owned this note   changed 3 years ago  
Linked with GitHub

Linux iptables 的運作原理分析 - 邱宏瑋 (hwchiu)

歡迎來到 https://hackmd.io/c/COSCUP2018 共筆

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

點擊本頁上方的 開始用 Markdown 一起寫筆記！
手機版請點選上方 按鈕展開議程列表。

請從這裡開始

netfilter

What happen

  • iptables command needs a communication between user and kernel space.
  • It need a lock to make sure the consistence
  • iptables will exit if it can't acquire …
    -w : wait

流程

  1. lock
  2. lock fail
  3. lock busy
  • iptables 的 rules 可重複

solution

  • Custom chain
    • Use the -F to flush all rules.
  • Check before inserting rule
    • Use the -C to check
  • Modify the iptables to avoid duplicated rules.
  • 改 code 麻煩，能否直接修改 iptable

-n new chain

libiptc

  • Library which manipulates firewall rules
  • Use the system call to interact with kernel
    • GetSocketOpt()
    • SetSocketOpt()
  • Maintain a cache for each iptables command.

workflows

  • Initial the libiptc to fetch all current rules
    • In the iptables, we use a handle to represent the cache.
  • Store those rules into a local cache
  • Operates rules in that cache
  • Commit the change to kernel

how to read

  • Function
    • DNAT(upper case) -> target
    • tcp(lowerccase) -> match
  • File naming
  • Old style
  • New style
    • libxt -> ipv4/ipv6
tags: COSCUP2018 source
Select a repo