Netfilter学习之NAT类型动态配置（三）MASQUERADE内核空间的实现

今天药忘吃喽~ 2022-05-29 12:50 347阅读 0赞

本节中，我们分析MASQUERADE在内核空间的实现。详细分析在代码中以注释的形式说明。

##### 1.ipt\_MASQUERADE.c源码分析 #####

iptables 命令行在用户空间配置之后，会激活相应的内核空间的钩子函数。此源码即为钩子函数的注册。

/* Masquerade. Simple mapping which alters range to a local IP address (depending on route). */
    
    /* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */
    #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
    #include <linux/types.h>
    #include <linux/inetdevice.h>
    #include <linux/ip.h>
    #include <linux/timer.h>
    #include <linux/module.h>
    #include <linux/netfilter.h>
    #include <net/protocol.h>
    #include <net/ip.h>
    #include <net/checksum.h>
    #include <net/route.h>
    #include <linux/netfilter_ipv4.h>
    #include <linux/netfilter/x_tables.h>
    #include <net/netfilter/nf_nat.h>
    #include <net/netfilter/ipv4/nf_nat_masquerade.h>
    
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
    MODULE_DESCRIPTION("Xtables: automatic-address SNAT");
    
    /* * FIXME: Multiple targets. --RR * 对iptables命令行传入内和空间的数据输入的检测 */
    static int masquerade_tg_check(const struct xt_tgchk_param *par)
    {
        const struct nf_nat_ipv4_multi_range_compat *mr = par->targinfo;
    
        if (mr->range[0].flags & NF_NAT_RANGE_MAP_IPS) {
            pr_debug("bad MAP_IPS.\n");
            return -EINVAL;
        }
        if (mr->rangesize != 1) {
            pr_debug("bad rangesize %u\n", mr->rangesize);
            return -EINVAL;
        }
        return nf_ct_netns_get(par->net, par->family);
    }
    
    static unsigned int
    masquerade_tg(struct sk_buff *skb, const struct xt_action_param *par)
    {
        struct nf_nat_range range;
        const struct nf_nat_ipv4_multi_range_compat *mr;
    
        mr = par->targinfo;
        range.flags = mr->range[0].flags;
        range.min_proto = mr->range[0].min;
        range.max_proto = mr->range[0].max;
    
        /* 调用函数nf_nat_masquerade_ipv4（）将命令行输入的数值传入Netfilter中以实现钩子函数功能*/
        return nf_nat_masquerade_ipv4(skb, xt_hooknum(par), &range,
                          xt_out(par));
    }
    
    static void masquerade_tg_destroy(const struct xt_tgdtor_param *par)
    {
        nf_ct_netns_put(par->net, par->family);
    }
    
    /* * 钩子函数的注册 * 一定要注意，这里的名字必须和用户空间的libipt_masquerade.c中注册的对应 * 这里我们可以看到masquerade的位置是POSTROUTING，即针对内部tuple转化为外部tuple和目标通信 */
    static struct xt_target masquerade_tg_reg __read_mostly = {
        .name       = "MASQUERADE",
        .family     = NFPROTO_IPV4,
        .target     = masquerade_tg,
        .targetsize = sizeof(struct nf_nat_ipv4_multi_range_compat),
        .table      = "nat",
        .hooks      = 1 << NF_INET_POST_ROUTING,
        .checkentry = masquerade_tg_check,
        .destroy    = masquerade_tg_destroy,
        .me     = THIS_MODULE,
    };
    
    static int __init masquerade_tg_init(void)
    {
        int ret;
    
        ret = xt_register_target(&masquerade_tg_reg);
    
        if (ret == 0)
            nf_nat_masquerade_ipv4_register_notifier();
    
        return ret;
    }
    
    static void __exit masquerade_tg_exit(void)
    {
        xt_unregister_target(&masquerade_tg_reg);
        nf_nat_masquerade_ipv4_unregister_notifier();
    }
    
    module_init(masquerade_tg_init);
    module_exit(masquerade_tg_exit);

##### 2.nf\_nat\_masquerade\_ipv4.c源码分析 #####

这里是对上文中调用函数的具体实现。

/* (C) 1999-2001 Paul `Rusty' Russell * (C) 2002-2006 Netfilter Core Team <coreteam@netfilter.org> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */
    
    #include <linux/types.h>
    #include <linux/module.h>
    #include <linux/atomic.h>
    #include <linux/inetdevice.h>
    #include <linux/ip.h>
    #include <linux/timer.h>
    #include <linux/netfilter.h>
    #include <net/protocol.h>
    #include <net/ip.h>
    #include <net/checksum.h>
    #include <net/route.h>
    #include <linux/netfilter_ipv4.h>
    #include <linux/netfilter/x_tables.h>
    #include <net/netfilter/nf_nat.h>
    #include <net/netfilter/ipv4/nf_nat_masquerade.h>
    
    /* masquerade_tg()中引用的函数的具体实现*/
    unsigned int
    nf_nat_masquerade_ipv4(struct sk_buff *skb, unsigned int hooknum,
                   const struct nf_nat_range *range,
                   const struct net_device *out)
    {
        struct nf_conn *ct;
        struct nf_conn_nat *nat;
        enum ip_conntrack_info ctinfo;
        struct nf_nat_range newrange;
        const struct rtable *rt;
        __be32 newsrc, nh;
    
