Iptable.s NAT的基本工作原理域名
(1) IP地址转换过滤器(CONFIG_IP_NF_NAT)用来实现各种IP续接. 当主机之间不能直接进行IP寻径时，通.过双方都能寻径的代理主机.的.IP地址转换器进行相互翻译，形成一个透明的IP回路。常见的地址转换.类型有IP伪装(IP MASQUERADE), 端口转发(PORT FORWARDING)，IP重定向(IP REDIRECT). --------------彩票
(2) IP伪装可以使内网中的主机共享网关主机在外网中的地址来与外网主机通信, 当内网主机的IP包要传送到外网主机时, 网关的地址转换器将IP.包的源地址和端口置换成自已的地址.传递到外网目的.主机, 当目的主机应答.时, 网关再将应答包的目的地址和端口恢复成内网主机的IP地址和端口.--------------彩票
(3) 当外网主机.首先与内网网关主机建立连接时, 网关的地址转换器可以将不.同端口的IP包转接到不同的内网主机中, 这就是端口转发. .网关修改外网IP包的源地址和目的地址以及端口传递到.相应的内网主机中, 内网主机的应答包再被网关恢复其源地址和目的地址及其端口发送回外网主机. 婚庆
(4) 通过.网关的IP包可以被网关将其目的地址替换为本地地址., 把通过网关的外部连接定向到主机本身, 这就是IP重定向, 可以用来实现IP透明代理. 外汇
(5) IP地址变换器建立在IP轨迹跟踪的.基础上, IP轨迹可看成主机与主机之间的IP回路在网关主机内产生的映象. 当IP包从内网主机通过网关主机向外.网主机发出初次请求时, 就在网关主机内产生了一条请.求轨迹, 当外网主机通过网关向内网主机发出应答时, 通过网关主机的应答包就被IP轨迹跟踪器绑定在对.应的请求轨.迹上. 每条轨迹具有正向地址元和逆向地址元分别与请求IP包地址与应答IP包地址匹配. 在正常的.网关路由过程中, 轨迹的正向请求与逆向应答地址元.是对称的, 当引入了地址转换操作以后, 轨迹的正向与逆向地址元的对称性被破坏, 成为转移轨迹, 绑定在转移轨迹上的IP包通过地址转换过滤器后, IP包的地址将发生变化, 即请求包的地址被.置换为转移轨迹逆向应答地址元的逆地址, 应答包的.地址被置换为转移轨迹前向请求地址元的逆地址. 由此可见, 标准的IP寻径操作可以看成IP地址转换操作的一种特例.
(6) IP地址变换器是IP轨迹跟踪器的后级过滤器, 它有3个过滤端. IP包的地址转换并不是一次完成的, IP包目的地址转换在路由前.端或本地输出端完成, IP包的源地址转换在路由后端完成, 地址变换器输出注入到IP轨迹跟踪器的未端输出. ip_nat_info描述轨迹的地址转换信息, 它是IP轨迹.结构(ip_conntrack)的一部分.. 对于新建轨迹, 转换器将从地址.转换规则表(nat_table)建立轨迹的地址转换信息, .ip_nat_info结构中的ip_nat_info_manip结构用于完成IP包地.址的映射和逆映射.电影
/* Worst case: local-out manip + 1 post-routing, and reverse dirn. */ .#define IP_NAT_MAX_MANIPS (2.*3) ./* The structure embedde.d in the conntrack str..uctu.re. */ struct ip_nat_info { /* Set to zero when conntrack created: bitmask of maniptypes */ int i.nitialized; unsigned int num_manips; /* Manipulations to be done on this conntrack. */ struct ip_nat_info_manip manips[IP_NAT_MAX_M.ANIPS]; /* The mapping type whi.ch crea.t.ed us (NULL for null map.ping). */ const st.ruct ip_nat_mapping_type *mtype; struct ip_nat_hash bysource, byipsproto.;. /* Helper (NULL if none). */ struct ip_nat_helper *he.lper; }; struct ip_nat_info_manip { /* The. direction. */ u._int8_t direction; /* Which hook the manipulation happens on. */ u_int8_t hooknum; ./* The .manipu.lation type. */ u_int8_t maniptype; /* Man.ipulations .to occur at each conntrack in this dirn. */ struct ip_conntrack_manip manip; }; /* Hashes for by-source and IP/protocol. */ struct ip_nat_hash { struct list._head list; /* conntrack we're embedded in: NULL if not in hash. */ struct ip_c.onn.trac.k *conntrack; }; /* A range co.nsists of an array of 1 or. more ip_nat_range */ struct ip_nat_multi_range 建立地址转换信息的规则表的参数结构 { unsigned int rangesize; /* hangs off end. */ struct ip_nat_range r.ange[1]; }; /* Single range specification. */ struct ip_nat_range { /* Set to OR of flags above. */ unsigned int flags; /* Inclusive: network order. */ u_int32_t min_ip, max_ip; /* Inclusive: network order */ union ip_conntrack_manip_proto min, max; }; /* Return conntrack .an.d conntrack_info a given skb */ inline struct ip_conntrack * ip_conntrack._get(struct sk_buff *skb, enu.m ip_conntrack_info *ctinfo) 取包缓冲所绑定的轨迹 { if (.skb->;nfct) { struct ip_conntrack *ct = (struct ip_conntrack *)skb->;nfct->;master; /* ctinfo is the index of the nfct inside the conntrack */ *ctinfo. = skb->;nfct - ct->;infos; IP_NF_ASSERT(*ctinfo >;= 0 && *ctinfo < IP_CT_NUMBER); return ct; } return NULL; } extern inline int ip_ct_tup.le_src_equal(const struct ip_conntr.ack_tuple *t1, const struct ip_conntrack_tuple *..t2) { return t1->;src.ip == t2->;src.ip &&. t1->;src.u.all == t2->;src.u.all; } extern inline int ip_ct_tuple_dst_equal(const struct ip_conntrack_tuple *t1, const struct ip_conntrack_tuple *t2) { return t1->;dst.ip == t2->;dst.ip &&. t1->;dst.u.all == t2->;dst.u.all && t1->;dst.protonum == t2->;dst.protonum; } enum ip_nat_manip_type { IP_NAT_MANIP_S.RC, IP_NAT_MANIP_DST }; /* SR.C manip occurs only on POST_ROUTING */ #define .HOOK2MANIP(hooknum) ((hooknum) != NF_IP_POST_R.OUTING) #define CTINFO2DIR(ctinfo) ((ctinfo) >;= IP_CT_IS_REPLY ? IP_CT_DIR_REPLY : IP_CT_DIR_ORIGINAL) ; net/ipv4/netfilter/ip_nat_standalone.c: ----------------------------------------- * We must be after connection tracking and before packet filtering. */ /* Before packet filtering, change destination */ static struct nf_hook_ops ip_nat_in_ops 路由.前IP输入地址转换器 = { { NULL,. NULL }, i.p_nat_fn, PF_INET, NF_IP_PRE_ROUTING, NF_IP_PRI_NA.T_DST }; /* After packet filtering,. change source */ sta.tic struc.t. nf_hook_ops ip_nat_out_o.ps 路由后IP输出地址转换器 = { { NULL, NULL }, ip_nat_out, PF_INET, NF_IP_POST_ROUTING, NF_IP_PRI_NAT_SRC}; /* Befo.re packet filtering, change destination */ static struct nf_hook_ops ip_nat_local_out_.ops 本地输出地址转换器 = { { NULL, NULL }, ip_na.t_local_fn, PF_INET, NF_IP_LOCA.L_OUT, NF_IP_PRI_NAT_DST }; static int init_or_c.leanup(int init) 地址转换模块初始化 { int ret = 0; if (!init) goto cleanup;. ret = ip_nat_rule_init(); 地址转规则表初始.化 if (ret < 0) { printk("ip_nat_init: can't setup rules.\n"); goto cle.anup_no.thing; } ret = ip_nat_init.(); 地址转换器初始化 if (ret < 0) { printk("ip_nat_init: can't setup r.ules.\n"); g.oto cleanup_rul.e_init; } ret = nf_register_hook(&ip_nat_in_ops); if (ret < 0.) { printk("ip_nat_init: can't register in hook..\n"); goto cleanup_nat; } ret = nf_register.._hook(&ip_n.at_out_ops); if (ret < 0) { p.rintk("ip_nat_init: can't register out hook.\n."); goto cleanup_inops; } ret. = nf_register_hook(&ip_nat_local_out_ops); if (ret < 0) { printk("ip_nat_init: can't register local out hook.\n"); go.to cleanup_outops; } if (ip_conntrack_module) __MOD_INC_USE_COUNT(ip_conntrack_module); .return ret; cleanup: if (ip_conntrack_module) __MOD_DEC_USE_COUNT(ip_conntrack_module); nf_unregister_hook(&ip_nat_local_out_ops); cleanup_outops: nf_unregister_hook(&ip_nat_out_ops); c.leanup_.inops: nf_unregister_hook(&ip_nat_in_ops); cleanup_nat: ip_nat_cle.a.nup(); cleanup_rule_init: ip_nat_rule_cleanu.p(); cleanup_nothing: MUST_BE_READ_WRITE_UNLOCKED(&ip_nat_lock); return ret; } static un.signed int ip_nat_fn(unsigned int hooknum, struct sk_buff **pskb, c.onst struct net_device *in, const struct net_device *out, int (*okfn)(s.truct sk_buff *)) 地址转换器入口 { st.ruct ip_conntrack *ct; enum ip._conntrack_info ctinfo;. struct ip_nat_info *info; /* maniptype == SRC. for postrouting. */ enum ip_nat_manip_type mani.ptyp.e = HOOK2MANIP(hooknum); 取本过滤端所能进行地址转换的类型 /* We never see fragments: c.onntrack defrags on pre-routing and loc.al-out, .and ip_nat_out pr.otects post-routing. */ IP_NF_ASSERT(!((*pskb)->;nh.iph->;frag_off & __constant_htons(IP_MF|IP_OFFSET))); (*pskb)->;nfcache |= NFC_UNKNOWN; /* If we had a ha.rdware checksum before, it's now invalid */ if ((*pskb)->;pkt_type != PACKET_LOOPBACK) (*pskb)->;ip_summe.d = CH.ECKSUM_NONE; ct = ip_conn.track_ge.t(*pskb, &ctinfo); 取包轨迹 /* Can't track? Mayb.e out of memory.: this would make NAT unreliable. */ if (!ct) { if (net_ratelim.it()) .printk(KERN_D..EBUG "NAT: %u dropping unt.racked packet %p %u %u.%u.%u.%u ->; %u.%u.%u.%u\n", hooknum, *pskb, (*pskb)->;nh.iph->;protocol, NIPQUAD((*pskb)->;nh.iph->;saddr), NIPQUA.D((.*pskb)->;nh.iph->;daddr)); return NF_DROP; } switch (ctinfo) { case IP_CT_RELATED: case IP_CT._RELATED+IP_CT_IS_R.EPLY: if ((*pskb)->.;.nh.iph->;protocol == IPPROTO_ICMP) { return icmp_reply_translation(*pskb, ct, hooknum, CTINFO2DIR(ctinfo)); } /* Fall thru... (Only ICMPs can be IP_CT_IS_REPL.Y) */ case IP_CT_NE.W: 对于跟踪到的新轨迹 info = &ct->;nat.info; WRITE_LOCK(&ip_nat_lock); /* Seen it before? This can hap.pen for loopback, retrans, or local p.ackets.. */ if. (!(inf.o->;initialized .& (1 << maniptype))) { int in_h.ashes = info->;initialized; unsigned int ret; ret = .ip_nat_rule_find(pskb, hooknum., i.n, out, ct, info); 建立轨迹的地址转换信息 if (ret != NF_ACCEPT) { WRITE_UNLOCK(&ip_nat_lock); return ret.; } if (i.n_hashes) { IP_NF_ASSERT(info->;bysource.conntrack.); replace_in_hashes(ct, info); } else { place_in_hashes(ct, info); 对转换轨迹进行索引 } .} else DEBUGP("Already setup manip %s for. ct %p\n", maniptyp.e == IP_NAT_MANIP_SRC ? "SRC" :. "DST", ct); WRITE_UNLOCK(&ip_nat_lock); break; default: /* ESTABLISHED */ IP_NF_ASSERT(ctinfo == IP_CT_ESTABLISHED || ctinfo == (IP_CT_ESTABLISHED+IP_CT_IS_REPLY)); i.nfo = &ct->;nat.info; } IP_NF_ASSERT(info); return do_bindings(ct, ctinfo, info, hooknum, pskb); 进行包的地址转换 } static unsigned int ip_nat_out(unsigned int hooknum, struct sk_buff **psk.b, const struct net_device *in, const struct net_device *ou.t, int (*okfn)(struct sk_buff *)) 路由后输出转换器 { /* root. is playing with raw sockets. */ if ((*pskb)->;len < sizeof(st.ruct iphdr) || (*pskb)->;nh.iph->;ihl * 4 < sizeof(struct iphdr)) return NF_ACCEPT; /* We can hit fragment here; forwarded packets get defragmented b.y connection tracking coming in, then fragmented (grr) by the forward code. In fut.ure: If we have nfct != NULL, AND we .have NAT initialized, AND there is no helper, then we can do full NAPT on the hea.d, and IP-address-only NAT on the rest. I'm .starting to have nightmares about fragments. */ if ((*pskb)->;nh.iph->;frag_off & __constant_htons(IP_MF|IP_OFFSET)) { *pskb = ip_ct_gather_frags(*pskb); if. (!