iptables layer7

源代码的官网：http://vault.centos.org/
依次进入 6.8/os/Source/SPackages/
找到 kernel-3.10.0-693.el7.src.rpm，下载就行了。

# yum install rpm-build redhat-rpm-config asciidoc hmaccalc perl-ExtUtils-Embed pesign xmlto -y
# yum install audit-libs-devel binutils-devel elfutils-devel elfutils-libelf-devel -y
# yum install ncurses-devel newt-devel numactl-devel pciutils-devel python-devel zlib-devel bison -y

# mkdir -p ~/rpmbuild/{BUILD,BUILDROOT,RPMS,SOURCES,SPECS,SRPMS}
# echo ‘%_topdir %(echo $HOME)/rpmbuild‘ > ~/.rpmmacros

# rpm -i kernel-2.6.32-642.el6.src.rpm 2>&1 | grep -v exist
# cd ~/rpmbuild/SPECS
# rpmbuild -bp --target=$(uname -m) kernel.spec

gpg: WARNING: some OpenPGP programs can‘t handle a DSA key with this digest size

需要安装：rng-tools
# yum install rng-tools -y

# echo ‘EXTRAOPTIONS="--rng-device /dev/urandom"‘ >/etc/sysconfig/rngd
# service rngd start
Starting rngd:                                            [  OK  ]
# chkconfig rngd on
# chkconfig --list rngd
rngd             0:off   1:off   2:on   3:on   4:on   5:on   6:off
或者
直接在/etc/rc.d/rc.local中加入
rngd -r /dev/urandom -o /dev/random &

关于rng-tools详细的说明，可以参看
# yum -y install kernel-doc
# less /usr/share/doc/kernel-doc-2.6.32-xxx/Documentation/hw_random.txt

~/$HOME/rpmbuild/BUILD/kernel-2.6.32-642.el6/linux-2.6.32-642.el6.x86_64

# cp -R linux-2.6.32-642.el6.x86_64 /usr/src/linux-2.6.32
# cd /usr/src
# ln -sv linux-2.6.32 linux
# cd linux
# cp /boot/config-2.6.32-754.el6.x86_64 .config
# make menuconfig

Networking support
    Networking options --->
        Network packet filtering framework(Netfilter) --->
            Core Netfilter Configuration --->
                <M> layer7 match support (NEW)
                <M> Netfilter connection tracking support     //layer7是依赖于Netfilter连接追踪功能的
<*>Enable loadable module support --->　　//支持模块动态装卸载中
　　[] Module signature verification　　//模块签名校验，rhel提供的密钥来校验模块是否被修改了，所以把这一项去掉
Cryptographic API -->　　加密库API
　　[] In-kernel signature checker 　//将kerneil内部的签名校验器也关掉
最后保存退出