 1)
  26. 				continue;
  27. 			return ret;
  28. 		default: // NF_STOLEN，让netfilter框架忽略该数据包的处理
  29. 			/* Implicit handling for NF_STOLEN, as well as any other
  30. 			 * non conventional verdicts.
  31. 			 */
  32. 			return 0;
  33. 		}
  34. 	}
  35.  
  36. 	return 1;
  37. }
  38. EXPORT_SYMBOL(nf_hook_slow);

④调用内联函数nf_hook_entry_hookfn

include\linux\netfilter.h

  1. static inline int
  2. nf_hook_entry_hookfn(const struct nf_hook_entry *entry, struct sk_buff *skb,
  3. 		     struct nf_hook_state *state)
  4. {
  5. 	return entry->hook(entry->priv, skb, state);
  6. }

⑤最终就调用到hook_entry的hook回调函数

此时entry->hook就是我们自定义的nf_hook_ops中的hook函数了。

⑥钩子函数的返回值

它的返回值为以下几种：

include\uapi\linux\netfilter.h

  1. /* Responses from hook functions. */
  2. #define NF_DROP 0 // 丢弃该数据包
  3. #define NF_ACCEPT 1 // 当前hook点，允许该数据包继续在协议栈中流转
  4. #define NF_STOLEN 2 // 让netfilter框架忽略该数据包的处理
  5. #define NF_QUEUE 3 // 该数据包加入到用户队列，供用户程序处理
  6. #define NF_REPEAT 4
  7. #define NF_STOP 5	/* Deprecated, for userspace nf_queue compatibility. */
  8. #define NF_MAX_VERDICT NF_STOP

3、钩子函数的注销

net\netfilter\core.c

⑴nf_unregister_net_hook

  1. void nf_unregister_net_hook(struct net *net, const struct nf_hook_ops *reg)
  2. {
  3. 	if (reg->pf == NFPROTO_INET) {
  4. 		__nf_unregister_net_hook(net, NFPROTO_IPV4, reg);
  5. 		__nf_unregister_net_hook(net, NFPROTO_IPV6, reg);
  6. 	} else {
  7. 		__nf_unregister_net_hook(net, reg->pf, reg);
  8. 	}
  9. }
  10. EXPORT_SYMBOL(nf_unregister_net_hook);

⑵__nf_unregister_net_hook

跟注册类似处理之后，里面会调用__nf_unregister_net_hook函数：

  1. static void __nf_unregister_net_hook(struct net *net, int pf,
  2. 				     const struct nf_hook_ops *reg)
  3. {
  4. 	struct nf_hook_entries __rcu **pp;
  5. 	struct nf_hook_entries *p;
  6.  
  7. 	pp = nf_hook_entry_head(net, pf, reg->hooknum, reg->dev);
  8. 	if (!pp)
  9. 		return;
  10.  
  11. 	mutex_lock(&nf_hook_mutex);
  12.  
  13. 	p = nf_entry_dereference(*pp);
  14. 	if (WARN_ON_ONCE(!p)) {
  15. 		mutex_unlock(&nf_hook_mutex);
  16. 		return;
  17. 	}
  18.  
  19.     // 将该hook从对应hook数组中移除
  20. 	if (nf_remove_net_hook(p, reg)) {
  21. #ifdef CONFIG_NETFILTER_INGRESS
  22. 		if (pf == NFPROTO_NETDEV && reg->hooknum == NF_NETDEV_INGRESS)
  23. 			net_dec_ingress_queue();
  24. #endif
  25. #ifdef HAVE_JUMP_LABEL
  26. 		static_key_slow_dec(&nf_hooks_needed[pf][reg->hooknum]);
  27. #endif
  28. 	} else {
  29. 		WARN_ONCE(1, "hook not found, pf %d num %d", pf, reg->hooknum);
  30. 	}
  31.  
  32.     // 尝试缩容，移除hook为accept_all的hook函数操作
  33. 	p = __nf_hook_entries_try_shrink(p, pp);
  34. 	mutex_unlock(&nf_hook_mutex);
  35. 	if (!p)
  36. 		return;
  37.  
  38. 	nf_queue_nf_hook_drop(net);
  39. 	nf_hook_entries_free(p);
  40. }

