[LARTC] kernel packet traveling diagram

[Leonardo Balliache <leoball@opalsoft.net>]

Sorry everyone, I'm late.. always!!

Here is a new version of kernel packet traveling diagram. Thanks a lot
to Julian Anastasov by his comments (notes at the end as I understood).

I insist it's nice to have this diagram ready and updated.  Look that
when Jan Coppens needed to tell us where he does need to mark packets
he just said "At this point I should need another mangle table->" using
the diagram as reference.

We understand that internal kernel code is complex and interlaced and
not always is possible to identify clearly each part of it in a simple
diagram. But we keep on trying.

I've got some comments:

1) I didn't know there was ipchains code in kernel 2.4; I supposed
    iptables new code replace totally old ipchains code. Any feedback
    about it would be useful.

2) Below I enclosed a link to an article from Harald Welte "The journey
    of a packet through the linux 2.4 network stack"; it could help to the
    discussion and getting an improved diagram, if it's possible.

    http://www.gnumonks.org/ftp/pub/doc/packet-journey-2.4.html

3) TODO: include LVS in the diagram. Julian give us this link to study the
    issue and trying to complete the diagram.

    http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO-19.html#ss19.21

4) Of course, diagram is ready to be shoot it off. Any comment, criticism,
    etc,. is welcome.

Best regards,

Leonardo Balliache



                                     Network
                             -----------+-----------
                                        |
                                +-------+------+
                                |    mangle    |
                                |  PREROUTING  | <- MARK REWRITE
                                +-------+------+
                                        |
                                +-------+------+
                                |      nat     |
                                |  PREROUTING  | <- DEST REWRITE
                                +-------+------+
                                        |
                                +-------+------+
                                |   ipchains   |
                                |    FILTER    |
                                +-------+------+
                                        |
                                +-------+------+
                                |     QOS      |
                                |   INGRESS    | <- controlled by tc
                                +-------+------+
                                        |
                 packet is for  +-------+------+ packet is for
                 this address   |     INPUT    | another address
                 +--------------+    ROUTING   +---------------+
                 |              |    + PRDB    |               |
                 |              +--------------+               |
         +-------+------+                                      |
         |    filter    |                                      |
         |    INPUT     |                                      |
         +-------+------+                                      |
                 |                                             |
         +-------+------+                                      |
         |    Local     |                                      |
         |   Process    |                                      |
         +-------+------+                                      |
                 |                                             |
         +-------+------+                                      |
         |    OUTPUT    |                              +-------+-------+
         |    ROUTING   |                              |    filter     |
         +-------+------+                              |    FORWARD    |
                 |                                     +-------+-------+
         +-------+------+                                      |
         |    mangle    |                                      |
         |    OUTPUT    | MARK REWRITE                         |
         +-------+------+                                      |
                 |                                             |
         +-------+------+                                      |
         |     nat      |                                      |
         |    OUTPUT    | DEST REWRITE                         |
         +-------+------+                                      |
                 |                                             |
         +-------+------+                                      |
         |    filter    |                                      |
         |    OUTPUT    |                                      |
         +-------+------+                                      |
                 |                                             |
                 +----------------+       +--------------------+
                                  |       |
                               +--+-------+---+
                               |   ipchains   |
                               |    FILTER    |
                               +-------+------+
                                       |
                               +-------+------+
                               |     nat      |
                               | POSTROUTING  | SOURCE REWRITE
                               +-------+------+
                                       |
                               +-------+------+
                               |     QOS      |
                               |    EGRESS    | <- controlled by tc
                               +-------+------+
                                       |
                            -----------+-----------
                                    Network


Notes:

1) The input routing determines local/forward.
2) ip rule (policy routing database PRDB) is input routing, more correctly,
    part of the input routing.
3) The output routing is performed from "higher layer".
4) nexthop and output device are determined both from the input and the
    output routing.
5) The forwarding process is called at input routing by functions from
    specific place in the code. It executes after input routing and does not
    perform nexthop/outdev selection. It's the process of receiving and
    sending the same packet but in the context of all these hooks the code
    that sends ICMP redirects (demanded from input routing), decs the IP TTL,
    performs dumb NAT and calls the filter chain. This code is used only for
    forwarded packets.
6) Sometimes the word "Forwarding" with "big F", is used for referencing both,
    the routing and forwarding process.


_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/