Linux防火墙中模块加载技术的研究与实现

本文对Linux 防火墙内核中Netfilter 系统的结构框架、工作原理及其在内核中的实现机制进行了研究，阐述了Linux 内核可加载模块的机制，并分析了其主要数据结构及它们之间的关系。还介绍了如何编写内核模块，并将其镶嵌在Netfilter 的架构中以实现对防火墙功能的扩充，并用防火墙作为实例，说明了如何在Linux 系统下实现模块加载和卸载。
关键词：防火墙；Linux 内核；Netfilter；模块加载
Abstract：This paper introduces the framework, working theory and implementation mechanisms in kernel of the Linux firewall named Netfilter. Then it expounds the loading module mechanism of Linux, and analyzes the data structure of Linux module and their relationship, and how to program the kernel module and build it in Netfilter, in order to achieve the function expansion of firewall. The Linux firewall will be taken as an example to show how to implement module loading and unloading technology.
Key words：firewall; Iinux kernal; Netfilter ; Module Loading Technology