本文對(duì)Linux 防火墻內(nèi)核中Netfilter 系統(tǒng)的結(jié)構(gòu)框架、工作原理及其在內(nèi)核中的實(shí)現(xiàn)機(jī)制進(jìn)行了研究，闡述了Linux 內(nèi)核可加載模塊的機(jī)制，并分析了其主要數(shù)據(jù)結(jié)構(gòu)及它們之間的關(guān)系。還介紹了如何編寫內(nèi)核模塊，并將其鑲嵌在Netfilter 的架構(gòu)中以實(shí)現(xiàn)對(duì)防火墻功能的擴(kuò)充，并用防火墻作為實(shí)例，說(shuō)明了如何在Linux 系統(tǒng)下實(shí)現(xiàn)模塊加載和卸載。
關(guān)鍵詞：防火墻；Linux 內(nèi)核；Netfilter；模塊加載
Abstract：This paper introduces the framework, working theory and implementation mechanisms in kernel of the Linux firewall named Netfilter. Then it expounds the loading module mechanism of Linux, and analyzes the data structure of Linux module and their relationship, and how to program the kernel module and build it in Netfilter, in order to achieve the function expansion of firewall. The Linux firewall will be taken as an example to show how to implement module loading and unloading technology.
Key words：firewall; Iinux kernal; Netfilter ; Module Loading Technology