CODE:

/* Returns 1 if okfn() needs to be executed by the caller,
* -EPERM for NF_DROP, 0 otherwise. */
int nf_hook_slow(int pf, unsigned int hook, struct sk_buff **pskb,
    struct net_device *indev,
    struct net_device *outdev,
    int (*okfn)(struct sk_buff *),
    int hook_thresh)
{
struct list_head *elem;
unsigned int verdict;
int ret = 0;

/* We may already have this, but read-locks nest anyway */
rcu_read_lock();

#ifdef CONFIG_NETFILTER_DEBUG
if (unlikely((*pskb)->nf_debug & (1 << hook))) {
printk("nf_hook: hook %i already set.\n", hook);
nf_dump_skb(pf, *pskb);
}
(*pskb)->nf_debug |= (1 << hook);
#endif
/*取得对应的链表首部*/
elem = &nf_hooks[pf][hook];
next_hook:
/*调用对应的钩子函数*/
verdict = nf_iterate(&nf_hooks[pf][hook], pskb, hook, indev,
      outdev, &elem, okfn, hook_thresh);
/*判断返回值，做相应的处理*/
if (verdict == NF_ACCEPT || verdict == NF_STOP) {
ret = 1; /*前面提到过，返回1，则表示装继续调用okfn函数指针*/
goto unlock;
} else if (verdict == NF_DROP) {
kfree_skb(*pskb); /*删除数据包，需要释放skb*/
ret = -EPERM;
} else if (verdict == NF_QUEUE) {
NFDEBUG("nf_hook: Verdict = QUEUE.\n");
if (!nf_queue(*pskb, elem, pf, hook, indev, outdev, okfn))
goto next_hook;
}
unlock:
rcu_read_unlock();
return ret;
}

CODE:

static unsigned int nf_iterate(struct list_head *head,
          struct sk_buff **skb,
          int hook,
          const struct net_device *indev,
          const struct net_device *outdev,
          struct list_head **i,
          int (*okfn)(struct sk_buff *),
          int hook_thresh)
{
unsigned int verdict;

/*
    * The caller must not block between calls to this
    * function because of risk of continuing from deleted element.
    */
list_for_each_continue_rcu(*i, head) { /*遍历所有注册的Hook*/
/*取得当前遍历的Hook*/
struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;

if (hook_thresh > elem->priority)
continue;

/* Optimization: we don't need to hold module
               reference here, since function can't sleep. --RR */
/*调用Hook 的函数*/
` verdict = elem->hook(hook, skb, indev, outdev, okfn);
if (verdict != NF_ACCEPT) {
#ifdef CONFIG_NETFILTER_DEBUG
if (unlikely(verdict > NF_MAX_VERDICT)) {
NFDEBUG("Evil return from %p(%u).\n",
         elem->hook, hook);
continue;
}
#endif
if (verdict != NF_REPEAT)
return verdict;
*i = (*i)->prev;
}
}
return NF_ACCEPT;
}

CODE:

/* Responses from hook functions. */
#define NF_DROP 0     丢弃该数据包
#define NF_ACCEPT 1     保留该数据包
#define NF_STOLEN 2     记掉该数据包
#define NF_QUEUE 3     将该数据包插入到用户空间
#define NF_REPEAT 4              再次调用该Hook函数
#define NF_STOP 5     停止检测，不再进行下一个Hook函数

CODE:

if (verdict != NF_ACCEPT)
{
if (verdict != NF_REPEAT)
return verdict;
*i = (*i)->prev;
}