1. FSU CIS 5930 Internet Protocols
NETFILTER
Reading: Chapter 19
Fall 2004
FSU CIS 5930 Internet Protocols

2. FSU CIS 5930 Internet Protocols
NETFILTER
NF_IP_LOCAL_IN
(iptables: INPUT)
CRC Check
Consistency check
Routing
NF_IP_FORWARD
(iptables: FORWARD)
Higher layers
Local processes
NF_IP_LOCAL_OUT
(iptables: OUTPUT)
Forwarded packets
Incoming packets
Outgoing packets
Device driver (input)
Device driver
(output)
NF_IP_PRE_ROUTING
NF_IP_POST_ROUTING
Fall 2004
FSU CIS 5930 Internet Protocols

3. FSU CIS 5930 Internet Protocols
NETFILTER hooks
A means to insert packet filter code at well-defined locations
NF_IP_PRE_ROUTING
NF_IP_LOCAL_IN
NF_IP_FORWARD
NF_IP_LOCAL_OUT
NF_IP_POST_ROUTING
Fall 2004
FSU CIS 5930 Internet Protocols

4. FSU CIS 5930 Internet Protocols
NF_HOOK()
#define NF_HOOK(pf, hook, skb, indev, outdev, okfn)
(list_empty(&nf_hooks[(pf)][(hook)])
? (okfn)(skb)
: nf_hook_slow((pf), (hook), (skb), (indev), (outdev), (okfn)))
One example:
return NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev, output_maybe_reroute);
Fall 2004
FSU CIS 5930 Internet Protocols

5. Register/unregister hook functions
Template of hook functions
nf_register_hook()
nf_unregister_hook()
typedef unsigned int nf_hookfn(unsigned int hooknum,
struct sk_buff **skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *));
Fall 2004
FSU CIS 5930 Internet Protocols

6. FSU CIS 5930 Internet Protocols
struct nf_hook_ops
Struct nf_hook_ops {
struct list_head list;
nf_hookfn *hook;
int pf;
int hooknum;
int priority; };
Fall 2004
FSU CIS 5930 Internet Protocols