linux防火墙实现技术比较

核心提示： struct ip_chain{ip_chainlabel label; /* Defines the label for each block */struct ip_chain *next; /* Pointer to next block */struct ip_fwkernel *

struct ip_chain

{

ip_chainlabel label; /* Defines the label for each block */

struct ip_chain *next; /* Pointer to next block */

struct ip_fwkernel *chain; /* Pointer to first rule in block */

__u32 refcount; /* Number of refernces to block */

int policy; /* Default rule for chain. Only *

* used in built in chains */

struct ip_reent reent[0]; /* Actually several of these */

};

每条规则用一个ip_fwkernel结构表示：

struct ip_fwkernel

{

struct ip_fw ipfw;

struct ip_fwkernel *next; /* where to go next if current

* rule doesn't match */

struct ip_chain *branch; /* which branch to jump to if

* current rule matches */

int simplebranch; /* Use this if branch == NULL */

struct ip_counters counters[0]; /* Actually several of these */

};

ip_fwkernel中的一个重要部分就是ip_fw，用来表示待匹配的数据包消息：

struct ip_fw

{

struct in_addr fw_src, fw_dst; /* Source and destination IP addr */

struct in_addr fw_smsk, fw_dmsk; /* Mask for src and dest IP addr */

__u32 fw_mark; /* ID to stamp on packet */

__u16 fw_proto; /* Protocol, 0 = ANY */

__u16 fw_flg; /* Flags word */

__u16 fw_invflg; /* Inverse flags */

__u16 fw_spts[2]; /* Source port range. */

__u16 fw_dpts[2]; /* Destination port range. */

__u16 fw_redirpt; /* Port to redirect to. */