nefilter

理解Netfilter事件机制与用户态监听

最新推荐文章于 2024-02-18 10:31:25 发布

与时俱进2014

最新推荐文章于 2024-02-18 10:31:25 发布

阅读量3.2k

点赞数 2

分类专栏： kernel

kernel 专栏收录该内容

56 篇文章

订阅专栏

这个函数实现很简单，它就是置事件缓存的标志位。

static inline void
nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
{
struct nf_conntrack_ecache *e;
if (nf_conntrack_event_cb == NULL)
return;
e = nf_ct_ecache_find(ct);
if (e == NULL)
return;
set_bit(event, &e->cache);
}

复制代码

问题的关键在于，需要事解Netfilter的event通告机制，简而言知就是，用户态可以使用一个守护进程监控内核连接跟踪的状态，如新建、删除等，在一些特殊应用场合比较有用，如HA环境中。

以下的内容来自于偶一篇没有整理过的笔记，主要分析事件机制的实现，希望对你有所帮助。

//////////////////////////////////////////////////////////////

内核态接口

1、初始化

//事件句柄

static struct nf_ct_event_notifier ctnl_notifier = {
.fcn = ctnetlink_conntrack_event,
};

复制代码

//初始化，调用nf_conntrack_register_notifier注册

#ifdef CONFIG_NF_CONNTRACK_EVENTS
ret = nf_conntrack_register_notifier(&ctnl_notifier);
if (ret < 0) {
printk("ctnetlink_init: cannot register notifier.\n");
goto err_unreg_exp_subsys;
}

复制代码

//注销nf_conntrack_unregister_notifier

#ifdef CONFIG_NF_CONNTRACK_EVENTS
nf_conntrack_unregister_notifier(&ctnl_notifier);
#endif

复制代码

//注册函数

int nf_conntrack_register_notifier(struct nf_ct_event_notifier *new)
{
int ret = 0;
struct nf_ct_event_notifier *notify;
//获得锁
mutex_lock(&nf_ct_ecache_mutex);
//获取事件句柄，判断是否已注册
notify = rcu_dereference(nf_conntrack_event_cb);
if (notify != NULL) {
ret = -EBUSY;
goto out_unlock;
}
//注册新的句柄
rcu_assign_pointer(nf_conntrack_event_cb, new);
//释放锁
mutex_unlock(&nf_ct_ecache_mutex);
return ret;
out_unlock:
mutex_unlock(&nf_ct_ecache_mutex);
return ret;
}

复制代码

//注销函数置相应的指针位

void nf_conntrack_unregister_notifier(struct nf_ct_event_notifier *new)
{
struct nf_ct_event_notifier *notify;
mutex_lock(&nf_ct_ecache_mutex);
notify = rcu_dereference(nf_conntrack_event_cb);
BUG_ON(notify != new);
rcu_assign_pointer(nf_conntrack_event_cb, NULL);
mutex_unlock(&nf_ct_ecache_mutex);
}

复制代码

2、触发事件

事件类型，事件名称是位掩码，设置某个事件，使用 1 << event

/* Connection tracking event types */
enum ip_conntrack_events
{
IPCT_NEW = 0, /* new conntrack */
IPCT_RELATED = 1, /* related conntrack */
IPCT_DESTROY = 2, /* destroyed conntrack */
IPCT_STATUS = 3, /* status has changed */
IPCT_PROTOINFO = 4, /* protocol information has changed */
IPCT_HELPER = 5, /* new helper has been set */
IPCT_MARK = 6, /* new mark has been set */
IPCT_NATSEQADJ = 7, /* NAT is doing sequence adjustment */
IPCT_SECMARK = 8, /* new security mark has been set */
};

复制代码

一个触发场景：

static void death_by_timeout(unsigned long ul_conntrack)
{
……
if (!test_bit(IPS_DYING_BIT, &ct->status) &&
unlikely(nf_conntrack_event(IPCT_DESTROY, ct) < 0)) {
……

复制代码

nf_conntrack_event接口触发事件：

static inline int
nf_conntrack_event(enum ip_conntrack_events event, struct nf_conn *ct)
{
//计算位掩码后，调用nf_conntrack_eventmask_report，pid和report置为0
return nf_conntrack_eventmask_report(1 << event, ct, 0, 0);
}

