NetFilter (1)

Linux, known for its high-efficiency network, is of course not to be overlooked, and how to configure the processing of network packets with efficient and powerful means is particularly important, and NetFilter is the component that undertakes this task.
Since the development of the firewall of Linux, it has been replaced by NetFilter as the core to complete the function of kernel state. We know that in the user state, the Iptables tool can be very easy to configure the firewall, but it just provides some user-friendly configuration commands, and then sent to the kernel space read, in the kernel state NetFilter will be based on the configuration of users to match and perform operations.
This article takes the treatment of the IPv4 package as an example to explain, and only the principle, do not touch the details, in understanding the general principle and framework, to know the details, the source will tell you the answer. Based on Linux 2.6.27.62.

Simply put, the firewall is actually at the right point, to take over the IP packet processing, and then according to the configured rules to decide what to do. So the question is, how to choose the right point. See:

is to extract a picture on the network, where five locations, is the Linux support of several interception points, then the first step of the problem becomes very simple, in these locations in the function of the implementation of the hook can be. So when the packet is processed by these functions, it can call to our function, we have the opportunity to deal with, NetFilter can not mundane, fortunately, the kernel of the network part and NetFilter is perfectly compatible, it provides a registration mechanism, as long as the network to indicate their own type and want to hook Location, then your callback function will have the opportunity to be executed at the hook.

extern struct List_head nf_hooks[nproto][nf_max_hooks];int nf_register_hook (struct nf_hook_ops *reg) {struct NF_HOOK_ OPS *elem;int Err;err = mutex_lock_interruptible (&nf_hook_mutex), if (Err < 0) return Err;list_for_each_entry ( Elem, &nf_hooks[reg->pf][reg->hooknum], list) {if (Reg->priority < elem->priority) break;} List_add_rcu (&reg->list, Elem->list.prev); Mutex_unlock (&nf_hook_mutex); return 0;}

Nf_register_hook is to provide you with the convenience of the function, the code is visible, we register the callback will be connected to the Nf_hooks, this global variable is recorded, different network types, different mount points of all the callback functions, when the packet through the corresponding point, By traversing it, you can sequentially process all registered callbacks.
Of course, you can also register your own callback, to do a self-firewall function. (not to be continued)

NetFilter (1)