----- Original Message ----- From: "Leonardo Balliache" <leoball@opalsoft.net> To: <lartc@mailman.ds9a.nl> Sent: Thursday, June 27, 2002 8:02 PM Subject: kernel packet traveling diagram > Sorry everyone, I'm late.. always!! > > Here is a new version of kernel packet traveling diagram. Thanks a lot > to Julian Anastasov by his comments (notes at the end as I understood). > > I insist it's nice to have this diagram ready and updated. Look that > when Jan Coppens needed to tell us where he does need to mark packets > he just said "At this point I should need another mangle table->" using > the diagram as reference. > > We understand that internal kernel code is complex and interlaced and > not always is possible to identify clearly each part of it in a simple > diagram. But we keep on trying. > > I've got some comments: > > 1) I didn't know there was ipchains code in kernel 2.4; I supposed > iptables new code replace totally old ipchains code. Any feedback > about it would be useful. > > 2) Below I enclosed a link to an article from Harald Welte "The journey > of a packet through the linux 2.4 network stack"; it could help to the > discussion and getting an improved diagram, if it's possible. > > http://www.gnumonks.org/ftp/pub/doc/packet-journey-2.4.html > > 3) TODO: include LVS in the diagram. Julian give us this link to study the > issue and trying to complete the diagram. > > http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO-19.html#ss19.2 1 > > 4) Of course, diagram is ready to be shoot it off. Any comment, criticism, > etc,. is welcome. > > Best regards, > > Leonardo Balliache > > > > Network > -----------+----------- > | > +-------+------+ > | mangle | > | PREROUTING | <- MARK REWRITE > +-------+------+ > | > +-------+------+ > | nat | > | PREROUTING | <- DEST REWRITE > +-------+------+ > | > +-------+------+ > | ipchains | > | FILTER | > +-------+------+ > | > +-------+------+ > | QOS | > | INGRESS | <- controlled by tc > +-------+------+ > | > packet is for +-------+------+ packet is for > this address | INPUT | another address > +--------------+ ROUTING +---------------+ > | | + PRDB | | > | +--------------+ | > +-------+------+ | > | filter | | > | INPUT | | > +-------+------+ | > | | > +-------+------+ | > | Local | | > | Process | | > +-------+------+ | > | | > +-------+------+ | > | OUTPUT | +-------+-------+ > | ROUTING | | filter | > +-------+------+ | FORWARD | > | +-------+-------+ > +-------+------+ | > | mangle | | > | OUTPUT | MARK REWRITE | > +-------+------+ | > | | > +-------+------+ | > | nat | | > | OUTPUT | DEST REWRITE | > +-------+------+ | > | | > +-------+------+ | > | filter | | > | OUTPUT | | > +-------+------+ | > | | > +----------------+ +--------------------+ > | | > +--+-------+---+ > | ipchains | > | FILTER | > +-------+------+ > | > +-------+------+ > | nat | > | POSTROUTING | SOURCE REWRITE > +-------+------+ > | > +-------+------+ > | QOS | > | EGRESS | <- controlled by tc > +-------+------+ > | > -----------+----------- > Network > > > Notes: > > 1) The input routing determines local/forward. > 2) ip rule (policy routing database PRDB) is input routing, more correctly, > part of the input routing. Are you sure? In the previous diagram, the PRDB was checked before the packet hits the QOS Ingress. If the PRDB indeed is checked after QOS Ingress (i.e. in INPUT ROUTING), which seems the logical way, is it possible (with a patch???) to check the tc_index in "ip rule"? This would make it possible to let the output of the QOS ingress participate in the policy routing. FYI, there is a iptables patch out there, called mangle5hooks, so the mangle table registers all 5 netfilter hooks. This implies that the mangle table has 5 chains instead of 2, PREROUTING, INPUT, OUTPUT, FORWARD and POSTROUTING. Cheers, Jan > 3) The output routing is performed from "higher layer". > 4) nexthop and output device are determined both from the input and the > output routing. > 5) The forwarding process is called at input routing by functions from > specific place in the code. It executes after input routing and does not > perform nexthop/outdev selection. It's the process of receiving and > sending the same packet but in the context of all these hooks the code > that sends ICMP redirects (demanded from input routing), decs the IP TTL, > performs dumb NAT and calls the filter chain. This code is used only for > forwarded packets. > 6) Sometimes the word "Forwarding" with "big F", is used for referencing both, > the routing and forwarding process. > > > _______________________________________________ > LARTC mailing list / LARTC@mailman.ds9a.nl > http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/ > > _______________________________________________ LARTC mailing list / LARTC@mailman.ds9a.nl http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