*pskb) return NF_STOLEN.; } return ip_nat_fn(hooknum, pskb, in, out, okfn); } static unsigned int ip_nat_local_fn(unsigned int hooknu.m, struct .sk_buff **pskb, c.onst struct n.et_devic.e *in, const struct net_device *out, int (*okfn)(struct sk_bu.ff *)) 本地输出转换器 { .u_int32_t saddr., daddr; unsigned int ret; /* roo.t is playing with raw sockets. */ if ((*psk.b)->;len < size.of(struct iphdr) || (*pskb)->;nh.iph->;ihl * 4 < sizeof(struct iphdr)) ret.urn NF_ACCEPT; saddr = (*pskb)->;nh.iph->;saddr; daddr = (*pskb)->;nh.iph->;daddr;. ret = ip_nat_fn(hookn.um, pskb, in, out, okfn); if (ret != NF_DRO.P && ret != NF_STO.LEN && ((*pskb.)->;nh.iph.->;saddr != saddr || (*pskb)->;nh.iph->;daddr != daddr)) 如果转换器输出包的IP地址发生变化, return .route_me_harder(*pskb) == 0 ? ret : NF_DROP; 重新绑定输出包路由 return ret; } /* FIXME: change in oif may mean change in hh_len. Check and realloc --RR */ static int route_me_harder(struct sk_buff *skb) { struct iphdr *i.ph = skb->;.nh.iph; struct rtable *rt; struct .rt_key key = { dst:iph->;daddr, src:iph->;saddr, oif:skb->;sk ? skb->;sk->;bound_dev_if : 0, tos:R.T_TOS(iph->;.tos)|RTO_CONN, #ifdef CONFIG_IP_R.OUTE_FWMARK fwmark:skb->;nfmark #endif }; if (ip_route_output_key(&r.t, &key.) != 0) { printk("route_me_harder: No. more route.\n"); return -EINVAL; } /* Drop old route. */ dst_release(skb->;dst); skb->;dst = &rt->;u.dst; return 0; } ; net/ipv.4/netfilter/ip_nat_core.c: .----------------------------------- #define IP_NAT_HTABLE_SIZE 64 static struct list_head bysource[IP_NAT_HTABLE_SIZE]; 按转移轨迹源地址和协议索引的散列表 static struct list_head byipsproto[IP_NAT_HTABLE_SIZE]; 接转移轨迹IP地址和协议进行索引的散列表 LIST_HEAD(protos);. 传输协议地址转换器 static LIST_HEAD(helpers); LIST_HEAD.(nat_expect_list); int __init ip_nat_init(void) { size_t i; /.* Sew in builtin protocols. */ WRITE_.LOCK(&ip_nat_lock); list_append(&protos, &ip_nat_protocol_tcp); list_append(&protos, &ip_nat_protocol_udp); list_append(&protos, &ip_nat_protoco.l_icmp); WRITE_UNLOCK(&ip_nat_lock); for (i = 0; i < IP_NAT_HT.ABLE_SIZE; i++) { INIT_LIST_HEAD(&bysource[ i ]); INIT_LI.ST_HEAD(&byipsproto[. i ]); } /* FIXME: .Man, t.his is a hack. */ IP_NF_ASSERT(ip_conntrack_destroy.ed == NULL); ip_conntrack_destroyed = &ip_nat_cleanup_conntrack; return 0; } /* Do pac.ket man.ipulations according to binding. */ unsigned int do_bindings.(struct ip_conntrack *ct, enum ip_conntrack_info ctin.fo, struc.t ip_nat_info *info, unsigned int hooknum, struct sk_buff .**pskb) 完成地址转换 { unsigned int i; struct ip_nat_helper *helper; enum ip_conntrack_dir dir = CTINF.O2DIR(ctinfo); /* Need nat lock .to protect against modification, but ne.ither conntrack .(referenced) and helper (deleted with synchronize_bh()) can vanish. */ READ_LOCK(&ip_nat_lock); for (i = 0; i < info->;num_manips; i++) { if (i.nfo->;manips[ i ].direction == dir && info->;m.anips[ i ].hooknum ==. hooknum) { 对于特定的转换方向和过滤端 DEBUGP("Mangling %p: %s to %u.%u.%u.%u %u\n", *.pskb, info->;manips[ .i ].maniptype == IP_NAT._MANIP_SRC ? "SRC". : "DS.T", NIPQUAD(info->;manips[ i ].manip.ip), htons(info->;manips[ i ].manip.u.all)); manip_pkt((*pskb)->;nh.iph->;protocol, (*pskb)->;nh..iph, (*pskb)->;len, &.info->.;manips[ i ].manip, info->;manips[ i. ].maniptype, &(*p.skb)->;nfcache.);. } } helper = info->;helper; READ_UNLOC.K(&ip_nat_lock); if (helper) { /* Always defragged for helpers */ IP_NF_ASSERT(!