转载请注明 作者: Alanx Email:[email protected] QQ:8540426
http://hi.baidu.com/alanx/
当内核准备好要发包时,将调用以下函数,其中最重要的结构是struct sk_buff请查相关资料
int ip_output(struct sk_buff *skb)
{
struct net_device *dev = skb_dst(skb)->dev; 取发包设备
IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUT, skb->len); 此处应为snmp网网协议相关的操作
skb->dev = dev; 设发发包的设备
skb->protocol = htons(ETH_P_IP); 指定IP协议
return NF_HOOK_COND(PF_INET, NF_INET_POST_ROUTING, skb, NULL, dev,
ip_finish_output,
!(IPCB(skb)->flags & IPSKB_REROUTED));
}
最后一句是调用勾子,就是netfilter机制最著名的勾子函数。别急,我们像下看。
NF_HOOK_COND()是一个宏,定义如下:
#define NF_HOOK_COND(pf, hook, skb, indev, outdev, okfn, cond) /
({int __ret; /
if ((__ret=nf_hook_thresh(pf, hook, (skb), indev, outdev, okfn, INT_MIN, cond)) == 1)/
__ret = (okfn)(skb); /
__ret;})
再像下看:
static inline int nf_hook_thresh(u_int8_t pf, unsigned int hook,
struct sk_buff *skb,
struct net_device *indev,
struct net_device *outdev,
int (*okfn)(struct sk_buff *), int thresh,
int cond)
{
if (!cond)
return 1;
#ifndef CONFIG_NETFILTER_DEBUG
if (list_empty(&nf_hooks[pf][hook]))
return 1;
#endif
return nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh);
}
好像明白点什么了,嗯。cond非0时或nf_hooks[pf][hook]链表为空时,int nf_hook_thresh()返回1。接着NF_HOOK_COND()会调用(okfn)(skb)的指针函数。
根据传过来的参数,我们得知,实际上就是调用:ip_finish_output(sk).最后我们再分析ip_finish_output(sk),先让我们看看cond和nf_hooks[pf][hook]链表吧。
cond:
根据我们传来的参数得知就是!(IPCB(skb)->flags & IPSKB_REROUTED),具体没细看,猜想可能是和路由重发有关吧。感兴趣的朋友可以了解一下。
nf_hooks[pf][hook]:
根据上层传过来的参数据应为:nf_hooks[PF_INET][NF_INET_POST_ROUTING] 。 让我们看看它的定义struct list_head nf_hooks[NFPROTO_NUMPROTO][NF_MAX_HOOKS] __read_mostly;
明白了吧。就是的一链表数组。我们这里用的是其中的nf_hooks[PF_INET][NF_INET_POST_ROUTING]。解释一下的话,应 为PF_INET协议时,路由发包的勾子函数链表。当我们用iptables或tc时。用netlink和内核通信,在这个链表上挂上很多结点。
有什么用呢?我们接着往下看:nf_hook_slow(pf, hook, skb, indev, outdev, okfn, thresh)
我们看一下它的构成:
nt nf_hook_slow(u_int8_t pf, unsigned int hook, struct sk_buff *skb,
struct net_device *indev,
struct net_device *outdev,
int (*okfn)(struct sk_buff *),
int hook_thresh)
{
struct list_head *elem;
unsigned int verdict;
int ret = 0;
/* We may already have this, but read-locks nest anyway */
rcu_read_lock();
elem = &nf_hooks[pf][hook];
next_hook:
verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,
outdev, &elem, okfn, hook_thresh);
if (verdict == NF_ACCEPT || verdict == NF_STOP) {
ret = 1;
} else if (verdict == NF_DROP) {
kfree_skb(skb);
ret = -EPERM;
} else if ((verdict & NF_VERDICT_MASK) == NF_QUEUE) {
if (!nf_queue(skb, elem, pf, hook, indev, outdev, okfn,
verdict >> NF_VERDICT_BITS))
goto next_hook;
}
rcu_read_unlock();
return ret;
}
关键是这句 verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev,
outdev, &elem, okfn, hook_thresh);
根据上面返回的值,决定这个包是否通过NF_ACCEPT 或 丢弃 NF_DROP 还是进行流控入排队 NF_QUEUE.注意。这是个循环goto next_hook
接下来,我们看看关键的verdict = nf_iterate(&nf_hooks[pf][hook], skb, hook, indev, outdev, &elem, okfn, hook_thresh);
unsigned int nf_iterate(struct list_head *head,
struct sk_buff *skb,
unsigned int hook,
const struct net_device *indev,
const struct net_device *outdev,
struct list_head **i,
int (*okfn)(struct sk_buff *),
int hook_thresh)
{
unsigned int verdict;
/*
* The caller must not block between calls to this
* function because of risk of continuing from deleted element.
*/
list_for_each_continue_rcu(*i, head) {
struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
if (hook_thresh > elem->priority)
continue;
/* Optimization: we don't need to hold module
reference here, since function can't sleep. --RR */
verdict = elem->hook(hook, skb, indev, outdev, okfn);
if (verdict != NF_ACCEPT) {
#ifdef CONFIG_NETFILTER_DEBUG
if (unlikely((verdict & NF_VERDICT_MASK)
> NF_MAX_VERDICT)) {
NFDEBUG("Evil return from %p(%u)./n",
elem->hook, hook);
continue;
}
#endif
if (verdict != NF_REPEAT)
return verdict;
*i = (*i)->prev;
}
}
return NF_ACCEPT;
}
其中
1、ist_for_each_continue_rcu(*i, head) 是循环遍历head 既刚才所说的nf_hooks[PF_INET][NF_INET_POST_ROUTING]。
2、struct nf_hook_ops *elem = (struct nf_hook_ops *)*i; 取出上面链表的结点。
3、if (hook_thresh > elem->priority) 如果优先级小。则下一个结点这里 hook_thresh为INT_MIN
continue;
4、verdict = elem->hook(hook, skb, indev, outdev, okfn);结于调到勾子了。万岁。最激动人心的事。上面说了勾子是我们用iptables或tc通过与内核通讯的netlink,挂到nf_hooks上的。
让我们看看。 nf_hooks上的结点的结构吧。
typedef unsigned int nf_hookfn(unsigned int hooknum,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *));
struct nf_hook_ops
{
struct list_head list; 链表
/* User fills in from here down. */
nf_hookfn *hook; 勾子函数,就是上面调用的
struct module *owner; 模块
u_int8_t pf; 如:PF_INT
unsigned int hooknum; 如:NF_INET_POST_ROUTING
/* Hooks are ordered in ascending priority. */
int priority; 优先级:如INT_MIN等
};
等以上的都处理完,最后,要么把包丢弃了。要最一开始的ip_finish_output处理发包啦!先写到此了!