Netfilter运行时钩子列表

这是在CentOS 7 (kernel 3.10.0-514.el7)上面运行时的钩子列表, 抓下来便于学习理解和调试.

第一级是协议分类, 第二级是钩子点, 第三级是钩子函数, 方括号里面是钩子函数所在模块.

NFPROTO_UNSPEC: None

NFPROTO_INET: None

NFPROTO_IPV4:
    NF_INET_PRE_ROUTING:
        ip_sabotage_in          [br_netfilter]
        ipv4_conntrack_defrag   [nf_defrag_ipv4]        
        iptable_raw_hook        [iptable_raw]   
        ipv4_conntrack_in       [nf_conntrack_ipv4]
        iptable_mangle_hook     [iptable_mangle]
        iptable_nat_ipv4_in     [iptable_nat]
    NF_INET_LOCAL_IN:
        iptable_mangle_hook     [iptable_mangle]
        iptable_filter_hook     [iptable_filter]
        iptable_nat_ipv4_fn     [iptable_nat]
        ipv4_helper             [nf_conntrack_ipv4]
        ipv4_confirm            [nf_conntrack_ipv4]
    NF_INET_FORWARD:
        iptable_mangle_hook     [iptable_mangle]
        iptable_filter_hook     [iptable_filter]
    NF_INET_LOCAL_OUT:
        ipv4_conntrack_defrag   [nf_defrag_ipv4]
        iptable_raw_hook        [iptable_raw]
        ipv4_conntrack_local    [nf_conntrack_ipv4]
        iptable_mangle_hook     [iptable_mangle]
        iptable_nat_ipv4_local_fn       [iptable_nat]
        iptable_filter_hook     [iptable_filter]
    NF_INET_POST_ROUTING:
        iptable_mangle_hook     [iptable_mangle]
        iptable_nat_ipv4_out    [iptable_nat]
        ipv4_helper             [nf_conntrack_ipv4]
        ipv4_confirm            [nf_conntrack_ipv4]
        
NFPROTO_ARP: None

NFPROTO_BRIDGE:
    NF_BR_PRE_ROUTING:
        ebt_nat_in              [ebtable_nat]
        br_nf_pre_routing       [br_netfilter]
    NF_BR_LOCAL_IN:
        ebt_in_hook             [ebtable_filter]
        br_nf_local_in          [br_netfilter]
    NF_BR_FORWARD:
        ebt_in_hook             [ebtable_filter]
        br_nf_forward_ip        [br_netfilter]
        br_nf_forward_arp       [br_netfilter]
    NF_BR_LOCAL_OUT:
        ebt_nat_out             [ebtable_nat]
        ebt_out_hook            [ebtable_filter]
    NF_BR_POST_ROUTING:
        ebt_nat_out             [ebtable_nat]
        br_nf_post_routing      [br_netfilter]
        
NFPROTO_IPV6: 
    NF_INET_PRE_ROUTING:
        ip_sabotage_in          [br_netfilter]
        ipv6_defrag             [nf_defrag_ipv6]
        ip6table_raw_hook       [ip6table_raw]  
        ipv6_conntrack_in       [nf_conntrack_ipv6]
        ip6table_mangle_hook    [ip6table_mangle]
    NF_INET_LOCAL_IN:
        ip6table_mangle_hook    [ip6table_mangle]
        ip6table_filter_hook    [ip6table_filter]
        ipv6_helper             [nf_conntrack_ipv6]
        ipv6_confirm            [nf_conntrack_ipv6]
    NF_INET_FORWARD:
        ip6table_mangle_hook    [ip6table_mangle]
        ip6table_filter_hook    [ip6table_filter]
    NF_INET_LOCAL_OUT:
        ipv6_defrag             [nf_defrag_ipv6]
        ip6table_raw_hook       [ip6table_raw]  
        ipv6_conntrack_local    [nf_conntrack_ipv6]
        ip6table_mangle_hook    [ip6table_mangle]
        ip6table_filter_hook    [ip6table_filter]
    NF_INET_POST_ROUTING:
        ip6table_mangle_hook    [ip6table_mangle]
        ipv6_helper             [nf_conntrack_ipv6]
        ipv6_confirm            [nf_conntrack_ipv6]

NFPROTO_DECNET: None