((*pskb)->;nh.iph->;f.rag_off & __constant_htons(IP_MF|IP_OFFSET))); return helper->;help(ct, info, cti.nfo, hooknum, pskb); } else return NF_ACCEPT; } static void manip_pk.t(u_int16_t proto, struct .iphdr *iph, size_t len, const struct ip_connt.rack_manip *manip, enum ip_nat_manip_type maniptype, __u32 *nfcache) { *nfcache |= NFC_ALTERED; find_nat_proto(proto)-.>;manip_pkt(iph, len, manip, maniptype); 转换传输层地址元 if (maniptype == IP_N.AT_MANI.P_SR.C) { 如果为源地址转换 iph->;check = ip_nat_cheat_check(~iph->;saddr, manip->;ip, iph->;check); iph->;saddr = manip->;ip; 置换IP包的源.地址 } el.se { 否则为目标地址.转换 iph->;check = ip_nat_cheat_check(~iph->;daddr, manip->;ip, iph->;check); iph->;daddr = manip->;ip; 置换IP包的目的.地址 } #if 0 if. (ip_fast_csum((u8 *)iph, iph->;ihl) != 0) DEBUGP("IP:. checksum on packet bad.\n"); if (proto == IPPRO.TO_TCP) {. void *th = (u_int32_t *)iph + iph->;ihl; if (tcp_v4_check(th, len - 4*.iph.->;ihl, iph->;saddr, iph->;daddr, csum_partial(.(char *)th, len-4*iph-.>;ih.l, 0))) DEBUGP("TCP: c.hecksum on packet bad\n").; } #endif. } int ip_nat_rule_find(struct sk_buff **pskb, unsigned int hooknum, const struct net_device *in, const struct net_device *out,. struct ip_conntrack *ct, struct ip_nat_in.fo *info) 从NAT规则表中建立轨迹的地址转换信息 { .int ret; /* Master won't vanish whi.le this ctrack still alive */ if. (ct->;master.master) { 如果该轨迹是从属于ma.ster的轨迹 struct ip_conntrack *master; master = (struct ip_conntrack *)ct->;master.master; if (LIST_FIND(&nat_ex.pect_list, call_expect, struct ip_nat_expect *, pskb, hooknum,. ct, info, master, &master->;nat.i.nfo, &ret)) return ret; } ret = ipt_do_table(pskb, hooknum, in, out, &nat_table, NULL); 运行地址转换规则.表 if (re.t == NF_ACCEPT) { i.f (!(info->;initial.ized & (1 << HOOK2MANIP(hooknum)))) /* NUL mapping */ re.t = alloc_null_b.inding(ct, i.nfo, hooknum); 建立空转换信息 } return ret; } sta.tic inline unsigned int alloc_null_binding(struct ip_conntrack *conntrack, struct ip_nat_info *info, u.nsigned. int hooknum) { /* Force range to this IP; let proto decide mapping for per-proto .parts (hen.ce not .IP_NAT_RANGE_PROTO_SPECIFIED). Use reply in case it's already been mangled (eg local packet.). */ u_int32_t ip = (HOOK2MANIP(hooknum) == IP_NAT_MANIP_SRC ? conntrack->;tupl.ehash[IP_CT_DIR_REPLY].tuple.dst.ip :.. conntrack->;tup.lehash[IP_CT_DIR_REPLY].tuple.src.ip); struct ip_nat_multi_r.ange mr = { 1, { { IP_NAT_RANGE_MAP_IPS, ip, ip, { 0 }, { 0 } } } }; DEBUG.P("Allocating NULL binding for .%p (%u.%u..%u.%u)\n", conntrack, NIPQU.AD(ip)); r.eturn ip_nat_setup_info(conntrack, &mr, hooknum); } /* Where to ma.nip t.he reply packets .(will be reverse manip). */ static unsigned int opposite_hook[NF_IP_NUMHOOKS] = { [NF_I.P_PRE_ROUTING] = NF_IP_POST_ROUTING, [NF_IP_POST_ROUTIN.G] = NF._IP_PRE_ROUTIN.G, [NF_IP_LOCAL_OUT] = NF_IP_POST_ROUTING }; unsigned int ip_nat_setup_.info(struct ip_.conntrack *conntrack, const struct ip_.nat_multi_range *mr, unsigned int hooknum) 建立地址转换信.