【LINUX协议栈】netfilter之filter表、mangle表、nat表、raw表

news/2024/11/17 0:27:31/

1、filter表

  • Filter表 是以kernel module形式加载的(insmod iptable_filter)
  • 入口在net/ipv4/netfilter/iptable_filter.c中
  • Filter表主要在以下Hook点起作用：
#define FILTER_VALID_HOOKS ((1 << NF_INET_LOCAL_IN) | \(1 << NF_INET_FORWARD) | \(1 << NF_INET_LOCAL_OUT))
即只在数据包的接收、转发、发送时起作用

1.1 filter表信息 packet_filter

static const struct xt_table packet_filter = {.name		= "filter",.valid_hooks	= FILTER_VALID_HOOKS,.me		= THIS_MODULE,.af		= NFPROTO_IPV4,.priority	= NF_IP_PRI_FILTER,
};

1.2 内核加载初始化 iptable_filter_init

static struct pernet_operations iptable_filter_net_ops = {.init = iptable_filter_net_init,.exit = iptable_filter_net_exit,
};static int __init iptable_filter_init(void)
{int ret;ret = register_pernet_subsys(&iptable_filter_net_ops);if (ret < 0)return ret;/* Register hooks */filter_ops = xt_hook_link(&packet_filter, iptable_filter_hook);if (IS_ERR(filter_ops)) {ret = PTR_ERR(filter_ops);unregister_pernet_subsys(&iptable_filter_net_ops);}return ret;
}

1.3 filter表初始化 iptable_filter_net_init

static int __net_init iptable_filter_net_init(struct net *net)
{struct ipt_replace *repl;/* 分配初始化表，用于下面的表注册 */repl = ipt_alloc_initial_table(&packet_filter);if (repl == NULL)return -ENOMEM;/* Entry 1 is the FORWARD hook *//* 入口1是否为FORWARD钩子点时的verdict值设置 */((struct ipt_standard *)repl->entries)[1].target.verdict =forward ? -NF_ACCEPT - 1 : -NF_DROP - 1;/* 注册filter表，注册后，ipv4.iptable_filter保存了注册后的新表 */net->ipv4.iptable_filter =ipt_register_table(net, &packet_filter, repl);/* 释放初始化表 */kfree(repl);return PTR_ERR_OR_ZERO(net->ipv4.iptable_filter);
}

1.4 filter表的hook定义 iptable_filter_hook

static unsigned int
iptable_filter_hook(void *priv, struct sk_buff *skb,const struct nf_hook_state *state)
{if (state->hook == NF_INET_LOCAL_OUT &&(skb->len < sizeof(struct iphdr) ||ip_hdrlen(skb) < sizeof(struct iphdr)))/* root is playing with raw sockets. */return NF_ACCEPT;return ipt_do_table(skb, state, state->net->ipv4.iptable_filter);
}

2、mangle表

  • 入口在net\ipv4\netfilter\iptable_mangle.c中
  • mangle表主要在以下Hook点起作用：
#define MANGLE_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | \(1 << NF_INET_LOCAL_IN) | \(1 << NF_INET_FORWARD) | \(1 << NF_INET_LOCAL_OUT) | \(1 << NF_INET_POST_ROUTING))
主要功能是根据规则修改数据包的一些标志位，以便其他规则或程序可以利用这种标志对数据包进行过滤或策略路由

2.1 mangle表信息 packet_mangler

static const struct xt_table packet_mangler = {.name		= "mangle",.valid_hooks	= MANGLE_VALID_HOOKS,.me		= THIS_MODULE,.af		= NFPROTO_IPV4,.priority	= NF_IP_PRI_MANGLE,
};

2.2 内核加载初始化 iptable_mangle_init

static struct pernet_operations iptable_mangle_net_ops = {.init = iptable_mangle_net_init,.exit = iptable_mangle_net_exit,
};static int __init iptable_mangle_init(void)
{int ret;ret = register_pernet_subsys(&iptable_mangle_net_ops);if (ret < 0)return ret;/* Register hooks */mangle_ops = xt_hook_link(&packet_mangler, iptable_mangle_hook);if (IS_ERR(mangle_ops)) {ret = PTR_ERR(mangle_ops);unregister_pernet_subsys(&iptable_mangle_net_ops);}return ret;
}

2.3mangle表初始化 iptable_mangle_net_init

static int __net_init iptable_mangle_net_init(struct net *net)
{struct ipt_replace *repl;repl = ipt_alloc_initial_table(&packet_mangler);if (repl == NULL)return -ENOMEM;net->ipv4.iptable_mangle =ipt_register_table(net, &packet_mangler, repl);kfree(repl);return PTR_ERR_OR_ZERO(net->ipv4.iptable_mangle);
}

2.4 mangle表的hook定义 iptable_mangle_hook

/* The work comes in here from netfilter.c. */
static unsigned int
iptable_mangle_hook(void *priv,struct sk_buff *skb,const struct nf_hook_state *state)
{if (state->hook == NF_INET_LOCAL_OUT)return ipt_mangle_out(skb, state);if (state->hook == NF_INET_POST_ROUTING)return ipt_do_table(skb, state,state->net->ipv4.iptable_mangle);/* PREROUTING/INPUT/FORWARD: */return ipt_do_table(skb, state, state->net->ipv4.iptable_mangle);
}

3、nat表

  • 入口在net\ipv4\netfilter\iptable_nat.c中

3.1 nat表信息

static const struct xt_table nf_nat_ipv4_table = {.name		= "nat",.valid_hooks	= (1 << NF_INET_PRE_ROUTING) |(1 << NF_INET_POST_ROUTING) |(1 << NF_INET_LOCAL_OUT) |(1 << NF_INET_LOCAL_IN),.me		= THIS_MODULE,.af		= NFPROTO_IPV4,
};

3.2内核加载初始化 iptable_nat_init

static int __init iptable_nat_init(void)
{int err;//注册pernet函数，其init函数会初始化nf_nat_ipv4_tableerr = register_pernet_subsys(&iptable_nat_net_ops);if (err < 0)goto err1;//注册nat的hook函数err = nf_register_hooks(nf_nat_ipv4_ops, ARRAY_SIZE(nf_nat_ipv4_ops));if (err < 0)goto err2;return 0;err2:unregister_pernet_subsys(&iptable_nat_net_ops);
err1:return err;
}

3.3 nat表初始化 iptable_nat_net_init

static struct pernet_operations iptable_nat_net_ops = {.init	= iptable_nat_net_init,.exit	= iptable_nat_net_exit,
};static int __net_init iptable_nat_net_init(struct net *net)
{struct ipt_replace *repl;/* 分配初始化表，用于下面的注册 */repl = ipt_alloc_initial_table(&nf_nat_ipv4_table);if (repl == NULL)return -ENOMEM;/* 表注册 */net->ipv4.nat_table = ipt_register_table(net, &nf_nat_ipv4_table, repl);kfree(repl);return PTR_ERR_OR_ZERO(net->ipv4.nat_table);
}

3.4 nat表的hook定义 nf_nat_ipv4_ops

static struct nf_hook_ops nf_nat_ipv4_ops[] __read_mostly = {/* Before packet filtering, change destination */{.hook		= iptable_nat_ipv4_in,.pf		= NFPROTO_IPV4,.hooknum	= NF_INET_PRE_ROUTING,.priority	= NF_IP_PRI_NAT_DST,},/* After packet filtering, change source */{.hook		= iptable_nat_ipv4_out,.pf		= NFPROTO_IPV4,.hooknum	= NF_INET_POST_ROUTING,.priority	= NF_IP_PRI_NAT_SRC,},/* Before packet filtering, change destination */{.hook		= iptable_nat_ipv4_local_fn,.pf		= NFPROTO_IPV4,.hooknum	= NF_INET_LOCAL_OUT,.priority	= NF_IP_PRI_NAT_DST,},/* After packet filtering, change source */{.hook		= iptable_nat_ipv4_fn,.pf		= NFPROTO_IPV4,.hooknum	= NF_INET_LOCAL_IN,.priority	= NF_IP_PRI_NAT_SRC,},
};

4、raw表

  • 入口在net\ipv4\netfilter\iptable_raw.c中
  • raw表主要在以下Hook点起作用：
#define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))

4.1 raw表信息 packet_raw

static const struct xt_table packet_raw = {.name = "raw",.valid_hooks =  RAW_VALID_HOOKS,.me = THIS_MODULE,.af = NFPROTO_IPV4,.priority = NF_IP_PRI_RAW,
};

4.2内核加载初始化 iptable_raw_init

static struct pernet_operations iptable_raw_net_ops = {.init = iptable_raw_net_init,.exit = iptable_raw_net_exit,
};static int __init iptable_raw_init(void)
{int ret;ret = register_pernet_subsys(&iptable_raw_net_ops);if (ret < 0)return ret;/* Register hooks */rawtable_ops = xt_hook_link(&packet_raw, iptable_raw_hook);if (IS_ERR(rawtable_ops)) {ret = PTR_ERR(rawtable_ops);unregister_pernet_subsys(&iptable_raw_net_ops);}return ret;
}

