什么是定义Netfilter钩子函数的正确方式？

Question

我正在编写一个内核模块（更具体地说，是一个Netfilter模块）用于Linux。我试图使其兼容各种版本的内核，但入口函数给我带来了麻烦。

从LXR上可以看到，nf_hookfn类型定义在3.13内核中发生了变化。 Linux 3.12及之前版本:

typedef unsigned int nf_hookfn(unsigned int hooknum, (...));

从3.13开始：

typedef unsigned int nf_hookfn(const struct nf_hook_ops *ops, (...));

然而，我们有一台红帽机器声称正在使用内核3.10.0-123.4.4.el7.x86_64，但它的netlink.h文件却显示：

typedef unsigned int nf_hookfn(const struct nf_hook_ops *ops, (...));

我仿佛在写3.13+版本的代码。

它导致我的模块产生警告，因为它彻底破坏了我根据内核版本不同定义函数的尝试：

#if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
#define HOOK_ARG_TYPE const struct nf_hook_ops *
#else
#define HOOK_ARG_TYPE unsigned int
#endif

我错过了哪个文档？从来没有任何文件提示我内核API依赖于内核版本和发行版，这毫无意义。

更重要的是，我该怎么办？nf_hookfn是一个typedef，而不是宏，所以我不能在我的函数定义中直接使用它。 可能会让事情变得更容易的一件事是，我从来没有使用那个参数。

我肯定不是第一个遇到这种情况的人吧？我的意思是，nf_hookfn是任何Netfilter模块的入口点;你会认为他们通过更改它而破坏了成千上万的驱动程序。

- Yd Ahhrk

Answer 1

最终我只是创建了一个专门处理此问题的整个模块：

/**
 * The kernel API is far from static. In particular, the Netfilter packet entry
 * function keeps changing. nf_hook.c, the file where we declare our packet
 * entry function, has been quite difficult to read for a while now. It's pretty
 * amusing, because we don't even use any of the noisy arguments.
 *
 * This file declares a usable function header that abstracts away all those
 * useless arguments.
 */

#include <linux/version.h>

/* If this is a Red Hat-based kernel (Red Hat, CentOS, Fedora, etc)... */
#ifdef RHEL_RELEASE_CODE

#if RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(7, 2)
#define NF_CALLBACK(name, skb) unsigned int name( \
        const struct nf_hook_ops *ops, \
        struct sk_buff *skb, \
        const struct net_device *in, \
        const struct net_device *out, \
        const struct nf_hook_state *state) \

#elif RHEL_RELEASE_CODE >= RHEL_RELEASE_VERSION(7, 0)
#define NF_CALLBACK(name, skb) unsigned int name( \
        const struct nf_hook_ops *ops, \
        struct sk_buff *skb, \
        const struct net_device *in, \
        const struct net_device *out, \
        int (*okfn)(struct sk_buff *))

#else

/*
 * Sorry, I don't have headers for RHEL 6 and below because I'm in a bit of a
 * deadline right now.
 * If this is causing you trouble, find `nf_hookfn` in your kernel headers
 * (typically in include/linux/netfilter.h) and add your version of the
 * NF_CALLBACK macro here.
 * Also, kernel headers per version can be found here: http://vault.centos.org/
 */
#error "Sorry; this version of RHEL is not supported because it's kind of old."

#endif /* RHEL_RELEASE_CODE >= x */


/* If this NOT a RedHat-based kernel (Ubuntu, Debian, SuSE, etc)... */
#else

#if LINUX_VERSION_CODE >= KERNEL_VERSION(4, 4, 0)
#define NF_CALLBACK(name, skb) unsigned int name( \
        void *priv, \
        struct sk_buff *skb, \
        const struct nf_hook_state *state)

#elif LINUX_VERSION_CODE >= KERNEL_VERSION(4, 1, 0)
#define NF_CALLBACK(name, skb) unsigned int name( \
        const struct nf_hook_ops *ops, \
        struct sk_buff *skb, \
        const struct nf_hook_state *state)

#elif LINUX_VERSION_CODE >= KERNEL_VERSION(3, 13, 0)
#define NF_CALLBACK(name, skb) unsigned int name( \
        const struct nf_hook_ops *ops, \
        struct sk_buff *skb, \
        const struct net_device *in, \
        const struct net_device *out, \
        int (*okfn)(struct sk_buff *))

#elif LINUX_VERSION_CODE >= KERNEL_VERSION(3, 0, 0)
#define NF_CALLBACK(name, skb) unsigned int name( \
        unsigned int hooknum, \
        struct sk_buff *skb, \
        const struct net_device *in, \
        const struct net_device *out, \
        int (*okfn)(struct sk_buff *))

#else
#error "Linux < 3.0 isn't supported at all."

#endif /* LINUX_VERSION_CODE > n */

#endif /* RHEL or not RHEL */

所以，不要这样写：

static unsigned int function_name((...), struct sk_buff *skb, (...))
{
    return do_something_with_skb(skb);
}

请执行以下操作：

static NF_CALLBACK(function_name, skb)
{
    return do_something_with_skb(skb);
}

- Yd Ahhrk

Answer 2

你可能在使用一个为较新内核版本编译的ko文件。如果该模块未作为RH（Red Hat，红帽公司）发布，则可能需要与供应商合作解决此问题。

- askb

---

我实际上正在尝试编写一个内核模块，并使其与各种内核兼容。嗯...我想我的问题不太清楚。我会编辑一下。 - Yd Ahhrk