复制代码

static inline int
nf_conntrack_eventmask_report(unsigned int eventmask,
struct nf_conn *ct,
u32 pid,
int report)
{
int ret = 0;
struct net *net = nf_ct_net(ct);
struct nf_ct_event_notifier *notify;
struct nf_conntrack_ecache *e;
rcu_read_lock();
//取得事件通知句柄
notify = rcu_dereference(nf_conntrack_event_cb);
if (notify == NULL)
goto out_unlock;
//取得sysctl控制标志
if (!net->ct.sysctl_events)
goto out_unlock;
//寻找事件缓存
e = nf_ct_ecache_find(ct);
if (e == NULL)
goto out_unlock;
if (nf_ct_is_confirmed(ct) && !nf_ct_is_dying(ct)) {
//构建nf_ct_event
struct nf_ct_event item = {
.ct = ct,
.pid = e->pid ? e->pid : pid, //根据缓存中的pid，如果没有，使用参数的值
.report = report
};
/* This is a resent of a destroy event? If so, skip missed */
unsigned long missed = e->pid ? 0 : e->missed;
//调用通知函数
ret = notify->fcn(eventmask | missed, &item);
if (unlikely(ret < 0 || missed)) {
spin_lock_bh(&ct->lock);
if (ret < 0) {
/* This is a destroy event that has been
* triggered by a process, we store the PID
* to include it in the retransmission. */
if (eventmask & (1 << IPCT_DESTROY) &&
e->pid == 0 && pid != 0)
e->pid = pid;
else
e->missed |= eventmask;
} else
e->missed &= ~missed;
spin_unlock_bh(&ct->lock);
}
}
out_unlock:
rcu_read_unlock();
return ret;
}

复制代码

static int
ctnetlink_conntrack_event(unsigned int events, struct nf_ct_event *item)
{
//根据事件掩码，计算相应的nfnetlink conntrack子系统的消息类型和nfnetlink group
if (events & (1 << IPCT_DESTROY)) {
type = IPCTNL_MSG_CT_DELETE;
group = NFNLGRP_CONNTRACK_DESTROY;
} else if (events & ((1 << IPCT_NEW) | (1 << IPCT_RELATED))) {
type = IPCTNL_MSG_CT_NEW;
flags = NLM_F_CREATE|NLM_F_EXCL;
group = NFNLGRP_CONNTRACK_NEW;
} else if (events) {
type = IPCTNL_MSG_CT_NEW;
group = NFNLGRP_CONNTRACK_UPDATE;
} else
return 0;
//如果没有置report标志，则需要有相应的监听者
if (!item->report && !nfnetlink_has_listeners(group))
return 0;
//构造skb
……
//发送报文
err = nfnetlink_send(skb, item->pid, group, item->report, GFP_ATOMIC);
if (err == -ENOBUFS || err == -EAGAIN)
return -ENOBUFS;
}

复制代码

int nfnetlink_send(struct sk_buff *skb, u32 pid,
unsigned group, int echo, gfp_t flags)
{
return nlmsg_notify(nfnl, skb, pid, group, echo, flags);
}

复制代码

int nfnetlink_has_listeners(unsigned int group)
{
return netlink_has_listeners(nfnl, group);
}

复制代码

nfnetlink group:
enum nfnetlink_groups {
NFNLGRP_NONE,
#define NFNLGRP_NONE NFNLGRP_NONE
NFNLGRP_CONNTRACK_NEW,
#define NFNLGRP_CONNTRACK_NEW NFNLGRP_CONNTRACK_NEW
NFNLGRP_CONNTRACK_UPDATE,
#define NFNLGRP_CONNTRACK_UPDATE NFNLGRP_CONNTRACK_UPDATE
NFNLGRP_CONNTRACK_DESTROY,
#define NFNLGRP_CONNTRACK_DESTROY NFNLGRP_CONNTRACK_DESTROY
NFNLGRP_CONNTRACK_EXP_NEW,
#define NFNLGRP_CONNTRACK_EXP_NEW NFNLGRP_CONNTRACK_EXP_NEW
NFNLGRP_CONNTRACK_EXP_UPDATE,
#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
NFNLGRP_CONNTRACK_EXP_DESTROY,
#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
__NFNLGRP_MAX,
};
#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)

复制代码

//////////////////////////////////////////////////////////////////////////

与用户态的nfnetlink groups不同的是，用户态是一个位图，这是因为，内核是事件的发送者，它一个时刻只
发送一个事件，而用户态是接受者，它可以同时监听多个事件：