Linux连接跟踪源码分析2.docVIP

Linux连接跟踪源码分析2 鍑哄锛歅HPor 鐨凚log 鏃堕棿锛歍hu, 25 Sep 2008 14:19:57 +0000 浣滆€咃細phpor 鍦板潃锛?blog/read.php?286 鍐呭锛? 5锛?涓や釜涓昏鐨勮繛鎺ヨ窡韪嚱鏁? ip_conntrack_in()鍜宨p_confirm() 5.1.1 ip_conntrack_in锛堬級鍑芥暟ip_conntrack_core.c 鎺ユ敹鍊掔殑鏁版嵁鍖呰繘鍏etfilter鍚庯紝棣栧厛杩涜鍒嗙墖澶勭悊锛岀劧鍚庡氨浼氳皟鐢╥p_conntrack_in鍑芥暟锛?ip_conntrack_in 涓昏瀹屾垚鐨勫伐浣滃氨鏄垽鏂暟鎹寘鏄惁宸插湪杩炴帴璺熻釜琛ㄤ腑锛屽鏋滀笉鍦紝鍒欎负鏁版嵁鍖呭垎閰峣p_conntrack锛屽苟鍒濆鍖栧畠锛岀劧鍚庯紝涓鸿繖涓暟鎹寘璁剧疆杩炴帴鐘舵€併€? unsigned int ip_conntrack_in(unsigned int hooknum, struct sk_buff **pskb, const struct net_device *in, const struct net_device *out, int (*okfn)(struct sk_buff *)) { struct ip_conntrack *ct; enum ip_conntrack_info ctinfo; struct ip_conntrack_protocol *proto; int set_reply; int ret; /* 鍒嗙墖鍖呬細鍦ㄥ墠涓€涓狧ook涓澶勭悊锛屼簨瀹炰笂锛屽苟涓嶄細瑙﹀彂璇ユ潯浠?*/ if ((*pskb)-nh.iph-frag_off htons(IP_OFFSET)) { return NF_ACCEPT; if (net_ratelimit()) { printk(KERN_ERR ip_conntrack_in: Frag of proto %u (hook=%u)\n, (*pskb)-nh.iph-protocol, hooknum); } return NF_DROP; } /* 灏嗗綋鍓嶆暟鎹寘璁剧疆涓烘湭淇敼 */ (*pskb)-nfcache |= NFC_UNKNOWN; /* 鍒ゆ柇褰撳墠鏁版嵁鍖呮槸鍚﹀凡琚鏌ヨ繃浜?/ if ((*pskb)-nfct) return NF_ACCEPT; /* 鏍规嵁褰撳墠鏁版嵁鍖呯殑鍗忚锛屾煡鎵句笌涔嬬浉搴旂殑struct ip_conntrack_protocol缁撴瀯 */ proto = ip_ct_find_proto((*pskb)-nh.iph-protocol); /* 濡傛灉鏄痠cmp閿欒鎶ユ枃 */ if ((*pskb)-nh.iph-protocol == IPPROTO_ICMP icmp_error_track(*pskb, ctinfo, hooknum)) return NF_ACCEPT; /* 鍦ㄥ叏灞€鐨勮繛鎺ヨ〃涓紝鏌ユ壘涓庡綋鍓嶅寘鐩稿尮閰嶇殑杩炴帴缁撴瀯锛岃繑鍥炵殑鏄痵truct ip_conntrack *绫诲瀷鎸囬拡锛屽畠鐢ㄤ簬鎻忚堪涓€涓暟鎹寘鐨勮繛鎺ョ姸鎬?*/ if (!(ct = resolve_normal_ct(*pskb, proto,set_reply,hooknum,ctinfo))) return NF_ACCEPT; if (IS_ERR(ct)) return NF_DROP; IP_NF_ASSERT((*pskb)-nfct); /* 濡傛灉娉ㄥ唽浜嗙浉搴旂殑鍗忚鐨刬p_conntrack_protocol缁撴瀯锛屽垯鍦ㄨ繖閲岃皟鐢ㄥ叾涓殑packet鍑芥暟鍋氫竴浜涙鏌?*/ ret = proto-packet(ct, *pskb, ctinfo); if (ret == -1) { /* Invalid */ nf_conntrack_put((*pskb)-nfct); (*pskb)-nfct = NULL; return NF_ACCEPT; } /* 濡傛灉娉ㄥ唽浜嗙浉搴斿崗璁殑ip_conntrack_helper缁撴瀯锛屽垯鍦ㄨ繖閲岃皟鐢ㄥ叾help鍑芥暟 */ if (ret != NF_DROP ct-helper) { ret = ct-helper-help(*pskb, ct, ctinfo); if (ret == -1) { /* Invalid */ nf_conntrack_put((*pskb)-nfct); (*pskb)-nfct = NULL; return NF_ACCE