iptables中的addrtype的定义是什么？

我热衷于addrtype在-src我的过滤器链之一中结合使用，例如，这样可以丢弃一些Bogon ip：

-A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j WEB

手册页显示以下内容

addrtype
此模块根据数据包的地址类型匹配数据包。地址类型用于内核网络堆栈中，并将地址分为各种组。该组的确切定义取决于特定的第三层协议。

以下地址类型是可能的：

• UNSPEC一个未指定的地址（即0.0.0.0）
• UNICAST单播地址
• 本地地址
• 广播广播地址
• ANYCAST任播数据包
• 多播多播地址
• 黑洞黑洞地址
• 无法访问的地址
• 禁止使用禁止的地址
• 扔固定
• NAT修复程序
• XRESOLVE

目前尚不清楚确切的定义是什么，它是否取决于特定的第3层协议。我是这样认为的：

• UNICAST（！广播，！MULTICAST，！ANYCAST）
• 当地（127.0.0.0/8）
• 广播（*.*.*.255）
• ANYCAST（*.*.*.*）
• 多播（224.0.0.0/4）

是否有人清楚这意味着什么以及如何通过iptables实现它（例如，它如何知道黑洞在哪里）？

我认为让您知道内核是黑洞地址类型取决于您。

从iptables源代码中的xt_addrtype.h文件中，您可以看到：

/* rtn_type enum values from rtnetlink.h, but shifted */                        
enum {                                                                          
    XT_ADDRTYPE_UNSPEC = 1 << 0,                                                
    XT_ADDRTYPE_UNICAST = 1 << 1,   /* 1 << RTN_UNICAST */                      
    XT_ADDRTYPE_LOCAL  = 1 << 2,    /* 1 << RTN_LOCAL, etc */                   
    XT_ADDRTYPE_BROADCAST = 1 << 3,                                             
    XT_ADDRTYPE_ANYCAST = 1 << 4,                                               
    XT_ADDRTYPE_MULTICAST = 1 << 5,                                             
    XT_ADDRTYPE_BLACKHOLE = 1 << 6,                                             
    XT_ADDRTYPE_UNREACHABLE = 1 << 7,                                           
    XT_ADDRTYPE_PROHIBIT = 1 << 8,                                              
    XT_ADDRTYPE_THROW = 1 << 9,                                                 
    XT_ADDRTYPE_NAT = 1 << 10,                                                  
    XT_ADDRTYPE_XRESOLVE = 1 << 11,                                             
};

在中rtnetlink.h，您将看到相同的定义：

enum {                                                                          
    RTN_UNSPEC,                                                                 
    RTN_UNICAST,        /* Gateway or direct route  */                          
    RTN_LOCAL,      /* Accept locally       */                                  
    RTN_BROADCAST,      /* Accept locally as broadcast,                         
                   send as broadcast */                                         
    RTN_ANYCAST,        /* Accept locally as broadcast,                         
                   but send as unicast */                                       
    RTN_MULTICAST,      /* Multicast route      */                              
    RTN_BLACKHOLE,      /* Drop             */                                  
    RTN_UNREACHABLE,    /* Destination is unreachable   */                      
    RTN_PROHIBIT,       /* Administratively prohibited  */                      
    RTN_THROW,      /* Not in this table        */                              
    RTN_NAT,        /* Translate this address   */                              
    RTN_XRESOLVE,       /* Use external resolver    */                          
    __RTN_MAX                                                                   
};

您可以看到iptables在内核tcp网络堆栈中使用相同的地址类型定义。

然后从man ip：

Route types:

      unicast - the route entry describes real paths to the destinations covered by the route prefix.

      unreachable  - these destinations are unreachable.  Packets are discarded and the ICMP message host unreachable is generated.
               The local senders get an EHOSTUNREACH error.

      blackhole - these destinations are unreachable.  Packets are discarded silently.  The local senders get an EINVAL error.

      prohibit - these destinations are unreachable.  Packets are discarded and the  ICMP  message  communication  administratively
               prohibited is generated.  The local senders get an EACCES error.

      local - the destinations are assigned to this host.  The packets are looped back and delivered locally.

      broadcast - the destinations are broadcast addresses.  The packets are sent as link broadcasts.

      throw  - a special control route used together with policy rules. If such a route is selected, lookup in this table is termi‐
               nated pretending that no route was found.  Without policy routing it is equivalent to the absence of the route in the routing
               table.   The  packets  are  dropped  and the ICMP message net unreachable is generated.  The local senders get an ENETUNREACH
               error.

      nat - a special NAT route.  Destinations covered by the prefix are considered to  be  dummy  (or  external)  addresses  which
               require  translation  to  real  (or  internal)  ones  before forwarding.  The addresses to translate to are selected with the
               attribute Warning: Route NAT is no longer supported in Linux 2.6.

               via.

      anycast - not implemented the destinations are anycast addresses assigned to this host.  They are mainly equivalent to  local
               with one difference: such addresses are invalid when used as the source address of any packet.

      multicast - a special type used for multicast routing.  It is not present in normal routing tables.

因此，当您通过ip命令定义到网络的路由并将其标记为黑洞路由时，内核现在使该网络地址成为黑洞类型：

ip route add blackhole X.X.X.X/24