关于iptables的的工作原理，主要分为三个方面：用户程序对规则的处理，内核对用户命令的处理，内核中netfilter对数据包的过滤(Ref:netfilter分析3-钩子函数执行流程)。
 本文大致分析iptables用户态程序如何解析规则，并将规则配置到内核中。以如下命令为例：

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

 主要分析第一句：

iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

用户空间

 代码版本：iptables-1.8.7。
 iptables的客户端和内核共享一些数据结构。例如：
ipt_entry 、xt_entry_match、xt_tcp。

struct ipt_entry {
    struct ipt_ip ip;
    /* Mark with fields that we care about. */
    unsigned int nfcache;
    /* Size of ipt_entry + matches */
    __u16 target_offset;
    /* Size of ipt_entry + matches + target */
    __u16 next_offset;
    /* Back pointer */
    unsigned int comefrom;
    /* Packet and byte counters. */
    struct xt_counters counters;
    /* The matches (if any), then the target. */
    unsigned char elems[0];
};
struct xt_entry_match {
    union {
        struct {
            __u16 match_size;
            /* Used by userspace */
            char name[XT_EXTENSION_MAXNAMELEN];
            __u8 revision;
        } user;
        struct {
            __u16 match_size;
            /* Used inside the kernel */
            struct xt_match *match;
        } kernel;
        /* Total length */
        __u16 match_size;
    } u;
    unsigned char data[0];
};
struct xt_tcp {
    __u16 spts[2];          /* Source port range. */
    __u16 dpts[2];          /* Destination port range. */
    __u8 option;            /* TCP Option iff non-zero*/
    __u8 flg_mask;          /* TCP flags mask byte */
    __u8 flg_cmp;           /* TCP flags compare byte */
    __u8 invflags;          /* Inverse flags */
};

 主函数为iptables_main(iptables-standalone.c)。

int
iptables_main(int argc, char *argv[])
{
    char *table = "filter";
    struct xtc_handle *handle = NULL;
    ret = do_command4(argc, argv, &table, &handle, false);
    if (ret) {
        ret = iptc_commit(handle);
        iptc_free(handle);
    }
}

 -A INPUT的解析代码：

int do_command4(int argc, char *argv[], char **table,
        struct xtc_handle **handle, bool restore)
{
        case 'A':
            add_command(&command, CMD_APPEND, CMD_NONE,
                    cs.invert);
            chain = optarg;
            break;
}

 -i eth0的解析代码：

int do_command4(int argc, char *argv[], char **table,
        struct xtc_handle **handle, bool restore)
{
        case 'i':
            if (*optarg == '\0')
                xtables_error(PARAMETER_PROBLEM,
                    "Empty interface is likely to be "
                    "undesired");
            set_option(&cs.options, OPT_VIANAMEIN, &cs.fw.ip.invflags,
                   cs.invert);
            xtables_parse_interface(optarg,
                    cs.fw.ip.iniface,
                    cs.fw.ip.iniface_mask);
            break;
}

 -p tcp -s 192.168.100.0/24 --dport 22
 ip段(192.168.100.0/24)的解析：

int do_command4(int argc, char *argv[], char **table,
        struct xtc_handle **handle, bool restore)
{
    if (shostnetworkmask)
        xtables_ipparse_multiple(shostnetworkmask, &saddrs,
                     &smasks, &nsaddrs);

    if (dhostnetworkmask)
        xtables_ipparse_multiple(dhostnetworkmask, &daddrs,
                     &dmasks, &ndaddrs);
}

 --dport 22的参数解析，需要tcp_match模块，命令中已经指定了协议(-p tcp)。

static struct xtables_match tcp_match = {
    .family     = NFPROTO_UNSPEC,
    .name       = "tcp",
    .version    = XTABLES_VERSION,
    .size       = XT_ALIGN(sizeof(struct xt_tcp)),
    .userspacesize  = XT_ALIGN(sizeof(struct xt_tcp)),
    .help       = tcp_help,
    .init       = tcp_init,
    .parse      = tcp_parse,
    .print      = tcp_print,
    .save       = tcp_save,
    .extra_opts = tcp_opts,
    .xlate      = tcp_xlate,
};

