size of a rule

size of a rule

[Ozgur AKAN]

[-- Attachment #1: Type: text/plain, Size: 609 bytes --]

Hi,
I am trying to find the size of a rule in memory.

const struct ipt_entry *e;

sizeof (*e) is equal to 112 always. But the size of rule should be 
different because we can give different parameters to each rule. (I 
guess that this is the size of the header-like place)

So I looked at the source of libiptc and found this in linux_list.h 
while searching for the size value.

#define list_entry(ptr, type, member) \
        ((type *) ( (char *)(ptr)-(unsigned long)(&((type *)0)->member) ) )

What is the meaning of ((type *)0)->member ? I can not understand the 
part with 0.  

thanks,
-- 
Ozgur Akan


[-- Attachment #2: Type: text/html, Size: 1043 bytes --]

Re: size of a rule

[Ozgur AKAN]

[-- Attachment #1: Type: text/plain, Size: 915 bytes --]

Actually when I print the address of ipt_entry and subtract it from the 
next ipt_entry I can get the size of the rule but I am not sure if I am 
doing something wrong or right.

I still can not understand ((type *)0)->member.

Ozgur AKAN wrote:

> Hi,
> I am trying to find the size of a rule in memory.
>
> const struct ipt_entry *e;
>
> sizeof (*e) is equal to 112 always. But the size of rule should be 
> different because we can give different parameters to each rule. (I 
> guess that this is the size of the header-like place)
>
> So I looked at the source of libiptc and found this in linux_list.h 
> while searching for the size value.
>
> #define list_entry(ptr, type, member) \
>         ((type *) ( (char *)(ptr)-(unsigned long)(&((type 
> *)0)->member) ) )
>
> What is the meaning of ((type *)0)->member ? I can not understand the 
> part with 0.  
>
>thanks,
>-- 
>Ozgur Akan
>  
>


-- 
Ozgur Akan


[-- Attachment #2: Type: text/html, Size: 1592 bytes --]

Re: size of a rule

[zhi wang]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=us-ascii, Size: 1112 bytes --]

> #define list_entry(ptr, type, member) \
>         ((type *) ( (char *)(ptr)-(unsigned long)(&((type *)0)->member) ) )
> 
> What is the meaning of ((type *)0)->member ? I can not understand the 
> part with 0.  
This is a common trick in Linux. I first saw it in 4.4BSD source codes. Here,
the type is often a structure, for example,
struct foo{
     int bar1;
     int bar2;
};
then 
(struct foo*)0 coverts zero to a point to struct foo, suppose:
    struct foo* p = (struct foo*)0;
then &((struct foo*)0)->bar2 is:
    &p->bar2
which get the address of bar2. 
Becase p equals to zero, so the address of bar2 is also the offset of bar2 in
the structure foo.
So, &((type*)0)->member yields the offset of member in type.

If you want to find the size of a rule, try this command:
          iptables -L -vvv
This command shows the details of filter tables rules. It aslo gives the
structure of iptable. If you want to read the source codes, It will help a lot.


	
		
__________________________________
Do you Yahoo!?
Yahoo! Photos: High-quality 4x6 digital prints for 25¢
http://photos.yahoo.com/ph/print_splash

Re: size of a rule

[Henrik Nordstrom]

On Mon, 26 Apr 2004, Ozgur AKAN wrote:

> Hi,
> I am trying to find the size of a rule in memory.
> 
> const struct ipt_entry *e;
> 
> sizeof (*e) is equal to 112 always. But the size of rule should be 
> different because we can give different parameters to each rule. (I 
> guess that this is the size of the header-like place)

ipt_entry->next_offset gives the size of this rule from what I can 
understand.

> So I looked at the source of libiptc and found this in linux_list.h 
> while searching for the size value.
> 
> #define list_entry(ptr, type, member) \
>         ((type *) ( (char *)(ptr)-(unsigned long)(&((type *)0)->member) ) )
> 
> What is the meaning of ((type *)0)->member ? I can not understand the 
> part with 0.  

The (&((type *)0)->member) is just one way of calculating the offset of
"member" within the datatype "type".

This macro is used by iptables to index various lists.

Regards
Henrik

Re: size of a rule

[Ozgur AKAN]

Henrik Nordstrom wrote:

>
>ipt_entry->next_offset gives the size of this rule from what I can 
>understand.
>
>Regards
>Henrik
>
I solved my problem. Here is the sample which gets the name of target. 
It may be useful for other beginners.

Thank you for your help.

-------------------------------------------------
//print ipt_entry_target
struct ipt_entry_target *
get_target(const struct ipt_entry *e)
{
    return (void *)e + e->target_offset;
}

//print ipt_entry_target.name
static void print_target_name(const struct ipt_entry *e)
{
    struct ipt_entry_target *t = get_target(e);
    printf("Target name : %s\n", t->u.user.name);
}
------------------------------------------------------

-- 
Ozgur Akan