struct nf_sockopt_ops

{

struct list_head list;

int pf;

/* Non-inclusive ranges: use 0/0/NULL to never get called. */

int set_optmin;

int set_optmax;

int (*set)(struct sock *sk, int optval, void __user *user, unsigned int len);

int (*compat_set)(struct sock *sk, int optval,void __user *user, unsigned int len);

int get_optmin;

int get_optmax;

int (*get)(struct sock *sk, int optval, void __user *user, int *len);

int (*compat_get)(struct sock *sk, int optval,void __user *user, int *len);

/* Number of users inside set() or get(). */

unsigned int use;

struct task_struct *cleanup_task;

};

typedef struct iptc_handle *iptc_handle_t;

/* Does this chain exist? */

int iptc_is_chain(const char *chain, const iptc_handle_t handle);

/* Take a snapshot of the rules.  Returns NULL on error. */

iptc_handle_t iptc_init(const char *tablename);

/* Cleanup after iptc_init(). */

void iptc_free(iptc_handle_t *h);

/* Iterator functions to run through the chains.  Returns NULL at end. */

const char *iptc_first_chain(iptc_handle_t *handle);

const char *iptc_next_chain(iptc_handle_t *handle);

/* Get first rule in the given chain: NULL for empty chain. */

const struct ipt_entry *iptc_first_rule(const char *chain,iptc_handle_t *handle);

/* Returns NULL when rules run out. */

const struct ipt_entry *iptc_next_rule(const struct ipt_entry *prev,iptc_handle_t *handle);

/* Returns a pointer to the target name of this entry. */

const char *iptc_get_target(const struct ipt_entry *e,iptc_handle_t *handle);

/* Is this a built-in chain? */

int iptc_builtin(const char *chain, const iptc_handle_t handle);

int iptc_append_entry(const ipt_chainlabel chain,

const struct ipt_entry *e,

iptc_handle_t *handle);

/* Zeroes the counters in a chain. */

int iptc_zero_entries(const ipt_chainlabel chain,iptc_handle_t *handle);

/* Creates a new chain. */

int iptc_create_chain(const ipt_chainlabel chain,iptc_handle_t *handle);

/* Makes the actual changes. */

int iptc_commit(iptc_handle_t *handle);

适用于当getsockopt的参数为IPT_SO_GET_INFO，用于从内核读取表信息

struct ipt_getinfo               #define STRUCT_GETINFO struct ipt_getinfo

{

/* Which table: caller fills this in. */    #从内核取出的表信息会存储在该结构体中

char name[IPT_TABLE_MAXNAMELEN];

/* Kernel fills these in. */

unsigned int valid_hooks; /* Which hook entry points are valid: bitmask */

unsigned int hook_entry[NF_IP_NUMHOOKS]; // Hook entry points: one per netfilter hook.

unsigned int underflow[NF_IP_NUMHOOKS]; /* Underflow points. */

unsigned int num_entries; /* Number of entries */

unsigned int size; /* Size of entries. */

};

/* The argument to IPT_SO_GET_ENTRIES. */

struct ipt_get_entries

{

/* Which table: user fills this in. */

char name[IPT_TABLE_MAXNAMELEN];

unsigned int size; /* User fills this in: total entry size. */

struct ipt_entry entrytable[0]; /*内核里表示规则的结构，参见博文三. */

};

if (target && iptc_is_chain(jumpto, *handle)) {

fprintf(stderr,"Warning: using chain %s, not extension\n",jumpto);

if (target->t)

free(target->t);

printf("Target is a chain,but we have gotten a target,then free it!\n");

target = NULL;

}

if (!target  #如果没有指定target。同样，我们的规则也不会执行到这里

&& (strlen(jumpto) == 0|| iptc_is_chain(jumpto, *handle)) #或者target是一条链或为空

)

{

size_t size;

… …

}

size = sizeof(struct ipt_entry);

for (matchp = matches; matchp; matchp = matchp->next)

size += matchp->match->m->u.match_size;

e = fw_malloc(size + target->u.target_size);

*e = *fw;

e->target_offset = size;

e->next_offset = size + target->u.target_size;

size = 0;

for (matchp = matches; matchp; matchp = matchp->next) {

memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size);

size += matchp->match->m->u.match_size;

}

memcpy(e->elems + size, target, target->u.target_size);

struct chain_head

{

struct list_head list;

char name[TABLE_MAXNAMELEN];

unsigned int hooknum;             /* hook number+1 if builtin */

unsigned int references; /* 有多少-j 指定了我们的名字 */

int verdict;                          /* verdict if builtin */

STRUCT_COUNTERS counters;        /* per-chain counters */

struct counter_map counter_map;

unsigned int num_rules;           /* 本链中的规则数*/

struct list_head rules;             /* 本链中所有规则的入口点 */

unsigned int index;           /* index (needed for jump resolval) */

unsigned int head_offset;        /* offset in rule blob */

unsigned int foot_index; /* index (needed for counter_map) */

unsigned int foot_offset;          /* offset in rule blob */

};

struct rule_head

{

struct list_head list;

struct chain_head *chain;

struct counter_map counter_map;

unsigned int index;           /* index (needed for counter_map) */

unsigned int offset;          /* offset in rule blob */

enum iptcc_rule_type type;