 相应的解析函数：

int command_default(struct iptables_command_state *cs,
            struct xtables_globals *gl)
{
    if (cs->target != NULL &&
        (cs->target->parse != NULL || cs->target->x6_parse != NULL) &&
        cs->c >= cs->target->option_offset &&
        cs->c < cs->target->option_offset + XT_OPTION_OFFSET_SCALE) {
        xtables_option_tpcall(cs->c, cs->argv, cs->invert,
                      cs->target, &cs->fw);
        return 0;
    }

    for (matchp = cs->matches; matchp; matchp = matchp->next) {
        m = matchp->match;

        if (matchp->completed ||
            (m->x6_parse == NULL && m->parse == NULL))
            continue;
        if (cs->c < matchp->match->option_offset ||
            cs->c >= matchp->match->option_offset + XT_OPTION_OFFSET_SCALE)
            continue;
        xtables_option_mpcall(cs->c, cs->argv, cs->invert, m, &cs->fw);
        return 0;
    }

    /* Try loading protocol */
    m = load_proto(cs);
    if (m != NULL) {
        size_t size;

        cs->proto_used = 1;

        size = XT_ALIGN(sizeof(struct xt_entry_match)) + m->size;

        m->m = xtables_calloc(1, size);
        m->m->u.match_size = size;
        strcpy(m->m->u.user.name, m->name);
        m->m->u.user.revision = m->revision;
        xs_init_match(m);

        if (m->x6_options != NULL)
            gl->opts = xtables_options_xfrm(gl->orig_opts,
                            gl->opts,
                            m->x6_options,
                            &m->option_offset);
        else
            gl->opts = xtables_merge_options(gl->orig_opts,
                             gl->opts,
                             m->extra_opts,
                             &m->option_offset);
        if (gl->opts == NULL)
            xtables_error(OTHER_PROBLEM, "can't alloc memory!");
        optind--;
        /* Indicate to rerun getopt *immediately* */
        return 1;
    }
}
void xtables_option_mpcall(unsigned int c, char **argv, bool invert,
               struct xtables_match *m, void *fw)
{
    if (m->x6_parse == NULL) {
    if (m->parse != NULL)
        m->parse(c - m->option_offset, argv, invert,
             &m->mflags, fw, &m->m);
    return;
    }
}

 tcp_parse会将端口数据写入struct xt_tcp中。
 load_proto中会加载按照protocol寻找对应的xtables_match。

struct xtables_match *load_proto(struct iptables_command_state *cs)
{
    if (!should_load_proto(cs))
        return NULL;
    return find_proto(cs->protocol, XTF_TRY_LOAD,
              cs->options & OPT_NUMERIC, &cs->matches);
}
static struct xtables_match *
find_proto(const char *pname, enum xtables_tryload tryload,
       int nolookup, struct xtables_rule_match **matches)
{
     return xtables_find_match(pname, tryload, matches);
}

 命令行中的数据会加载到struct xt_entry_match。之后被复制到struct ipt_entry中。

static struct ipt_entry *
generate_entry(const struct ipt_entry *fw,
           struct xtables_rule_match *matches,
           struct xt_entry_target *target)
{
    unsigned int size;
    struct xtables_rule_match *matchp;
    struct ipt_entry *e;

    size = sizeof(struct ipt_entry);
    for (matchp = matches; matchp; matchp = matchp->next)
        size += matchp->match->m->u.match_size;

    e = xtables_malloc(size + target->u.target_size);
    *e = *fw;
    e->target_offset = size;
    e->next_offset = size + target->u.target_size;

    size = 0;
    for (matchp = matches; matchp; matchp = matchp->next) {
        //复制match中的数据
        memcpy(e->elems + size, matchp->match->m, matchp->match->m->u.match_size);
        size += matchp->match->m->u.match_size;
    }
    memcpy(e->elems + size, target, target->u.target_size);

    return e;
}

 数据复制。

static int
append_entry(const xt_chainlabel chain,
         struct ipt_entry *fw,
         unsigned int nsaddrs,
         const struct in_addr saddrs[],
         const struct in_addr smasks[],
         unsigned int ndaddrs,
         const struct in_addr daddrs[],
         const struct in_addr dmasks[],
         int verbose,
         struct xtc_handle *handle)
{
    for (i = 0; i < nsaddrs; i++) {
        fw->ip.src.s_addr = saddrs[i].s_addr;
        fw->ip.smsk.s_addr = smasks[i].s_addr;
        for (j = 0; j < ndaddrs; j++) {
            fw->ip.dst.s_addr = daddrs[j].s_addr;
            fw->ip.dmsk.s_addr = dmasks[j].s_addr;
            if (verbose)
                print_firewall_line(fw, handle);
            ret &= iptc_append_entry(chain, fw, handle);
        }
    }

    return ret;
}
iptc_append_entry(const IPT_CHAINLABEL chain,
        const STRUCT_ENTRY *e,
        struct xtc_handle *handle)
{
    if (!(r = iptcc_alloc_rule(c, e->next_offset))) {
        DEBUGP("unable to allocate rule for chain `%s'\n", chain);
        errno = ENOMEM;
        return 0;
    }
    memcpy(r->entry, e, e->next_offset);
}
/* allocate and initialize a new rule for the cache */
static struct rule_head *iptcc_alloc_rule(struct chain_head *c, unsigned int size)
{
    r->chain = c;
    r->size = size;
    return r;
}

