本文對Linux 防火墻內(nèi)核中Netfilter 系統(tǒng)的結(jié)構框架、工作原理及其在內(nèi)核中的實現(xiàn)機制進行了研究，闡述了Linux 內(nèi)核可加載模塊的機制，并分析了其主要數(shù)據(jù)結(jié)構及它們之間的關系。還介紹了如何編寫內(nèi)核模塊，并將其鑲嵌在Netfilter 的架構中以實現(xiàn)對防火墻功能的擴充，并用防火墻作為實例，說明了如何在Linux 系統(tǒng)下實現(xiàn)模塊加載和卸載。
關鍵詞：防火墻；Linux 內(nèi)核；Netfilter；模塊加載
Abstract：This paper introduces the framework, working theory and implementation mechanisms in kernel of the Linux firewall named Netfilter. Then it expounds the loading module mechanism of Linux, and analyzes the data structure of Linux module and their relationship, and how to program the kernel module and build it in Netfilter, in order to achieve the function expansion of firewall. The Linux firewall will be taken as an example to show how to implement module loading and unloading technology.
Key words：firewall; Iinux kernal; Netfilter ; Module Loading Technology