扫一扫
分享文章到微信
扫一扫
关注官方公众号
至顶头条
规则
综述
ipchains
man ipfw可以看到这一段的详细解释。关键数据结构如下:
规则链用ip_chain结构来表示,缺省有input,ouptput,forward三条链。在配置规则的时候,也可以添加新的链。每条链事实上就是一组相关的规则,以链表的形式存储。
struct ip_chain { ip_chainlabel label; /* Defines the label for each block */ struct ip_chain *next; /* Pointer to next block */ struct ip_fwkernel *chain; /* Pointer to first rule in block */ __u32 refcount; /* Number of refernces to block */ int policy; /* Default rule for chain. Only * * used in built in chains */ struct ip_reent reent[0]; /* Actually several of these */ }; |
每条规则用一个ip_fwkernel结构表示:
struct ip_fwkernel { struct ip_fw ipfw; struct ip_fwkernel *next; /* where to go next if current * rule doesn't match */ struct ip_chain *branch; /* which branch to jump to if * current rule matches */ int simplebranch; /* Use this if branch == NULL */ struct ip_counters counters[0]; /* Actually several of these */ }; |
ip_fwkernel中的一个重要部分就是ip_fw,用来表示待匹配的数据包消息:
struct ip_fw { struct in_addr fw_src, fw_dst; /* Source and destination IP addr */ struct in_addr fw_smsk, fw_dmsk; /* Mask for src and dest IP addr */ __u32 fw_mark; /* ID to stamp on packet */ __u16 fw_proto; /* Protocol, 0 = ANY */ __u16 fw_flg; /* Flags word */ __u16 fw_invflg; /* Inverse flags */ __u16 fw_spts[2]; /* Source port range. */ __u16 fw_dpts[2]; /* Destination port range. */ __u16 fw_redirpt; /* Port to redirect to. */ __u16 fw_outputsize; /* Max amount to output to NETLINK */ char fw_vianame[IFNAMSIZ]; /* name of interface "via" */ __u8 fw_tosand, fw_tosxor; /* Revised packet priority */ }; |
2.2内核中网络包与规则的实际匹配在ip_fw_check中进行。
iptables
一条规则分为三部分:
struct ipt_entry file://主要用来匹配IP头 struct ip_match file://额外的匹配(tcp头,mac地址等) struct ip_target file://除缺省的动作外(如ACCEPT,DROP),可以增加新的(如REJECT)。 man iptable: >A firewall rule specifies criteria for a packet, and a >target. If the packet does not match, the next rule in >the chain is the examined; if it does match, then the next >rule is specified by the value of the target, which can be >the name of a user-defined chain, or one of the special >values ACCEPT, DROP, QUEUE, or RETURN. |
2.4内核中网络包与规则的实际匹配在ip_do_table中进行。
简化代码如下:
/* Returns one of the generic firewall policies, like NF_ACCEPT. */ unsigned int ipt_do_table(struct sk_buff **pskb, unsigned int hook, const struct net_device *in, const struct net_device *out, struct ipt_table *table, void *userdata) { struct ipt_entry *e; struct ipt_entry_target *t; unsigned int verdict = NF_DROP; table_base = (void *)table->priva |
如果您非常迫切的想了解IT领域最新产品与技术信息,那么订阅至顶网技术邮件将是您的最佳途径之一。
现场直击|2021世界人工智能大会
直击5G创新地带,就在2021MWC上海
5G已至 转型当时——服务提供商如何把握转型的绝佳时机
寻找自己的Flag
华为开发者大会2020(Cloud)- 科技行者