在 __ipvs_vs_init 中有通过 nf_register_net_hooks 注册 hook 函数到 netfilter 框架
如 ipv4 下的
static const struct nf_hook_ops ip_vs_ops[] = {
/* After packet filtering, change source only for VS/NAT */
{
.hook = ip_vs_reply4,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_NAT_SRC - 2,
},
/* After packet filtering, forward packet through VS/DR, VS/TUN,
* or VS/NAT(change destination), so that filtering rules can be
* applied to IPVS. */
{
.hook = ip_vs_remote_request4,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_IN,
.priority = NF_IP_PRI_NAT_SRC - 1,
},
/* Before ip_vs_in, change source only for VS/NAT */
{
.hook = ip_vs_local_reply4,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_NAT_DST + 1,
},
/* After mangle, schedule and forward local requests */
{
.hook = ip_vs_local_request4,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_LOCAL_OUT,
.priority = NF_IP_PRI_NAT_DST + 2,
},
/* After packet filtering (but before ip_vs_out_icmp), catch icmp
* destined for 0.0.0.0/0, which is for incoming IPVS connections */
{
.hook = ip_vs_forward_icmp,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD,
.priority = 99,
},
/* After packet filtering, change source only for VS/NAT */
{
.hook = ip_vs_reply4,
.pf = NFPROTO_IPV4,
.hooknum = NF_INET_FORWARD,
.priority = 100,
},
netfilter hook 机制其他文章再介绍,这里需要知道,nf_hook 是一个全局的二维数组:
如 NFPROTO_IPV4/NFPROTO_IPV6 就是一维列的值,NFPROTO_IPV4 也被称为 hook 点。
而第二列就是常说的五链,即NF_INET_PRE_ROUTING,NF_INET_LOCAL_IN,NF_INET_FORWARD,NF_INET_LOCAL_OUT,NF_INET_POST_ROUTING;每条链使用链表结构维护 hook 点下的 hook 方法;
如上面代码中的 ip_vs_remote_request4
方法就是在 nf_hook[NFPROTO_IPV4][NF_INET_LOCAL_IN] 的 hook 函数,链表通过优先级进行维护(nf_hook_entries_grow 调整新增 hook 函数的链表位置),优先级数字越低优先级越高。
那么当内核函数 ip_local_deliver
处理报文时,需要按照优先级顺序通过所有 [NFPROTO_IPV4][NF_INET_LOCAL_IN] 链表下的 hook 函数。