static unsigned int
ipt_hook(unsigned int hook,
struct sk_buff *skb,
const struct net_device *in,
const struct net_device *out,
int (*okfn)(struct sk_buff *))
{
struct netns_table_per_dev {
struct list_head list;
struct net_device *dev;
struct xt_table *table;
};
// dev_net(in)->ipv4.iptable_filter不再是一个xt_table，而是一个list
struct wrap_table {
struct list_head *tb_list;
};
struct xt_table *table;
struct netns_table_per_dev *table_dev;
struct list_head *pos;
struct wrap_table *tb_list = (struct wrap_table *)dev_net(in)->ipv4.iptable_filter;
list_for_each(pos, tb_list->tb_list) {
table_dev = list_entry(pos, struct netns_table_per_dev, dev);
if (table_dev->dev == in) {
table = table_dev->table;
}
}
if (table == NULL) {
return NF_ACCEPT;
}
return ipt_do_table(skb, hook, in, out, table);
}一个在协议栈拦截，一个在设备拦截，该手术做的有点大，颠覆了既有的理念，不知道会不会有后遗症。iptables规则绑定在端口而不是拦截在协议栈,布布扣,bubuko.com
原文：http://blog.csdn.net/dog250/article/details/24173103