息 { struct ip_conntrack_tuple new_tuple, inv_tuple, reply; struct ip_conntrack_tuple orig_tp; struct ip_nat_info *info = &conntrack->;nat.info; MUST_BE_WRITE_LOCKED(&ip_nat_lock); IP_NF_ASSERT(hooknum == NF_IP_PRE_ROU.TING || hooknum == NF_IP_POST_ROUTING || hooknum == NF_I.P_LOCAL_OUT); IP_NF_ASSERT(info->;num_manips < IP_NAT_MAX_MANIPS); /* What we've got wil.l look like inverse of reply.. Normally this is what is in the conntrack, ex.cep.t for prior manipulations (futur.e optimization: if num_manips == 0, .orig_.tp = conntrack->;tupleh.ash[IP_CT_DIR_ORIGINAL].tuple) */ inv.ert_t.uplepr(&orig_tp., &conntrack->;tuplehash[IP_CT_DIR_REPLY].tuple); 取原始的目标地址元 #if 0 { unsigned int i; DEBUGP("Hook %u (%s), ", hooknum, HOOK2MANIP(hooknum)==IP_NAT_MANIP_SRC ? "SRC" : "DST"); DUMP_TUPLE(&orig_tp); DEBUGP(".Range %p: ", mr); for (i = 0; i < mr->;.rangesize; i++) { DEBUGP("%u:%s.%s.%s %u.%u.%u.%u - %u.%u.%u.%u %u - %u\n", i., (mr->;range[ i ].flags & IP_NAT_RANGE_MAP_IPS) ? " MAP_IPS" : "", (mr->;range[ .i ].flags & IP_.NAT_RANGE_PROTO_SPECIFIED) ? " PR.OTO_SPECIFIED" : "", (mr->;range[ i ].flags & IP_NAT_RANGE_F.ULL.) ? " FULL" : "",. NIPQUAD(mr->;ra.nge[ i ].min_ip), NIPQUAD(m.r->;range[ i ].max_ip), mr->;range[ i ].min.all, mr->;range[ i ].max.all); } } #endif do {. if (!get_unique_tuple(&new_tuple, .&.orig_tp, mr, conntrack, 通过规则参数取新的目标地址元 hooknum)) { 指向目的主机的地址元 DEBUGP("ip_.nat_setup_info: Can't g.et. .unique for %p.\n", conntrack); return NF_DROP; } #if 0 DEBUGP.("Hook %u (%s) %p\n", h.ooknum, HOOK2MANIP(hooknum)==IP_NAT_MANIP_SRC ? "SRC" : ."DST", conntrack); DEBUGP("Original: "); DUMP_TUPLE(&orig_tp); DEBUGP("New: ".); DUMP_TUPLE(&new_tup.le); .#endif /* We .now have two tuples (SRCIP/.SRCPT/DSTIP/DSTPT): the original (A/B/C/D') and. the mangled one (E/F/G/H'). We're only allowed to work with the SRC per-proto part, so we create inv.erses of both t.o sta.rt, then derive the other fields we need. */ /* Reply connection: simply invert the new tuple (G/H/E/F') */ invert_tu.plepr(&reply, &new_tuple); 求新目标地址元的反向应答元 /* Alter conntrack table so it recognizes replies. If fail this race (repl.y tuple now used), repeat. */ } while (!ip_conntrack_alter_reply(conntrack, .&reply)); 设置轨迹的应答元 /* FIXME: We can simply used existing conntrack reply tuple here .--RR */ /* Create inverse of original: C/D/A/B' */ invert_tuplepr(&inv_tu.ple, &.orig_tp); 取.原目标地址元的.反向应答元 /* Has source changed?. */ if (!ip_ct_tuple_src_equal(&new_tuple, &orig_tp)) { 如果新目标地址元和.原目标地址元源地址不等 /* In this direction, a source manip. */ info->;mani.ps[info->;num_manips++] = 建立原向源地址映射结构 ((struct ip_nat_info_manip) { IP_CT_DIR_.ORIGINAL, hooknum, IP_NAT_MANIP_SRC, new_tuple.src }); IP_NF_ASSERT(info->;num_manips < IP_NAT_MAX_MANIPS); /* In the reverse direction, a destination manip. */ info->;manips[info->;num_manips++] = 建立逆向源地址逆映射结构 ((struct ip_nat_info_manip) { IP_CT_DIR_REPLY, opposite_hook[hooknum], IP_NAT_MANIP_DST, orig_tp.src }); IP_NF_ASSERT(info->;num_man.ips <= IP_NAT_MAX_MANIPS); } /* Has destination changed? */ if (!ip_ct_tuple_dst_equal(&new_tuple, &orig_tp)) { 如果新目标地址元和旧目标地址元目的地址不等 /* In this direction, a destination manip */ info->;manips[info->;num_manips++] = 建立原向目的地址映射结构 ((struct i.p_nat_info_manip) { IP_CT_DIR_ORIGINAL, hooknum, IP_NAT_MANIP_DST, reply.src }); IP_NF_AS.SERT(info->;num_manips < IP_NAT_MAX_MANIPS).; /* In the reverse direction, a source manip. */ info->;manips.