struct chain_head *jump;      /* jump target, if IPTCC_R_JUMP */

unsigned int size;              /* size of entry data */

STRUCT_ENTRY entry[0];   #真正的规则入口点 sizeof计算时不会包含这个字段

};

int

TC_APPEND_ENTRY(const IPT_CHAINLABEL chain,

const STRUCT_ENTRY *e,

TC_HANDLE_T *handle)    #注意：这里的handle是个二级指针

{

struct chain_head *c;

struct rule_head *r;

iptc_fn = TC_APPEND_ENTRY;

if (!(c = iptcc_find_label(chain, *handle))) {

#根据链名查找真正的链地址赋给c，此时c就指向了INPUT链的内存，

#包括INPUT中的所有规则和它的policy等

DEBUGP("unable to find chain `%s'\n", chain);

errno = ENOENT;

return 0;

}

if (!(r = iptcc_alloc_rule(c, e->next_offset))) {

#ipt_entry的next_offset即指明了下一条规则的起始地址，同时这个值也说明了本条规则所占了存储空间的大小。这里所申请的空间大小=sizeof(rule_head)+当前规则所占的空间大小。

DEBUGP("unable to allocate rule for chain `%s'\n", chain);

errno = ENOMEM;

return 0;

}

memcpy(r->entry, e, e->next_offset);       #把规则拷贝到柔性数组entry中去

r->counter_map.maptype = COUNTER_MAP_SET;

if (!iptcc_map_target(*handle, r)) {   #主要是设置规则r的target，后面分析。

DEBUGP("unable to map target of rule for chain `%s'\n", chain);

free(r);

return 0;

}

list_add_tail(&r->list, &c->rules); #将新规则r添加在链c的末尾

c->num_rules++;              #同时将链中的规则计数增加

set_changed(*handle);    #因为INPUT链中的规则已经被改变，则handle->changed=1;

return 1;

}

static int

iptcc_map_target(const TC_HANDLE_T handle,

struct rule_head *r)

{

STRUCT_ENTRY *e = r->entry;                 #取规则的起始地址

STRUCT_ENTRY_TARGET *t = GET_TARGET(e);    #取规则的target

/* Maybe it's empty (=> fall through) */

if (strcmp(t->u.user.name, "") == 0) { #如果没有指定target，则将规则类型设为“全放行”

r->type = IPTCC_R_FALLTHROUGH;

return 1;

}

/* Maybe it's a standard target name... */

#因为都是标准target，因此将target中用户空间的user.name都置为空，设置verdict，

#并将rule_head中的type字段为IPTCC_R_STANDARD

else if (strcmp(t->u.user.name, LABEL_ACCEPT) == 0)

return iptcc_standard_map(r, -NF_ACCEPT - 1);

else if (strcmp(t->u.user.name, LABEL_DROP) == 0)

return iptcc_standard_map(r, -NF_DROP - 1);

else if (strcmp(t->u.user.name, LABEL_QUEUE) == 0)

return iptcc_standard_map(r, -NF_QUEUE - 1);

else if (strcmp(t->u.user.name, LABEL_RETURN) == 0)

return iptcc_standard_map(r, RETURN);

else if (TC_BUILTIN(t->u.user.name, handle)) {

/* Can't jump to builtins. */

errno = EINVAL;

return 0;

} else {

/* 如果跳转的目标是一条用户自定义链，则执行下列操作*/

struct chain_head *c;

DEBUGP("trying to find chain `%s': ", t->u.user.name);

c = iptcc_find_label(t->u.user.name, handle); #找到要跳转的目的链的入口地址

if (c) {

DEBUGP_C("found!\n");

r->type = IPTCC_R_JUMP;  #将rule_head结构的type字段置为“跳转”

r->jump = c;             #跳转的目标为t->u.user.name所指示的链

c->references++;         #跳转到的目的链因此而被引用了一次，则计数器++

return 1;

}

DEBUGP_C("not found :(\n");

}

/* 如果不是用户自定义链，它一定一个用户自定义开发的target模块，比如SNAT、LOG等。If not, kernel will reject... */

/* memset to all 0 for your memcmp convenience: don't clear version */

memset(t->u.user.name + strlen(t->u.user.name),

0,

FUNCTION_MAXNAMELEN - 1 - strlen(t->u.user.name));

r->type = IPTCC_R_MODULE;  #比如SNAT，LOG等会执行到这里

set_changed(handle);

return 1;

}

ret = do_command(argc, argv, &table, &handle);

if (ret)

ret = iptc_commit(&handle);

static struct nf_sockopt_ops ipt_sockopts = {

.pf              = PF_INET,

.set_optmin     = IPT_BASE_CTL,

.set_optmax    = IPT_SO_SET_MAX+1,

.set           = do_ipt_set_ctl,

.get_optmin     = IPT_BASE_CTL,

.get_optmax    = IPT_SO_GET_MAX+1,

.get           = do_ipt_get_ctl,

};

static int do_replace(void __user *user, unsigned int len)

{

int ret;

struct ipt_replace tmp;

struct xt_table_info *newinfo;

void *loc_cpu_entry;

if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)

return -EFAULT;

/* Hack: Causes ipchains to give correct error msg --RR */

if (len != sizeof(tmp) + tmp.size)

return -ENOPROTOOPT;

… …

}