/*

每个struct xt_match代表一个扩展match，netfilter中各个扩展match自己定义自己的匹配参数数据结构，自己实现匹配函数

*/

struct xt_match {

    struct list_head list;

//match名字，和iptables配置的-m参数相同

    const char name[XT_EXTENSION_MAXNAMELEN];

    u_int8_t revision;

    /* Return true or false: return FALSE and set *hotdrop = 1 to

           force immediate packet drop. */

    /* Arguments changed since 2.6.9, as this must now handle

       non-linear skb, using skb_header_pointer and

       skb_ip_make_writable. *///规则匹配函数

    bool (*match)(const struct sk_buff *skb,

              struct xt_action_param *);

    /* Called when user tries to insert an entry of this type. */

    int (*checkentry)(const struct xt_mtchk_param *);/* 匹配函数入参检查函数 */

    /* Called when entry of this type deleted. */

    void (*destroy)(const struct xt_mtdtor_param *);

#ifdef CONFIG_COMPAT

    /* Called when userspace align differs from kernel space one */

    void (*compat_from_user)(void *dst, const void *src);

    int (*compat_to_user)(void __user *dst, const void *src);

#endif

    /* Set this to THIS_MODULE if you are a module, otherwise NULL */

    struct module *me;

    const char *table;

    unsigned int matchsize;//match的自定义数据长度

#ifdef CONFIG_COMPAT

    unsigned int compatsize;

#endif

    unsigned int hooks;

    unsigned short proto;

    unsigned short family;

};

int xt_register_match(struct xt_match *match)

{

    u_int8_t af = match->family;

    mutex_lock(&xt[af].mutex);

//加入Netfilter管理的全局Match链表上

    list_add(&match->list, &xt[af].match);

    mutex_unlock(&xt[af].mutex);

    return 0;

}

struct xt_standard_target {

    struct xt_entry_target target;

/*verdict 可以是指定返回值，也可以是goto到下一个rule的偏移量，

也可以是queue的队列号。

*/

    int verdict;

};

/*

 如果struct xt_entry->target 值为空，表示是标准target，根据verdict值来处理报文。

如果struct xt_entry->target不为空，表示不是标准target，就使用target的target函数返回值来处理报文

*/