[info->;num_manips++] = 建立逆向目标地址映射结构 ((struct ip_nat_info_manip) { IP_CT_DIR_REPLY, opposite_hook[hooknum], IP_NAT_MANIP_SRC., inv_tuple.src }); IP_NF_ASSERT(info->;n.um_man.ips <=. IP._NAT_MAX_MANIPS); } /* If there's a helper, assign it; based on new tuple. */ info->;.helper = LIST_FIND(&helper.s, helper_cmp, st.ruct ip_nat_helper *, &reply); /* It's. done. */ info->;.initialized |= (1 << HOOK2MANIP(hooknum)); 过滤端初始化标记 re.turn NF_ACCEPT.; } int invert_tuplepr(s.truct ip_conntrack_tuple *inverse, const struct ip_conntrack_tuple *orig) { return invert._tuple(inverse, orig, find_proto(orig->;dst.pro.tonum)); } /* If it's really a local destination manip, it may need to do a sour.ce manip too. */ static int do_extra_mangle(u_.int32_t var_.ip, u_int32_t *other_ipp) { struct rtable *rt; /* FIXME: IPTOS_TOS(iph->;tos). --RR */ if (ip_route_output(&rt, var_ip, 0, 0, 0) != 0) { D.EBUGP("do_ex.tra_mangle: Ca.n't get route to %u.%u.%u.%u\n", NIPQUAD(var_ip)); return 0; }. *other_ipp = rt-.>;rt_src; ip_rt_put(rt); return 1; } /* Alter reply tuple (maybe alter helper). If it's alrea.dy taken, return 0. and don't do alteration. */. int ip_conntrack_alter._reply(struct ip_conntrack *conntrack, co.nst struct ip_co.nntrack_tuple *newreply) { u.nsigned int newindex = hash_conntrack(newreply); WRITE_LOCK(&ip_conntrack_lock); if (__ip_conntrack_find(newreply, conntrack)) { WRITE_UNLOCK(&ip_conntra.ck_lock); return 0; } DEBUGP("Altering reply tuple of %p to ", conntrack); DUMP_TUP.LE(newreply); LIST_DELETE(&ip_conntrack_hash [hash_conntra.ck(&conntrack->;tuplehash[IP_CT_DIR_.REPLY] .tuple)], &c.onntrack->;tuplehash[IP_CT_.DIR_REPLY]); conntrack->;tuplehash[IP_CT_DIR_REPLY].tuple = *new.reply; l.ist_prepend(&ip_conntrack_hash[newindex], &conntrack->;tuplehash[IP_.CT_DIR_REPLY]); conntrack->;helper = LIST_FIND(&helpers, helper_cmp, struct ip_conntrack_helper *, newre.ply); WRITE_UNLOCK(&ip_conntrack_lock); return 1;.. .} /* W.e. do che.cksum mangling, so if they were wrong before they're still.. * wrong. Also works for incomplete packets (eg. ICMP dest .* unreachables.) */ u_int16_t ip_nat_cheat_check(u_int32_t oldvalinv, u_int32_t newval, u_int16_t oldcheck) { u_int32_t diffs[] = { oldvalinv, newval }; return csum_fold(csum_partial((char *)diffs, sizeof(diffs), oldcheck^0.xFFFF)); } static inline int call_expect(const struct ip_nat_expect *i, struct sk_buff. **ps.kb, unsigned int hooknum, struct ip_conn.track *ct, struct ip_nat_info *info, struct ip_conntrack *master, struct ip_nat_info *masterinfo, unsigned int *verdict) { return. i->;expect(p.skb, hooknum, ct, .info, master, masterinfo, verdict); } void