①nf_remove_net_hook

里面会调用nf_remove_net_hook，从对应的hook数组中移除该hook，这里移除并没有删掉，而是将该hook数组对应下标的hook改成了accept_all，nf_hook_ops设置为dummy_ops：

  1. /*
  2.  * nf_remove_net_hook - remove a hook from blob
  3.  *
  4.  * @oldp: current address of hook blob
  5.  * @unreg: hook to unregister
  6.  *
  7.  * This cannot fail, hook unregistration must always succeed.
  8.  * Therefore replace the to-be-removed hook with a dummy hook.
  9.  */
  10. static bool nf_remove_net_hook(struct nf_hook_entries *old,
  11. 			       const struct nf_hook_ops *unreg)
  12. {
  13. 	struct nf_hook_ops **orig_ops;
  14. 	unsigned int i;
  15.  
  16. 	orig_ops = nf_hook_entries_get_hook_ops(old);
  17. 	for (i = 0; i < old->num_hook_entries; i++) {
  18. 		if (orig_ops[i] != unreg)
  19. 			continue;
  20. 		WRITE_ONCE(old->hooks[i].hook, accept_all);
  21. 		WRITE_ONCE(orig_ops[i], &dummy_ops);
  22. 		return true;
  23. 	}
  24.  
  25. 	return false;
  26. }

②__nf_hook_entries_try_shrink

然后调用__nf_hook_entries_try_shrink，尝试缩容hook数组，这里是重新申请了个nf_hook_entries，把旧的nf_hook_entries里hook数组中除了元素为dummy_ops的所有元素都按顺序拷贝到新nf_hook_entries中：

  1. /*
  2.  * __nf_hook_entries_try_shrink - try to shrink hook array
  3.  *
  4.  * @old -- current hook blob at @pp
  5.  * @pp -- location of hook blob
  6.  *
  7.  * Hook unregistration must always succeed, so to-be-removed hooks
  8.  * are replaced by a dummy one that will just move to next hook.
  9.  *
  10.  * This counts the current dummy hooks, attempts to allocate new blob,
  11.  * copies the live hooks, then replaces and discards old one.
  12.  *
  13.  * return values:
  14.  *
  15.  * Returns address to free, or NULL.
  16.  */
  17. static void *__nf_hook_entries_try_shrink(struct nf_hook_entries *old,
  18. 					  struct nf_hook_entries __rcu **pp)
  19. {
  20. 	unsigned int i, j, skip = 0, hook_entries;
  21. 	struct nf_hook_entries *new = NULL;
  22. 	struct nf_hook_ops **orig_ops;
  23. 	struct nf_hook_ops **new_ops;
  24.  
  25. 	if (WARN_ON_ONCE(!old))
  26. 		return NULL;
  27.  
  28. 	orig_ops = nf_hook_entries_get_hook_ops(old);
  29. 	for (i = 0; i < old->num_hook_entries; i++) {
  30. 		if (orig_ops[i] == &dummy_ops)
  31. 			skip++;
  32. 	}
  33.  
  34. 	/* if skip == hook_entries all hooks have been removed */
  35. 	hook_entries = old->num_hook_entries;
  36. 	if (skip == hook_entries)
  37. 		goto out_assign;
  38.  
  39. 	if (skip == 0)
  40. 		return NULL;
  41.  
  42. 	hook_entries -= skip;
  43. 	new = allocate_hook_entries_size(hook_entries);
  44. 	if (!new)
  45. 		return NULL;
  46.  
  47. 	new_ops = nf_hook_entries_get_hook_ops(new);
  48. 	for (i = 0, j = 0; i < old->num_hook_entries; i++) {
  49. 		if (orig_ops[i] == &dummy_ops)
  50. 			continue;
  51. 		new->hooks[j] = old->hooks[i];
  52. 		new_ops[j] = (void *)orig_ops[i];
  53. 		j++;
  54. 	}
  55. 	hooks_validate(new);
  56. out_assign:
  57. 	rcu_assign_pointer(*pp, new);
  58. 	return old;
  59. }

③nf_queue_nf_hook_drop

在当前net网络命名空间中删除旧的nf_hook_entries。

④nf_hook_entries_free

释放旧nf_hook_entries_free所占空间。

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/羊村懒王/article/detail/160462
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号