Linux Kernel netfilter Helper Analysis

Linux NetFilter hook related to helper:

Click (here) to collapse or open

{

. Hook = ipv4_conntrack_in,

. Owner = This_module,

. PF = Pf_inet,

. Hooknum = nf_ip_pre_routing,

. Priority = Nf_ip_pri_conntrack,

}

{

. Hook = Ipv4_conntrack_help,

. Owner = This_module,

. PF = Pf_inet,

. Hooknum = Nf_ip_post_routing| Nf_ip_local_in,

. Priority = Nf_ip_pri_conntrack_helper,

}

The first packet arrival process:

Ipv4_conntrack_in--nf_conntrack_in--and RESOLVE_NORMAL_CT--nf_ct_get_tuple--Nf_conntrack_find_ Tuple (1)--Init_conntrack-nf_ct_find_expection (2)-Nf_ct_helper_find (3)-Nf_ct_helper_ext_add ( 4)

(1) Find a tuple five tuple, because it is the first connection, all cannot find

(2) Look for the desired connection, because there is no expected connection added, all also cannot find

(3) Find the helper for the registration, here TFTP, for example, found the TFTP registered helper

(4) Add the found helper to the CT result body

In the later Ipv4_conntrack_help hook function, the CT->HELPER->HELP function is executed, and the Help function Tftp_help adds an exp to the global expected join table

When the first packet of the expected link arrives, it is found in (2), which links the new connection to the previous one.

Linux Kernel netfilter Helper Analysis