replace_in_hashe.s(struct ip_conntrack *conntrack, struct ip_nat_info *in.fo) { /* Source has changed, so replace in hashes. */ uns.igned int srchash = hash_by_src(&connt.rack->;tuplehash[IP_CT_DIR_ORIGINAL] .tuple.src, conntrack->;t.uplehash[IP_CT_DIR_ORIGINAL] .tuple.dst.protonum); /* We place p.acket as seen OUTGOUNG in byips_proto hash (ie. reverse dst and src of reply packet. */ unsigned int ipsprotohash = hash_by_ipsproto(conntrack->;tuplehash[IP_CT_DIR_REPLY] .tuple..dst.ip, conntrack->;tuplehash[IP_CT_DIR_REPLY] .tuple.src..ip, conntrack->;tuplehash[IP_CT_DIR_REPLY] .tuple.dst.protonum); IP_NF_ASSERT(in.fo-.>;bysource.conntrack. ==. conntrack); MUST_BE_WRITE_LOCKED(&ip_nat_lock); list_del(&info->;bysource.list); list_del(&info->;byipsproto.list); list_prepend(&bysource[srchash], &info->;bysource); list_pre.pend(&byipsproto[ipsprotohash], &info->;byipsproto); } void. place_in_hashes(s.truct ip_conntrack *conntrack, struct ip_nat_info *info) { unsigned int srchash = hash_by_src(&conntrack->;tuplehash[IP_CT_DIR_ORIGINAL] .tuple.src, conntrack->;tuplehash[IP_CT_DIR_O.RIGINAL] .tuple.dst.protonum); /* We place packet as seen OUTGOUNG in byips_proto hash (ie. reverse dst. and src of reply packet. */ unsigned int ipsprotohash = hash_by_ipsproto(conntrack->.;tuplehash[IP_CT_DIR_REPLY] .tuple.dst.ip, conntrack->;tuplehash[IP._CT_DIR_REPL.Y] .tuple.src.ip, conntrack->;tuplehash[IP_CT_DIR_REPLY] .tuple.dst.protonum); IP_NF_ASSERT(!info->;bysource.conntrack); MUST_BE_WRITE_LOCKED(&ip_nat_lock); info.->;byipsproto.conntrack = conntrack; info->;bysource.con.ntrack = conntr.ack; list_pr.epend(&bysource[srchash], &info->;bysource); list_prepend(&byips.proto[ipsprotohash], &info->;byipsproto); .} static .inline size_t hash_by_src(const struct ip_conntrack_manip *manip, u_int16_t proto) 按源地址.和源端口索引 { /* Original src, to ensure we map it consistently if poss. */ retur..n (manip->;ip + manip->;u.all + proto) % IP_NAT_HTABLE_SIZE; } /* We keep extra hashes for each conntr.ack, for fast searching. */ static inline size_t hash_by_ipsproto(u_int32_t sr.c, u_int32_t dst, u_int16_t proto) 按IP地址索引 { /* M.odified src and dst, to ensure we don't create two identical streams. */ r.eturn (src + dst + proto.) % IP_NAT_HTABLE_SIZE; } /* Noone using conn.track by the time this called. */ stati.c v.oid ip_nat_cleanup_conntrack(struct ip_conntrack *conn) { struct ip_nat_info *info = &con.n->;n.at.info; if (!info->;initialized) return; IP_N.F_ASSERT(info->;bysource.conntrack); IP_NF_ASSERT(.info->;byipspr.oto.co.nntrack); WRITE_LOCK(&ip_nat_lock); LIST_DELETE(&bysource[hash_by_src(&conn->;tuplehash[IP_C.T_DIR_ORIGINAL] .tuple.src, conn->;tup.lehash[IP_CT_DIR_ORIGINAL] .tuple.dst.protonum)], &info->;bysource); LIST_DELETE(&byipsproto [hash_by_ipsproto(conn->;tuplehash[.IP_CT_.DIR_REPLY] .tuple.src.ip, conn->;tuplehash[IP_CT_DIR_REPLY] .tuple.dst.ip, conn->;t.uplehash[IP_.CT_DIR_REPLY] ..tuple.dst.protonum)], &info->;byipsproto); WRITE_UNLOCK(&ip_n.at_lock); } 建材
复制代码
