ipvs 原理解析（二）netfilter hook

netfilter hook

在 __ipvs_vs_init 中有通过 nf_register_net_hooks 注册 hook 函数到 netfilter 框架

如 ipv4 下的

static const struct nf_hook_ops ip_vs_ops[] = {
	/* After packet filtering, change source only for VS/NAT */
	{
		.hook		= ip_vs_reply4,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC - 2,
	},
	/* After packet filtering, forward packet through VS/DR, VS/TUN,
	 * or VS/NAT(change destination), so that filtering rules can be
	 * applied to IPVS. */
	{
		.hook		= ip_vs_remote_request4,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_IN,
		.priority	= NF_IP_PRI_NAT_SRC - 1,
	},
	/* Before ip_vs_in, change source only for VS/NAT */
	{
		.hook		= ip_vs_local_reply4,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST + 1,
	},
	/* After mangle, schedule and forward local requests */
	{
		.hook		= ip_vs_local_request4,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_LOCAL_OUT,
		.priority	= NF_IP_PRI_NAT_DST + 2,
	},
	/* After packet filtering (but before ip_vs_out_icmp), catch icmp
	 * destined for 0.0.0.0/0, which is for incoming IPVS connections */
	{
		.hook		= ip_vs_forward_icmp,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_FORWARD,
		.priority	= 99,
	},
	/* After packet filtering, change source only for VS/NAT */
	{
		.hook		= ip_vs_reply4,
		.pf		= NFPROTO_IPV4,
		.hooknum	= NF_INET_FORWARD,
		.priority	= 100,
	},

netfilter hook 机制其他文章再介绍，这里需要知道，nf_hook 是一个全局的二维数组：
如 NFPROTO_IPV4/NFPROTO_IPV6 就是一维列的值，NFPROTO_IPV4 也被称为 hook 点。

而第二列就是常说的五链，即NF_INET_PRE_ROUTING，NF_INET_LOCAL_IN，NF_INET_FORWARD，NF_INET_LOCAL_OUT，NF_INET_POST_ROUTING；每条链使用链表结构维护 hook 点下的 hook 方法；

如上面代码中的 ip_vs_remote_request4 方法就是在 nf_hook[NFPROTO_IPV4][NF_INET_LOCAL_IN] 的 hook 函数，链表通过优先级进行维护(nf_hook_entries_grow 调整新增 hook 函数的链表位置)，优先级数字越低优先级越高。

那么当内核函数 ip_local_deliver处理报文时，需要按照优先级顺序通过所有 [NFPROTO_IPV4][NF_INET_LOCAL_IN] 链表下的 hook 函数。