        WARN_ON(hooknum != NF_INET_POST_ROUTING);
    
        ct = nf_ct_get(skb, &ctinfo);
    
        /*仅针对新的通信连接进行该转换，已有的可以在by_source表中查到，详情见下一讲*/
        WARN_ON(!(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED ||
                 ctinfo == IP_CT_RELATED_REPLY)));
    
        /* Source address is 0.0.0.0 - locally generated packet that is * probably not supposed to be masqueraded. */
        if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3.ip == 0)
            return NF_ACCEPT;
    
        rt = skb_rtable(skb);
        nh = rt_nexthop(rt, ip_hdr(skb)->daddr);
    
        /* * 注意看这里，这里的inet_select_addr（）功能是在当前可用的外部IP中随机选择一个 * 由此，实现了对内部IP转化为外部IP的过程 * 由于是随机转化，因此取名为masquerade */
        newsrc = inet_select_addr(out, nh, RT_SCOPE_UNIVERSE);
        if (!newsrc) {
            pr_info("%s ate my IP address\n", out->name);
            return NF_DROP;
        }
    
        nat = nf_ct_nat_ext_add(ct);
        if (nat)
            nat->masq_index = out->ifindex;
    
        /* Transfer from original range. */
        memset(&newrange.min_addr, 0, sizeof(newrange.min_addr));
        memset(&newrange.max_addr, 0, sizeof(newrange.max_addr));
        newrange.flags       = range->flags | NF_NAT_RANGE_MAP_IPS;
        newrange.min_addr.ip = newsrc;
        newrange.max_addr.ip = newsrc;
        newrange.min_proto   = range->min_proto;
        newrange.max_proto   = range->max_proto;
    
        /* Hand modified range to generic setup. */
        return nf_nat_setup_info(ct, &newrange, NF_NAT_MANIP_SRC);
    }
    EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4);
    
    static int device_cmp(struct nf_conn *i, void *ifindex)
    {
        const struct nf_conn_nat *nat = nfct_nat(i);
    
        if (!nat)
            return 0;
        if (nf_ct_l3num(i) != NFPROTO_IPV4)
            return 0;
        return nat->masq_index == (int)(long)ifindex;
    }
    
    static int masq_device_event(struct notifier_block *this,
                     unsigned long event,
                     void *ptr)
    {
        const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
    
        if (event == NETDEV_DOWN) {
            /* Device was downed. Search entire table for * conntracks which were associated with that device, * and forget them. */
            WARN_ON(dev->ifindex == 0);
    
            nf_ct_iterate_cleanup_net(net, device_cmp,
                          (void *)(long)dev->ifindex, 0, 0);
        }
    
        return NOTIFY_DONE;
    }
    
    static int masq_inet_event(struct notifier_block *this,
                   unsigned long event,
                   void *ptr)
    {
        struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
        struct netdev_notifier_info info;
    
        /* The masq_dev_notifier will catch the case of the device going * down. So if the inetdev is dead and being destroyed we have * no work to do. Otherwise this is an individual address removal * and we have to perform the flush. */
        if (idev->dead)
            return NOTIFY_DONE;
    
        netdev_notifier_info_init(&info, idev->dev);
        return masq_device_event(this, event, &info);
    }
    
    static struct notifier_block masq_dev_notifier = {
        .notifier_call  = masq_device_event,
    };
    
    static struct notifier_block masq_inet_notifier = {
        .notifier_call  = masq_inet_event,
    };
    
    static atomic_t masquerade_notifier_refcount = ATOMIC_INIT(0);
    
    void nf_nat_masquerade_ipv4_register_notifier(void)
    {
        /* check if the notifier was already set */
        if (atomic_inc_return(&masquerade_notifier_refcount) > 1)
            return;
    
        /* Register for device down reports */
        register_netdevice_notifier(&masq_dev_notifier);
        /* Register IP address change reports */
        register_inetaddr_notifier(&masq_inet_notifier);
    }
    EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_register_notifier);
    
    void nf_nat_masquerade_ipv4_unregister_notifier(void)
    {
        /* check if the notifier still has clients */
        if (atomic_dec_return(&masquerade_notifier_refcount) > 0)
            return;
    
        unregister_netdevice_notifier(&masq_dev_notifier);
        unregister_inetaddr_notifier(&masq_inet_notifier);
    }
    EXPORT_SYMBOL_GPL(nf_nat_masquerade_ipv4_unregister_notifier);
    
    MODULE_LICENSE("GPL");
    MODULE_AUTHOR("Rusty Russell <rusty@rustcorp.com.au>");

##### 3.小结 #####

通过以上分析，我们可以了解了iptables命令行激活的内核中钩子函数是如何定义和实现的。但是依然有着许多的疑问，比如，钩子函数如何实现了NAT的类型转化？具体函数如何起作用的等等。这些问题是解决不同类型NAT实现的关键所在，将在下面几节中分析。

本文结束。