Routing Questions - Netfilter Hooks

Routing Questions - Netfilter Hooks

[Jon Webb]

Hello everyone... I am writing a new routing system. It uses a kernel 
module and a userspace daemon. Essentially the kernel module intercepts 
packets on NF_IP_PREROUTING and NF_IP_LOCAL_OUT and checks for existing 
routes. If the routes do not exist, the packets are bumped up to 
userspace so that routes can be established (by other means). I am 
having a problem for which I hope someone has a solution.

To start, the documentation is unclear about when packets go to the 
kernel routing system on the outbound path. The docs indicate that 
IP_LOCAL_OUT is called before the routing code, but then there is a 
sentence that states the routing code is called "first" to determine 
source IP, etc. This has grave implications for my code because I need 
to capture all packets before they are rejected due to lack of routes! 
Right now I have verified that if I do not have a route to a host, and I 
try to ping that host, I get network unreachable messages without the 
IP_LOCAL_OUT hook ever getting called. Is there a way around this? Or am 
I just doing something wrong?

My second question is more of a routing question in general, but perhaps 
someone has a suggestion. On the IP_PRE_ROUTING side, my code to check 
routes and bump them into userspace is working fine except that it would 
be really useful to know what kind of routes they are (ie, what flags 
they have). The problem with obtaining this information is that the 
rtable structure returned by the route lookup operation is not 
displaying any flags (the rt_flags field is always 0). This means I 
can't decipher whether the route it returns is a host route or a gateway 
route or whatever..

Thanks,
Jon Webb
jon_webb@binary-one.com

-----------------
Jon Webb
Computer Communications Research Group
University of California, Santa Cruz

Re: Routing Questions - Netfilter Hooks

[Jon Webb]

Ok. We've decided to either install a ficticious default route through 
the loopback device, or restict our routing protocol to operation on one 
subnet to which we will have a media route that will match anything of 
interest. But I still have the problem of addressing routes from within 
the kernel. Specifically, when I catch a packet on IP_LOCAL_OUT, I need 
to check it's route with ip_route_output_key() to see if it needs 
routing. Any packet which does not have a static route (ie, any packet 
which used the default route) needs additional routing done to it. The 
best way to do with would be to inspect the rt_flags field that is 
returned in the rtable structure by ip_route_output_key() except that 
they don't contain useful (if any) information. Is there another way 
that I could establish which route a packet has from inside a kernel 
module? Anything that distinguishes it as a default or "media" (ie 
subnet) route would do the trick.

Thanks,
Jon Webb
jon_webb@binary-one.com

--------
Jon Webb
Computer Communications Research Group
University of California, Santa Cruz

Jon Webb wrote:

> Hello everyone... I am writing a new routing system. It uses a kernel 
> module and a userspace daemon. Essentially the kernel module 
> intercepts packets on NF_IP_PREROUTING and NF_IP_LOCAL_OUT and checks 
> for existing routes. If the routes do not exist, the packets are 
> bumped up to userspace so that routes can be established (by other 
> means). I am having a problem for which I hope someone has a solution.
>
> To start, the documentation is unclear about when packets go to the 
> kernel routing system on the outbound path. The docs indicate that 
> IP_LOCAL_OUT is called before the routing code, but then there is a 
> sentence that states the routing code is called "first" to determine 
> source IP, etc. This has grave implications for my code because I need 
> to capture all packets before they are rejected due to lack of routes! 
> Right now I have verified that if I do not have a route to a host, and 
> I try to ping that host, I get network unreachable messages without 
> the IP_LOCAL_OUT hook ever getting called. Is there a way around this? 
> Or am I just doing something wrong?
>
> My second question is more of a routing question in general, but 
> perhaps someone has a suggestion. On the IP_PRE_ROUTING side, my code 
> to check routes and bump them into userspace is working fine except 
> that it would be really useful to know what kind of routes they are 
> (ie, what flags they have). The problem with obtaining this 
> information is that the rtable structure returned by the route lookup 
> operation is not displaying any flags (the rt_flags field is always 
> 0). This means I can't decipher whether the route it returns is a host 
> route or a gateway route or whatever..
>
> Thanks,
> Jon Webb
> jon_webb@binary-one.com
>
> -----------------
> Jon Webb
> Computer Communications Research Group
> University of California, Santa Cruz
>
>