 解析action，-j ACCEPT。

int do_command4(int argc, char *argv[], char **table,
        struct xtc_handle **handle, bool restore)
{
        case 'j':
            set_option(&cs.options, OPT_JUMP, &cs.fw.ip.invflags,
                   cs.invert);
            command_jump(&cs, optarg);
            break;
}
void command_jump(struct iptables_command_state *cs, const char *jumpto)
{
    cs->jumpto = xt_parse_target(jumpto);
    /* TRY_LOAD (may be chain name) */
    cs->target = xtables_find_target(cs->jumpto, XTF_TRY_LOAD);

    if (cs->target == NULL)
        return;

    size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;

    cs->target->t = xtables_calloc(1, size);
    cs->target->t->u.target_size = size;
}

 ACCEPT，DROP，QUEUE，RETURN对应的是standard target。

static struct xtables_target standard_target = {
    .family     = NFPROTO_UNSPEC,
    .name       = "standard",
    .version    = XTABLES_VERSION,
    .size       = XT_ALIGN(sizeof(int)),
    .userspacesize  = XT_ALIGN(sizeof(int)),
    .help       = standard_help,
};

 xt_entry_target分配的大小：

size = XT_ALIGN(sizeof(struct xt_entry_target)) + cs->target->size;
cs->target->t = xtables_calloc(1, size);

 standard target的target->size大小为XT_ALIGN(sizeof(int))。最终分配的结构体为xt_standard_target 。

struct xt_standard_target {
    struct xt_entry_target target;
    int verdict;
};

 整理成内核需要的格式，向内核提交：

int
TC_COMMIT(struct xtc_handle *handle)
{
    /* Replace, then map back the counters. */
    STRUCT_REPLACE *repl;
    new_number = iptcc_compile_table_prep(handle, &new_size);
    ret = iptcc_compile_table(handle, repl);
    ret = setsockopt(handle->sockfd, TC_IPPROTO, SO_SET_REPLACE, repl,
             sizeof(*repl) + repl->size);
}

内核空间

static int
do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
{
    switch (cmd) {
    case IPT_SO_SET_REPLACE:
        ret = do_replace(sock_net(sk), user, len);
        break;
    default:
        ret = -EINVAL;
    }
    return ret;
}
static int
do_replace(struct net *net, const void __user *user, unsigned int len)
{
    newinfo = xt_alloc_table_info(tmp.size);
    if (!newinfo)
        return -ENOMEM;

    loc_cpu_entry = newinfo->entries;
    if (copy_from_user(loc_cpu_entry, user + sizeof(tmp),
               tmp.size) != 0) {
        ret = -EFAULT;
        goto free_newinfo;
    }
    ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
    if (ret != 0)
        goto free_newinfo;
    
    ret = __do_replace(net, tmp.name, tmp.valid_hooks, newinfo,
            tmp.num_counters, tmp.counters);
}
static int
__do_replace(struct net *net, const char *name, unsigned int valid_hooks,
         struct xt_table_info *newinfo, unsigned int num_counters,
         void __user *counters_ptr)
{
    struct xt_table *t;
    t = xt_request_find_table_lock(net, AF_INET, name);
    oldinfo = xt_replace_table(t, num_counters, newinfo, &ret);
}
struct xt_table_info *
xt_replace_table(struct xt_table *table,
          unsigned int num_counters,
          struct xt_table_info *newinfo,
          int *error)
{
    table->private = newinfo;
}

