- unsigned int nf_iterate(struct list_head *head,
-
struct sk_buff *skb,
-
unsigned int hook,
-
const struct net_device *indev,
-
const struct net_device *outdev,
-
struct list_head **i,
-
int (*okfn)(struct sk_buff *),
-
int hook_thresh)
-
{
-
unsigned int verdict;
-
-
/*
-
* The caller must not block between calls to this
-
* function because of risk of continuing from deleted element.
-
*/
-
list_for_each_continue_rcu(*i, head) {
-
struct nf_hook_ops *elem = (struct nf_hook_ops *)*i;
/*
规则的优先级判断,目前从NF_HOOK到这里的优先级为INT_MIN,即最小。这种情况下,所以的规则都会被检 查。
这个hook_thresh用于保证某些规则在某些挂载点不起作用。
搜索NF_HOOK_THRESH关键字,可以发现对于协议NFPROTO_BRIDGE的挂载点NF_BR_PRE_ROUTING,其thr eash被设为1,这样保证仅部分规则起作用。
*/
-
if (hook_thresh > elem->priority)
-
continue;
-
-
/* Optimization: we don't need to hold module
-
reference here, since function can't sleep. --RR */
-
verdict = elem->hook(hook, skb, indev, outdev, okfn);
-
if (verdict != NF_ACCEPT) {
- /* 不等于ACCEPT,就可能直接返回判定结果 */
-
#ifdef CONFIG_NETFILTER_DEBUG
-
if (unlikely((verdict & NF_VERDICT_MASK)
-
> NF_MAX_VERDICT)) {
-
NFDEBUG("Evil return from %p(%u).\n",
-
elem->hook, hook);
-
continue;
-
}
-
#endif
- /* 还需要不能等于NF_REPEAT。也就是说既不能等于NF_ACCEPT和NF_REPEAT,即可直接返回判定结
- 果,无需后面的判定 */
-
if (verdict != NF_REPEAT)
-
return verdict;
/* 判定结果为NF_REPEAT,则重复这个规则的判定 */
-
*i = (*i)->prev;
-
}
-
}
/* 所有判定结果都为NF_ACCEPT,才可返回NF_ACCEPT */
-
return NF_ACCEPT;
-
}