增加include/net/netfilter/nf_conntrack_ext.h：
/* * (C) 2015 marywangran <marywangran@126.com> * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. */ #ifndef _NF_CONNTRACK_EXT_H #define _NF_CONNTRACK_EXT_H #include <net/net_namespace.h> #include <linux/netfilter/nf_conntrack_common.h> #include <linux/netfilter/nf_conntrack_tuple_common.h> #include <net/netfilter/nf_conntrack.h> #include <net/netfilter/nf_conntrack_extend.h> #define MAX_EXT_SLOTS 8 #define BITINT 1 struct nf_conntrack_ext { /* 必须有一个数组用于自省或者反射 */ int bits_idx[MAX_EXT_SLOTS]; int bits[BITINT]; char *slot[MAX_EXT_SLOTS]; }; int nf_ct_exts_add(const struct nf_conn *ct, void *ext); void *nf_ct_exts_get(const struct nf_conn *ct, int idx); void nf_ct_exts_remove(const struct nf_conn *ct, int idx); struct nf_conntrack_ext *nf_conn_exts_find(const struct nf_conn *ct); struct nf_conntrack_ext *nf_conn_exts_add(struct nf_conn *ct, gfp_t gfp); extern int nf_conntrack_exts_init(); extern void nf_conntrack_exts_fini(); #endif /* _NF_CONNTRACK_EXT_H */修改net/netfilter/nf_conntrack_core.c：
--- nf_conntrack_core.c.orig 2014-03-29 13:00:17.000000000 +0800 +++ nf_conntrack_core.c 2015-01-15 17:01:28.000000000 +0800 @@ -42,6 +42,10 @@ #include <net/netfilter/nf_conntrack_extend.h> #include <net/netfilter/nf_conntrack_acct.h> #include <net/netfilter/nf_conntrack_ecache.h> +#ifdef NFCT_EXT_EXT +/* 引入extend的extend头文件 */ +#include <net/netfilter/nf_conntrack_ext.h> +#endif #include <net/netfilter/nf_nat.h> #include <net/netfilter/nf_nat_core.h> @@ -644,8 +648,11 @@ } nf_ct_acct_ext_add(ct, GFP_ATOMIC); - nf_ct_ecache_ext_add(ct, GFP_ATOMIC); +#ifdef NFCT_EXT_EXT + /* 在创建conntrack的时候初始化extend的extend */ + nf_conn_exts_add(ct, GFP_ATOMIC); +#endif spin_lock_bh(&nf_conntrack_lock); exp = nf_ct_find_expectation(net, tuple); @@ -1130,6 +1137,10 @@ nf_ct_free_hashtable(net->ct.hash, net->ct.hash_vmalloc, net->ct.htable_size); +#ifdef NFCT_EXT_EXT + /* 析构extend的extend */ + nf_conntrack_exts_fini(); +#endif nf_conntrack_ecache_fini(net); nf_conntrack_acct_fini(net); nf_conntrack_expect_fini(net); @@ -1344,9 +1355,19 @@ ret = nf_conntrack_ecache_init(net); if (ret < 0) goto err_ecache; +#ifdef NFCT_EXT_EXT + /* 注册extend的extend */ + ret = nf_conntrack_exts_init(); + if (ret < 0) + goto err_exts; +#endif return 0; +#ifdef NFCT_EXT_EXT +err_exts: + nf_conntrack_ecache_fini(net); +#endif err_ecache: nf_conntrack_acct_fini(net); err_acct: