iptables 分析(二)

原文：http://blog.chinaunix.net/uid-24207747-id-2622901.html

do_command()函数分析

//负责整个用户输入的命令处理

int do_command(int argc, char *argv[], char **table, iptc_handle_t *handle)
{
//初始化变量

struct ipt_entry fw, *e = NULL;
    int invert = 0;
    unsigned int nsaddrs = 0, ndaddrs = 0;
    struct in_addr *saddrs = NULL, *daddrs = NULL;

int c, verbose = 0;
    const char *chain = NULL;
    const char *shostnetworkmask = NULL, *dhostnetworkmask = NULL;
    const char *policy = NULL, *newname = NULL;
    unsigned int rulenum = 0, options = 0, command = 0;
    const char *pcnt = NULL, *bcnt = NULL;
    int ret = 1;
    struct xtables_match *m;//扩展匹配操作函数指针

struct iptables_rule_match *matches = NULL;
    struct iptables_rule_match *matchp;
    struct xtables_target *target = NULL;
    struct xtables_target *t;//扩展目标操作函数指针

const char *jumpto = "";
    char *protocol = NULL;
    int proto_used = 0;
    unsigned long long cnt;

memset(&fw, 0, sizeof(fw));
/*extern char *optarg; //选项的参数指针
  extern int optind;     //下一次调用getopt时,从optind存储的位置处重新开始检查选择项.
   extern int opterr;      //当为0时,不向stderr输出错误信息.
*/
    optind = 0;

/* 清除标识mflags，以免do_command 被第二次调用，为了安全，清除了所有匹
配的链表*/
    for (m = xtables_matches; m; m = m->next)
        m->mflags = 0;

for (t = xtables_targets; t; t = t->next) {
        t->tflags = 0;
        t->used = 0;
    }

/* Suppress error messages: we may add new options if we
           demand-load a protocol. */
    opterr = 0; //禁止错误信息显示

//分析命令行选项,返回短选项字母，错误返回-1

while ((c = getopt_long(argc, argv,
     "-A:D:R:I:L::S::M:F::Z::N:X::E:P:Vh::o:p:s:d:j:i:fbvnt:m:xc:g:", //例ho:v::a，表示有效选项是-h,-o与-v并且第二个参数-o后面需要一个参数,v后接参数不能空格.

opts, NULL)) != -1) {
        switch (c) {
            
        case 'A'://追加一条规则到规则链，如：iptables -A INPUT -j ACCEPT

add_command(&command, CMD_APPEND, CMD_NONE,
                 invert); //该函数用来添加命令宏

chain = optarg; //得到-A 后参数（链名）

break;

case 'D': //删除规则链中某条规则

add_command(&command, CMD_DELETE, CMD_NONE,
                 invert);
            chain = optarg;
            if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!') {
                rulenum = parse_rulenumber(argv[optind++]); //把数字字符串转为数字

command = CMD_DELETE_NUM;
            }
            break;

case 'R':
            add_command(&command, CMD_REPLACE, CMD_NONE,
                 invert);
            chain = optarg;
            if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                rulenum = parse_rulenumber(argv[optind++]);
            else
                exit_error(PARAMETER_PROBLEM,
                     "-%c requires a rule number",
                     cmd2char(CMD_REPLACE));
            break;

case 'I':
            add_command(&command, CMD_INSERT, CMD_NONE,
                 invert);
            chain = optarg;
            if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                rulenum = parse_rulenumber(argv[optind++]);
            else rulenum = 1;
            break;

case 'L':
            add_command(&command, CMD_LIST, CMD_ZERO,
                 invert);
            if (optarg) chain = optarg;
            else if (optind < argc && argv[optind][0] != '-'
                 && argv[optind][0] != '!')
                chain = argv[optind++];
            if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                rulenum = parse_rulenumber(argv[optind++]);
            break;

case 'S':
            add_command(&command, CMD_LIST_RULES, CMD_ZERO,
                 invert);
            if (optarg) chain = optarg;
            else if (optind < argc && argv[optind][0] != '-'
                 && argv[optind][0] != '!')
                chain = argv[optind++];
            if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                rulenum = parse_rulenumber(argv[optind++]);
            break;

case 'F':
            add_command(&command, CMD_FLUSH, CMD_NONE,
                 invert);
            if (optarg) chain = optarg;
            else if (optind < argc && argv[optind][0] != '-'
                 && argv[optind][0] != '!')
                chain = argv[optind++];
            break;

case 'Z':
            add_command(&command, CMD_ZERO, CMD_LIST|CMD_LIST_RULES,
                 invert);
            if (optarg) chain = optarg;
            else if (optind < argc && argv[optind][0] != '-'
                && argv[optind][0] != '!')
                chain = argv[optind++];
            break;

case 'N':
            if (optarg && (*optarg == '-' || *optarg == '!'))
                exit_error(PARAMETER_PROBLEM,
                     "chain name not allowed to start "
                     "with `%c'\n", *optarg);
            if (find_target(optarg, TRY_LOAD))
                exit_error(PARAMETER_PROBLEM,
                     "chain name may not clash "
                     "with target name\n");
            add_command(&command, CMD_NEW_CHAIN, CMD_NONE,
                 invert);
            chain = optarg;
            break;

case 'X':
            add_command(&command, CMD_DELETE_CHAIN, CMD_NONE,
                 invert);
            if (optarg) chain = optarg;
            else if (optind < argc && argv[optind][0] != '-'
                 && argv[optind][0] != '!')
                chain = argv[optind++];
            break;

case 'E':
            add_command(&command, CMD_RENAME_CHAIN, CMD_NONE,
                 invert);
            chain = optarg;
            if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                newname = argv[optind++];
            else
                exit_error(PARAMETER_PROBLEM,
                     "-%c requires old-chain-name and "
                     "new-chain-name",
                     cmd2char(CMD_RENAME_CHAIN));
            break;

case 'P': //为规则链(INPUT、OUTPUT 和FORWARD)定义一默认策略

add_command(&command, CMD_SET_POLICY, CMD_NONE,
                 invert);
            chain = optarg; //链名

if (optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                policy = argv[optind++];//得到策略,如iptables -P INPUT ACCEPT

else
                exit_error(PARAMETER_PROBLEM,
                     "-%c requires a chain and a policy",
                     cmd2char(CMD_SET_POLICY));
            break;

case 'h':
            if (!optarg)
                optarg = argv[optind];

/* iptables -p icmp -h */
            if (!matches && protocol)
                find_match(protocol, TRY_LOAD, &matches);

exit_printhelp(matches);

case 'p':
            check_inverse(optarg, &invert, &optind, argc);
            set_option(&options, OPT_PROTOCOL, &fw.ip.invflags,
                 invert);

/* Canonicalize into lower case */
            for (protocol = argv[optind-1]; *protocol; protocol++)
                *protocol = tolower(*protocol);

protocol = argv[optind-1];
            fw.ip.proto = parse_protocol(protocol);

if (fw.ip.proto == 0
             && (fw.ip.invflags & IPT_INV_PROTO))
                exit_error(PARAMETER_PROBLEM,
                     "rule would never match protocol");
            break;

case 's':
            check_inverse(optarg, &invert, &optind, argc);
            set_option(&options, OPT_SOURCE, &fw.ip.invflags,
                 invert);
            shostnetworkmask = argv[optind-1];
            break;

case 'd':
            check_inverse(optarg, &invert, &optind, argc);
            set_option(&options, OPT_DESTINATION, &fw.ip.invflags,
                 invert);
            dhostnetworkmask = argv[optind-1];
            break;

#ifdef IPT_F_GOTO
        case 'g':
            set_option(&options, OPT_JUMP, &fw.ip.invflags,
                 invert);
            fw.ip.flags |= IPT_F_GOTO;
            jumpto = parse_target(optarg);
            break;
#endif

case 'j': // -j ACCEPT

//将j 选项对应的宏定义位OPT_JUMP 加到options 上，invert 表示非逻辑操作

set_option(&options, OPT_JUMP, &fw.ip.invflags,
                 invert);
            jumpto = parse_target(optarg); //解析目标名是否正确

target = find_target(jumpto, TRY_LOAD); //正确，从全局的目标链表xptables_targets 中查找这个目标,设置尝试加载目标标识

if (target) { //成功找到

size_t size;

size = IPT_ALIGN(sizeof(struct ipt_entry_target))
                    + target->size;

target->t = fw_calloc(1, size);
                target->t->u.target_size = size;
                strcpy(target->t->u.user.name, jumpto); //保存目标名到xptables_targets

set_revision(target->t->u.user.name,
                     target->revision); //设置版本

if (target->init != NULL)
                    target->init(target->t); //初始化xptables_targets

opts = merge_options(opts,
                         target->extra_opts,
                         &target->option_offset);//将target 的参数选项与旧的参数选项连接在一起由opts 返回，这样下一个循环可以分析target 的参数选项，一般在“default:”中进行分析

if (opts == NULL)
                    exit_error(OTHER_PROBLEM,
                         "can't alloc memory!");
            }
            break;

case 'i':
            check_inverse(optarg, &invert, &optind, argc);
            set_option(&options, OPT_VIANAMEIN, &fw.ip.invflags,
                 invert);
            parse_interface(argv[optind-1],
                    fw.ip.iniface,
                    fw.ip.iniface_mask);
            break;

case 'o':
            check_inverse(optarg, &invert, &optind, argc);
            set_option(&options, OPT_VIANAMEOUT, &fw.ip.invflags,
                 invert);
            parse_interface(argv[optind-1],
                    fw.ip.outiface,
                    fw.ip.outiface_mask);
            break;

case 'f':
            set_option(&options, OPT_FRAGMENT, &fw.ip.invflags,
                 invert);
            fw.ip.flags |= IPT_F_FRAG;
            break;

case 'v':
            if (!verbose)
                set_option(&options, OPT_VERBOSE,
                     &fw.ip.invflags, invert);
            verbose++;
            break;

case 'm': {//可扩展选项s

size_t size;

if (invert)
                exit_error(PARAMETER_PROBLEM,
                     "unexpected ! flag before --match");

m = find_match(optarg, LOAD_MUST_SUCCEED, &matches);//从全局链表xptables_match 中查找匹配模块

size = IPT_ALIGN(sizeof(struct ipt_entry_match))
                     + m->size;
            m->m = fw_calloc(1, size);
            m->m->u.match_size = size;
            strcpy(m->m->u.user.name, m->name);
            set_revision(m->m->u.user.name, m->revision);
            if (m->init != NULL)
                m->init(m->m); //初始化

if (m != m->next) {
                /* Merge options for non-cloned matches */
                opts = merge_options(opts,
                         m->extra_opts,
                         &m->option_offset);//将扩展匹配的选项加入到全局选项表opts，下一个循环就可以解析它的选项了

if (opts == NULL)
                    exit_error(OTHER_PROBLEM,
                         "can't alloc memory!");
            }
        }
        break;

case 'n':
            set_option(&options, OPT_NUMERIC, &fw.ip.invflags,
                 invert);
            break;

case 't':
            if (invert)
                exit_error(PARAMETER_PROBLEM,
                     "unexpected ! flag before --table");
            *table = argv[optind-1]; //取t 后面的表名

break;

case 'x':
            set_option(&options, OPT_EXPANDED, &fw.ip.invflags,
                 invert);
            break;

case 'V':
            if (invert)
                printf("Not %s ;-)\n", program_version);
            else
                printf("%s v%s\n",
                 program_name, program_version);
            exit(0);

case '0':
            set_option(&options, OPT_LINENUMBERS, &fw.ip.invflags,
                 invert);
            break;

case 'M':
            modprobe_program = optarg;
            break;

case 'c':

set_option(&options, OPT_COUNTERS, &fw.ip.invflags,
                 invert);
            pcnt = optarg;
            bcnt = strchr(pcnt + 1, ',');
            if (bcnt)
             bcnt++;
            if (!bcnt && optind < argc && argv[optind][0] != '-'
             && argv[optind][0] != '!')
                bcnt = argv[optind++];
            if (!bcnt)
                exit_error(PARAMETER_PROBLEM,
                    "-%c requires packet and byte counter",
                    opt2char(OPT_COUNTERS));

if (sscanf(pcnt, "%llu", &cnt) != 1)
                exit_error(PARAMETER_PROBLEM,
                    "-%c packet counter not numeric",
                    opt2char(OPT_COUNTERS));
            fw.counters.pcnt = cnt;

if (sscanf(bcnt, "%llu", &cnt) != 1)
                exit_error(PARAMETER_PROBLEM,
                    "-%c byte counter not numeric",
                    opt2char(OPT_COUNTERS));
            fw.counters.bcnt = cnt;
            break;

case 1: /* non option */
            if (optarg[0] == '!' && optarg[1] == '\0') {
                if (invert)
                    exit_error(PARAMETER_PROBLEM,
                         "multiple consecutive ! not"
                         " allowed");
                invert = TRUE;
                optarg[0] = '\0';
                continue;
            }
            fprintf(stderr, "Bad argument `%s'\n", optarg);
            exit_tryhelp(2);

default://分析扩展目标和扩展匹配的选项

if (!target
             || !(target->parse(c - target->option_offset, //调用扩展目标的选项分析函数

argv, invert,
                     &target->tflags,
                     &fw, &target->t))) {
                for (matchp = matches; matchp; matchp = matchp->next) {
                    if (matchp->completed)
                        continue;
                    if (matchp->match->parse(c - matchp->match->option_offset,
                         argv, invert,
                         &matchp->match->mflags,
                         &fw,
                         &matchp->match->m))
                        break;
                }
                m = matchp ? matchp->match : NULL;

if (m == NULL //如果匹配不存在，通过协议查找扩展匹配，由扩展匹配分析选项

&& protocol
                 && (!find_proto(protocol, DONT_LOAD,
                         options&OPT_NUMERIC, NULL)
                    || (find_proto(protocol, DONT_LOAD,
                            options&OPT_NUMERIC, NULL)
                     && (proto_used == 0))
                 )
                 && (m = find_proto(protocol, TRY_LOAD,
                         options&OPT_NUMERIC, &matches))){ //匹配成功

/* Try loading protocol */
                    size_t size;

proto_used = 1;

size = IPT_ALIGN(sizeof(structipt_entry_match))
                             + m->size;

m->m = fw_calloc(1, size);
                    m->m->u.match_size = size;
                    strcpy(m->m->u.user.name, m->name);
                    set_revision(m->m->u.user.name,
                         m->revision);
                    if (m->init != NULL)
                        m->init(m->m);

opts = merge_options(opts,
                             m->extra_opts,
                             &m->option_offset);
                    if (opts == NULL)
                        exit_error(OTHER_PROBLEM,
                            "can't alloc memory!");

optind--;
                    continue;
                }
                if (!m)
                    exit_error(PARAMETER_PROBLEM,
                         "Unknown arg `%s'",
                         argv[optind-1]);
            }
        }
        invert = FALSE;
    }

//final_check成员函数的作用是作最终的标志检查，如果检测失则，则退出

for (matchp = matches; matchp; matchp = matchp->next)
        if (matchp->match->final_check != NULL)//使用扩展匹配的函数检查标识

matchp->match->final_check(matchp->match->mflags);

if (target != NULL && target->final_check != NULL)
        target->final_check(target->tflags);

/* Fix me: must put inverse options checking here --MN
    接着对参数作一些必要的合法性检查 */
    if (optind < argc)
        exit_error(PARAMETER_PROBLEM,
             "unknown arguments found on commandline");
    if (!command)
        exit_error(PARAMETER_PROBLEM, "no command specified");
    if (invert)
        exit_error(PARAMETER_PROBLEM,
             "nothing appropriate following !");
    
//如果没有设置来源/目的地址及掩码，则给予它们一个默认值

if (command & (CMD_REPLACE | CMD_INSERT | CMD_DELETE | CMD_APPEND)) {
        if (!(options & OPT_DESTINATION)) //目的

dhostnetworkmask = "0.0.0.0/0";
        if (!(options & OPT_SOURCE))      //源

shostnetworkmask = "0.0.0.0/0";
    }

/*对来源/目的地址及掩码进行拆分，它们总是以 addr/mask的形式来出现的，根据’/’前面的字符串取得地址值，根据’/’后面的掩码位数，求得正确的掩码值，值得注意的是，同时要处理主机地址和网络地址的情况*/
    if (shostnetworkmask)
        ipparse_hostnetworkmask(shostnetworkmask, &saddrs,
                    &fw.ip.smsk, &nsaddrs);

if (dhostnetworkmask)
        ipparse_hostnetworkmask(dhostnetworkmask, &daddrs,
                    &fw.ip.dmsk, &ndaddrs);

/*然后检查来源/目的网络地址的合法性*/
    if ((nsaddrs > 1 || ndaddrs > 1) &&
     (fw.ip.invflags & (IPT_INV_SRCIP | IPT_INV_DSTIP)))
        exit_error(PARAMETER_PROBLEM, "! not allowed with multiple"
             " source or destination IP addresses");

if (command == CMD_REPLACE && (nsaddrs != 1 || ndaddrs != 1))
        exit_error(PARAMETER_PROBLEM, "Replacement rule does not "
             "specify a unique address");

generic_opt_check(command, options); //检查命令选项有效

if (chain && strlen(chain) > IPT_FUNCTION_MAXNAMELEN)
        exit_error(PARAMETER_PROBLEM,
             "chain name `%s' too long (must be under %i chars)",
             chain, IPT_FUNCTION_MAXNAMELEN);

/*handle，是一个指向了具体表，如filter、nat表的句柄，这里判断，如果handle为空，则调用iptc_init，根据table的名称，让handle指针指向相应的表的地址空间，也就是把对应表的所有信息从内核中取出来*/
    if (!*handle)
        *handle = iptc_init(*table); //调用 iptc_init获取表的规则信息，调用list_entries函数显示规则

/* try to insmod the module if iptc_init failed */
    if (!*handle && load_xtables_ko(modprobe_program, 0) != -1)
        *handle = iptc_init(*table);

if (!*handle)
        exit_error(VERSION_PROBLEM,
             "can't initialize iptables table `%s': %s",
             *table, iptc_strerror(errno));

if (command == CMD_APPEND
     || command == CMD_DELETE
     || command == CMD_INSERT
     || command == CMD_REPLACE) {
        if (strcmp(chain, "PREROUTING") == 0
         || strcmp(chain, "INPUT") == 0) {
            /* -o not valid with incoming packets. */
            if (options & OPT_VIANAMEOUT)
                exit_error(PARAMETER_PROBLEM,
                     "Can't use -%c with %s\n",
                     opt2char(OPT_VIANAMEOUT),
                     chain);
        }

if (strcmp(chain, "POSTROUTING") == 0
         || strcmp(chain, "OUTPUT") == 0) {
            /* -i not valid with outgoing packets */
            if (options & OPT_VIANAMEIN)
                exit_error(PARAMETER_PROBLEM,
                     "Can't use -%c with %s\n",
                     opt2char(OPT_VIANAMEIN),
                     chain);
        }

if (target && iptc_is_chain(jumpto, *handle)) { //jumpto链名

fprintf(stderr,
                "Warning: using chain %s, not extension\n",
                jumpto);

if (target->t)
                free(target->t);

target = NULL;
        }
        if (!target
         && (strlen(jumpto) == 0
            || iptc_is_chain(jumpto, *handle))) { //如果没有指定目标或没有指定链名，使用标准的

size_t size;

target = find_target(IPT_STANDARD_TARGET,
                     LOAD_MUST_SUCCEED); //找到加载内核

size = sizeof(struct ipt_entry_target)
                + target->size;
            target->t = fw_calloc(1, size);
            target->t->u.target_size = size;
            strcpy(target->t->u.user.name, jumpto);
            if (!iptc_is_chain(jumpto, *handle))
                set_revision(target->t->u.user.name,
                     target->revision);
            if (target->init != NULL)
                target->init(target->t);
        }

if (!target) {//扩展目标不存在

#ifdef IPT_F_GOTO
            if (fw.ip.flags & IPT_F_GOTO)
                exit_error(PARAMETER_PROBLEM,
                     "goto '%s' is not a chain\n", jumpto);
#endif
            find_target(jumpto, LOAD_MUST_SUCCEED);
        } else {//将扩展目标加入到规则条目中

e = generate_entry(&fw, matches, target->t);
            free(target->t);
        }
    }

/* 根据命令标志，增加、显示规则*/
    switch (command) {
    case CMD_APPEND:
        ret = append_entry(chain, e,
                 nsaddrs, saddrs, ndaddrs, daddrs,
                 options&OPT_VERBOSE,
                 handle);
        break;
    case CMD_DELETE:
        ret = delete_entry(chain, e,
                 nsaddrs, saddrs, ndaddrs, daddrs,
                 options&OPT_VERBOSE,
                 handle, matches);
        break;
    case CMD_DELETE_NUM:
        ret = iptc_delete_num_entry(chain, rulenum - 1, handle);
        break;
    case CMD_REPLACE:
        ret = replace_entry(chain, e, rulenum - 1,
                 saddrs, daddrs, options&OPT_VERBOSE,
                 handle);
        break;
    case CMD_INSERT:
        ret = insert_entry(chain, e, rulenum - 1,
                 nsaddrs, saddrs, ndaddrs, daddrs,
                 options&OPT_VERBOSE,
                 handle);
        break;
    case CMD_FLUSH:
        ret = flush_entries(chain, options&OPT_VERBOSE, handle);
        break;
    case CMD_ZERO:
        ret = zero_entries(chain, options&OPT_VERBOSE, handle);
        break;
    case CMD_LIST:
    case CMD_LIST|CMD_ZERO:
//list_entries是规则显示的主要处理函数

ret = list_entries(chain,
                 rulenum,
                 options&OPT_VERBOSE,
                 options&OPT_NUMERIC,
                 options&OPT_EXPANDED,
                 options&OPT_LINENUMBERS,
                 handle);
        if (ret && (command & CMD_ZERO))
            ret = zero_entries(chain,
                     options&OPT_VERBOSE, handle);
        break;
    case CMD_LIST_RULES:
    case CMD_LIST_RULES|CMD_ZERO:
        ret = list_rules(chain,
                 rulenum,
                 options&OPT_VERBOSE,
                 handle);
        if (ret && (command & CMD_ZERO))
            ret = zero_entries(chain,
                     options&OPT_VERBOSE, handle);
        break;
    case CMD_NEW_CHAIN:
        ret = iptc_create_chain(chain, handle);
        break;
    case CMD_DELETE_CHAIN:
        ret = delete_chain(chain, options&OPT_VERBOSE, handle);
        break;
    case CMD_RENAME_CHAIN:
        ret = iptc_rename_chain(chain, newname,    handle);
        break;
    case CMD_SET_POLICY:
        ret = iptc_set_policy(chain, policy, options&OPT_COUNTERS ?&fw.counters : NULL, handle);
        break;
    default:
        /* We should never reach this... */
        exit_tryhelp(2);
    }

if (verbose > 1)
        dump_entries(*handle);

clear_rule_matches(&matches);

if (e != NULL) {
        free(e);
        e = NULL;
    }

free(saddrs);
    free(daddrs);
    free_opts(1);

return ret;
}