Linux kernel Analysis

Kernel version: 2.6.34

NetFilter is introduced into the 2.4.x kernel, and becomes the main extension of network application under Linux platform, including not only the implementation of firewall, but also the processing of message (such as message encryption, message classification statistics, etc.).

NetFilter data structure Hook son struct nf_hook_ops[net\filter\core.c]

struct Nf_hook_ops {     
    struct list_head list;     
    /* User fills in from. * * 
    NF_HOOKFN *hook;     
    struct module *owner;     
    u_int8_t PF;     
    unsigned int hooknum;     
    /* Hooks are ordered in ascending priority. * 
    /int priority;     

The member list is used to link the global hook array nf_hooks, it must be in the first place, to ensure that the value of &nf_hook_ops->list is the same as &nf_hook_ops, which will be used later in the use of this technique;

A member hook is a user-defined hook function; Owner represents the module that registers this hook function, because the netfilter is kernel space, so it is generally a module to complete the hook function registration; The PF is indexed to a specific protocol-specific number of hook functions queue for indexing nf_ Hooks;priority determines the order of the same queue (PF and Hooknum), and the smaller the priority, the more forward the arrangement.

struct Nf_hook_ops just store hooks in the data structure, and the real storage of these hooks for the protocol stack call is nf_hooks, from the definition can be seen, it is actually a two-dimensional array of linked lists.

struct List_head nf_hooks[nfproto_numproto][nf_max_hooks]; [NET\FILTER\CORE.C]

Where Nfproto_numproto represents the protocol associated with the hook, which is desirable:

enum {     
    Nfproto_unspec =  0,     
    nfproto_ipv4   =  2,     
    nfproto_arp    =  3,     
    Nfproto_bridge =  7,     
    Nfproto_ipv6   = ten,     
    nfproto_decnet =,     
    nfproto_numproto,     
};

The nf_max_hooks represents the location where the tick is applied, and the optional values are defined within each protocol module, which represents the location of the hook function to be applied in the protocol process (later in bridge, for example), which generally has the following values:

Nf_xxx_pre_routing,     
nf_xxx_local_in,     
nf_xxx_forward,     
nf_xxx_local_out,     
nf_xxx_post_routing ,     
Nf_xxx_numhooks

NetFilter Registration

After understanding the Nf_hook_ops and nf_hooks, look at how to manipulate the elements in Nf_hooks.

Nf_register_hook () registers the Nf_hook_ops in the Nf_hooks:

int Nf_register_hook (struct nf_hook_ops *reg)     
{struct Nf_hook_ops     
    ;     
    int err;     


    Err = mutex_lock_interruptible (&nf_hook_mutex);     
    if (Err < 0) return     
        err;     
    List_for_each_entry (Elem, &nf_hooks[reg->pf][reg->hooknum], list) {     
        if (Reg->priority < elem- >priority) break     
            ;     
    List_add_rcu (->list, elem->list.prev);     
    Mutex_unlock (&nf_hook_mutex);     
    return 0;     
}

This function is very simple, from the specified pf&hooknum nf_hooks queue traversal, press priority from small to large order, the Reg inserted in the appropriate position, complete the registration of the hook function.

Nf_unregister_hook () cancels the nf_hook_ops from the Nf_hooks:

void Nf_unregister_hook

(struct nf_hook_ops *reg)     
{     
    mutex_lock (&nf_hook_mutex);     
    List_del_rcu (?->list);     
    Mutex_unlock (&nf_hook_mutex);     
    Synchronize_net ();     
}

This function is simpler and removes Reg from the nf_hooks.

The kernel also provides nf_register_hooks () and Nf_unregister_hooks () to register the Reg n times or unregister the Reg from the nf_hooks n times. When the hook function is registered, the nf_hooks structure is shown in the figure: