基于Netfilter框架的连接管理模型的研究  

Research on connection management model based on Netfilter framework

作　　者：赵大勇[1] 丁振国[1] 

机构地区：[1]西安电子科技大学计算机学院,陕西西安710071

出　　处：《计算机工程与设计》2008年第11期2794-2797,共4页Computer Engineering and Design

基　　金：国家863高技术研究发展计划基金项目(2004AA1Z2520);国防预研基金项目(2006QB1069)。

摘　　要：分析了Linux内核的Netfilter框架的实现机制,简要介绍了TCP粘合技术。业务选择网关(SSG)只允许授权用户进行TCP连接和资源访问,对TCP粘合技术进行改进,使之适应SSG连接管理机制的需求。提出基于Linux内核的Netfilter框架的连接管理模型的方案,并通过Netlink来实现用户空间和内核空间之间的数据交换。实践证明该方案能有效的对用户的连接进行控制和管理,这种模块化的实现方案具有易于功能扩展的特点,并且系统的性能得到显著的提高。The implementation mechanism of Netfilter framework in Linux kernel is analyzed and TCP splicing is introduced briefly. Service selection gateway （SSG） only permits the authorized users to establish TCP connection and access resources. TCP splicing method is revised so as to satisfy requirements of the SSG connection management mechanism. Scheme for connection management model based on Netfilter framework in Linux kernel is presented, also data exchange between user space and kernel space is achieved by Netlink in this scheme. Experiments prove that this scheme is very efficient in user connection control and management, and the per- formance of the system is highly improved. Furthermore, this modularized scheme can be simply extended when needed.

关 键 词：业务选择网关 网络过滤器 传输控制协议 连接管理 内核模块 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]