static struct sock *nlfd;
struct
{
  __u32 pid;
  rwlock_t lock;
}user_proc;
/*挂接在 netfilter 框架的 NF_IP_PRE_ROUTING 点上的函数为 get_icmp()*/
static struct nf_hook_ops imp2_ops =
{
  .hook = get_icmp,		/*netfilter 钩子函数*/
  .pf = PF_INET,
  .hooknum = NF_IP_PRE_ROUTING,
  .priority = NF_IP_PRI_FILTER -1,
};
static int __init init(void)
{
  rwlock_init(&user_proc.lock);
  /*在内核创建一个 netlink socket，并注明由 kernel_recieve() 函数接收数据
    这里协议 NL_IMP2 是自定的*/
  nlfd = netlink_kernel_create(NL_IMP2, kernel_receive);
  if(!nlfd)
    {
      printk("can not create a netlink socket\n");
      return -1;
    }
  /*向 netfilter 的 NF_IP_PRE_ROUTING 点挂接函数*/
  return nf_register_hook(&imp2_ops);
}
static void __exit fini(void)
{
  if(nlfd)
    {
      sock_release(nlfd->socket);
	}
  nf_unregister_hook(&imp2_ops);
}
module_init(init);
module_exit(fini);

DECLARE_MUTEX(receive_sem);
01:  static void kernel_receive(struct sock *sk, int len)
02:  {
03:    do
04:      {
05:       struct sk_buff *skb;
06:        if(down_trylock(&receive_sem))
07:            return;
08:
09:        while((skb = skb_dequeue(&sk-<receive_queue)) != NULL)
10:          {
11:          {
12:              struct nlmsghdr *nlh = NULL;
13:        if(skb-<len <= sizeof(struct nlmsghdr))
14:              {
15:                nlh = (struct nlmsghdr *)skb-<data;
16:                if((nlh-<nlmsg_len <= sizeof(struct nlmsghdr))
17:                   && (skb-<len <= nlh-<nlmsg_len))
18:                  {
19:                    if(nlh-<nlmsg_type == IMP2_U_PID)
20:                      {
21:                        write_lock_bh(&user_proc.pid);
22:                        user_proc.pid = nlh-<nlmsg_pid;
23:                write_unlock_bh(&user_proc.pid);
24:                      }
25:                    else if(nlh-<nlmsg_type == IMP2_CLOSE)
26:                      {
27:                        write_lock_bh(&user_proc.pid);
28:               if(nlh-<nlmsg_pid == user_proc.pid) user_proc.pid = 0;
29:                        write_unlock_bh(&user_proc.pid);
30:                      }
31:                  }
32:              }
33:          }
34:        kfree_skb(skb);
35:        }
36:        up(&receive_sem);
37:      }while(nlfd && nlfd-<receive_queue.qlen);
38:  }

static unsigned int get_icmp(unsigned int hook,
                             struct sk_buff **pskb,
                             const struct net_device *in,
                             const struct net_device *out,
                             int (*okfn)(struct sk_buff *))
{
  struct iphdr *iph = (*pskb)->nh.iph;
  struct packet_info info;
  if(iph->protocol == IPPROTO_ICMP)	/*若传输层协议为 ICMP*/
    {
      read_lock_bh(&user_proc.lock);
      if(user_proc.pid != 0)
	    {
          read_unlock_bh(&user_proc.lock);
          info.src = iph->saddr;	/*记录源地址*/
          info.dest = iph->daddr;	/*记录目的地址*/
          send_to_user(&info);		/*发送数据*/
        }
      else
        read_unlock_bh(&user_proc.lock);
    }
  return NF_ACCEPT;
}

static int send_to_user(struct packet_info *info)
{
  int ret;
  int size;
  unsigned char *old_tail;
  struct sk_buff *skb;
  struct nlmsghdr *nlh;
  struct packet_info *packet;
  size = NLMSG_SPACE(sizeof(*info));
  /*开辟一个新的套接字缓存*/
  skb = alloc_skb(size, GFP_ATOMIC);
  old_tail = skb->tail;
  /*填写数据报相关信息*/
  nlh = NLMSG_PUT(skb, 0, 0, IMP2_K_MSG, size-sizeof(*nlh));
  packet = NLMSG_DATA(nlh);
  memset(packet, 0, sizeof(struct packet_info));
  /*传输到用户空间的数据*/
  packet->src = info->src;
  packet->dest = info->dest;
  /*计算经过字节对其后的数据实际长度*/
  nlh->nlmsg_len = skb->tail - old_tail;
  NETLINK_CB(skb).dst_groups = 0;
  read_lock_bh(&user_proc.lock);
  ret = netlink_unicast(nlfd, skb, user_proc.pid, MSG_DONTWAIT); /*发送数据*/
  read_unlock_bh(&user_proc.lock);
  return ret;
 nlmsg_failure: /*若发送失败，则撤销套接字缓存*/
  if(skb)
    kfree_skb(skb);
  return -1;
}

/*字节对齐*/
#define NLMSG_ALIGN(len) ( ((len)+NLMSG_ALIGNTO-1) & ~(NLMSG_ALIGNTO-1) )
/*计算包含报头的数据报长度*/
#define NLMSG_LENGTH(len) ((len)+NLMSG_ALIGN(sizeof(struct nlmsghdr)))
/*字节对齐后的数据报长度*/
#define NLMSG_SPACE(len) NLMSG_ALIGN(NLMSG_LENGTH(len))
/*填写相关报头信息，这里使用了nlmsg_failure标签，所以在程序中要定义*/
#define NLMSG_PUT(skb, pid, seq, type, len) ({ if (skb_tailroom(skb) < (int)NLMSG_SPACE(len)) goto nlmsg_failure;    __nlmsg_put(skb, pid, seq, type, len); })
static __inline__ struct nlmsghdr *
__nlmsg_put(struct sk_buff *skb, u32 pid, u32 seq, int type, int len)
{
	struct nlmsghdr *nlh;
	int size = NLMSG_LENGTH(len);
	nlh = (struct nlmsghdr*)skb_put(skb, NLMSG_ALIGN(size));
	nlh->nlmsg_type = type;
	nlh->nlmsg_len = size;
	nlh->nlmsg_flags = 0;
	nlh->nlmsg_pid = pid;
	nlh->nlmsg_seq = seq;
	return nlh;
}
/*跳过报头取实际数据*/
#define NLMSG_DATA(nlh)  ((void*)(((char*)nlh) + NLMSG_LENGTH(0)))
/*取 netlink 控制字段*/
#define NETLINK_CB(skb)		(*(struct netlink_skb_parms*)&((skb)->cb))