原有规则的处理

 用户层调用setsockopt将数据配置到内核。do_replace函数会重新配置规则。但是用户可以多次配置iptable。这里就引入一个问题：之前内核中的iptables规到哪里去了呢？难道被冲掉了吗？
 iptables在重新解析规则时，会调用getsockopt将内核中的规则拷贝出来，然后重新配置。

int do_command4(int argc, char *argv[], char **table,
        struct xtc_handle **handle, bool restore)
{
    /* only allocate handle if we weren't called with a handle */
    if (!*handle)
        *handle = iptc_init(*table);
}
struct xtc_handle *
iptc_init(const char *tablename)
{
    strcpy(info.name, tablename);
//获取entry的大小信息。
    if (getsockopt(sockfd, TC_IPPROTO, SO_GET_INFO, &info, &s) < 0) {
        close(sockfd);
        return NULL;
    }
    h = alloc_handle(&info);
    /* Initialize current state */
    h->sockfd = sockfd;
    h->info = info;

    h->entries->size = h->info.size;

    tmp = sizeof(STRUCT_GET_ENTRIES) + h->info.size;
    if (getsockopt(h->sockfd, TC_IPPROTO, SO_GET_ENTRIES, h->entries,
               &tmp) < 0)
        goto error;
}

 getsockopt(h->sockfd, TC_IPPROTO,SO_GET_ENTRIES, h->entries, &tmp) 从内核中拷贝原有的entries。
 内核中对应的处理函数：

static int
compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
{
    int ret;

    if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
        return -EPERM;

    switch (cmd) {
    case IPT_SO_GET_INFO:
        ret = get_info(sock_net(sk), user, len, 1);
        break;
    case IPT_SO_GET_ENTRIES:
        ret = compat_get_entries(sock_net(sk), user, len);
        break;
    default:
        ret = do_ipt_get_ctl(sk, cmd, user, len);
    }
    return ret;
}

 读取规则信息之后，iptables重新处理数据：

/* parse an iptables blob into it's pieces */
static int parse_table(struct xtc_handle *h)
{
    /* First pass: over ruleset blob */
    ENTRY_ITERATE(h->entries->entrytable, h->entries->size,
            cache_add_entry, h, &prev, &num);
}
/* main parser function: add an entry from the blob to the cache */
static int cache_add_entry(STRUCT_ENTRY *e,
               struct xtc_handle *h,
               STRUCT_ENTRY **prev,
               unsigned int *num)
{
else if ((builtin = iptcb_ent_is_hook_entry(e, h)) != 0) {
        struct chain_head *c =
            iptcc_alloc_chain_head((char *)hooknames[builtin-1],
                        builtin);
        DEBUGP_C("%u:%u new builtin chain: %p (rules=%p)\n",
            *num, offset, c, &c->rules);
        if (!c) {
            errno = -ENOMEM;
            return -1;
        }

        c->hooknum = builtin;

        __iptcc_p_add_chain(h, c, offset, num);

        /* FIXME: this is ugly. */
        goto new_rule;
    } 
}

 内核中在初始化table的时候，会配置chain。博客——netfilter分析2-表在内核的初始化——有更详尽的分析。
 以filter表为例：

static int __net_init iptable_filter_table_init(struct net *net)
{
    repl = ipt_alloc_initial_table(&packet_filter);
}
void *ipt_alloc_initial_table(const struct xt_table *info)
{
    return xt_alloc_initial_table(ipt, IPT);
}
#define xt_alloc_initial_table(type, typ2) ({ \
    struct { \
        struct type##_replace repl; \
        struct type##_standard entries[]; \
    } *tbl; \
    struct type##_error *term; \
    size_t term_offset = (offsetof(typeof(*tbl), entries[nhooks]) + \
        __alignof__(*term) - 1) & ~(__alignof__(*term) - 1); \
    tbl = kzalloc(term_offset + sizeof(*term), GFP_KERNEL); \
    for (; hook_mask != 0; hook_mask >>= 1, ++hooknum) { \
        if (!(hook_mask & 1)) \
            continue; \
        tbl->repl.hook_entry[hooknum] = bytes; \
        tbl->repl.underflow[hooknum]  = bytes; \
        tbl->entries[i++] = (struct type##_standard) \
            typ2##_STANDARD_INIT(NF_ACCEPT); \
        bytes += sizeof(struct type##_standard); \
    } \
    tbl; \
})

Reference:

[1]25个iptables常用示例
[2]Netfilter之AF_INET协议族rule、match、target
[3]iptables 防火墙-filter表
[4]Netfilter 是如何工作的(二)：表(table)与规则(rule)
[5]Netfilter是如何工作的(三)：扩展匹配条件和动作
[6]netfilter分析2-表在内核的初始化
[7]netfilter分析3-钩子函数执行流程
[8]iptables性能 -- Kube-proxy引入user define chain思考
[9]ipset详解 使用ipset提高iptables的控制效率