4.3 raw表初始化 iptable_raw_net_init

static int __net_init iptable_raw_net_init(struct net *net)
{struct ipt_replace *repl;repl = ipt_alloc_initial_table(&packet_raw);if (repl == NULL)return -ENOMEM;net->ipv4.iptable_raw =ipt_register_table(net, &packet_raw, repl);kfree(repl);return PTR_ERR_OR_ZERO(net->ipv4.iptable_raw);
}

4.4 raw表的hook定义 iptable_raw_hook

/* The work comes in here from netfilter.c. */
static unsigned int
iptable_raw_hook(void *priv, struct sk_buff *skb,const struct nf_hook_state *state)
{if (state->hook == NF_INET_LOCAL_OUT &&(skb->len < sizeof(struct iphdr) ||ip_hdrlen(skb) < sizeof(struct iphdr)))/* root is playing with raw sockets. */return NF_ACCEPT;return ipt_do_table(skb, state, state->net->ipv4.iptable_raw);
}

http://www.ppmy.cn/news/1041624.html

相关文章

c语言每日一练(9)

c语言每日一练(9)

前言&#xff1a;每日一练系列&#xff0c;每一期都包含5道选择题&#xff0c;2道编程题&#xff0c;博主会尽可能详细地进行讲解&#xff0c;令初学者也能听的清晰。每日一练系列会持续更新&#xff0c;暑假时三天之内必有一更&#xff0c;到了开学之后&#xff0c;将看学业情…
阅读更多...
未来公文的智能化进程

未来公文的智能化进程

随着技术的飞速发展&#xff0c;公文——这个有着悠久历史的官方沟通方式&#xff0c;也正逐步走向智能化的未来。自动化、人工智能、区块链...这些现代科技正重塑我们的公文制度&#xff0c;让其变得更加高效、安全和智慧。 1.语义理解与自动生成 通过深度学习和NLP&#xff…
阅读更多...
Spring Clould 消息队列 - RabbitMQ

Spring Clould 消息队列 - RabbitMQ

视频地址&#xff1a;微服务&#xff08;SpringCloudRabbitMQDockerRedis搜索分布式&#xff09; 初识MQ-同步通讯的优缺点&#xff08;P61&#xff0c;P62&#xff09; 同步和异步通讯 微服务间通讯有同步和异步两种方式&#xff1a; 同步通讯&#xff1a;就像打电话&…
阅读更多...
【马蹄集】第二十三周——进位制专题

【马蹄集】第二十三周——进位制专题

进位制专题 目录 MT2186 二进制&#xff1f;不同&#xff01;MT2187 excel的烦恼MT2188 单条件和MT2189 三进制计算机1MT2190 三进制计算机2 MT2186 二进制&#xff1f;不同&#xff01; 难度&#xff1a;黄金    时间限制&#xff1a;1秒    占用内存&#xff1a;128M 题目…
阅读更多...
链表之第二回

链表之第二回

欢迎来到我的&#xff1a;世界 该文章收入栏目&#xff1a;链表 希望作者的文章对你有所帮助&#xff0c;有不足的地方还请指正&#xff0c;大家一起学习交流 ! 目录 前言第一题&#xff1a;反转一个链表第二题&#xff1a;链表内指定区间反转第三题&#xff1a;判断一个链表…
阅读更多...
红帆OA SQL注入漏洞复现

红帆OA SQL注入漏洞复现

0x01 产品简介 红帆iOffice.net从最早满足医院行政办公需求&#xff08;传统OA&#xff09;&#xff0c;到目前融合了卫生主管部门的管理规范和众多行业特色应用&#xff0c;是目前唯一定位于解决医院综合业务管理的软件&#xff0c;是最符合医院行业特点的医院综合业务管理平…
阅读更多...
第6章：支持向量机

第6章：支持向量机

间隔与支持向量 w为法向量&#xff0c;决定的是超平面的方向。b是偏移项&#xff0c;决定了超平面与原点之间的距离。 为什么最大化间隔&#xff0c;得到的就是最优平面呢&#xff1f; 当超平面没有正确划分正负样本时&#xff0c;几何间隔为负数。几何间隔&#xff0c;各个…
阅读更多...
AlexNet中文翻译

AlexNet中文翻译

ImageNet classification with deep convolutional neural networks 原文链接&#xff1a;https://dl.acm.org/doi/abs/10.1145/3065386 目录 使用深度卷积神经网络进行 ImageNet 分类 摘要 1 简介 2 数据集 3 架构 3.1 ReLU非线性 3.2 多GPU上的训练 3.3 局部响应标准化 3.4 重…
阅读更多...
最新文章

Copyright @ 2022~2023