From: "Jan Coppens" <Jan.Coppens@intec.rug.ac.be>
To: lartc@vger.kernel.org
Subject: Re: [LARTC] kernel packet traveling diagram
Date: Fri, 28 Jun 2002 10:49:43 +0000 [thread overview]
Message-ID: <marc-lartc-102526144225467@msgid-missing> (raw)
In-Reply-To: <marc-lartc-102520121109677@msgid-missing>
----- Original Message -----
From: "Leonardo Balliache" <leoball@opalsoft.net>
To: <lartc@mailman.ds9a.nl>
Sent: Thursday, June 27, 2002 8:02 PM
Subject: [LARTC] kernel packet traveling diagram
> Sorry everyone, I'm late.. always!!
>
> Here is a new version of kernel packet traveling diagram. Thanks a lot
> to Julian Anastasov by his comments (notes at the end as I understood).
>
> I insist it's nice to have this diagram ready and updated. Look that
> when Jan Coppens needed to tell us where he does need to mark packets
> he just said "At this point I should need another mangle table->" using
> the diagram as reference.
>
> We understand that internal kernel code is complex and interlaced and
> not always is possible to identify clearly each part of it in a simple
> diagram. But we keep on trying.
>
> I've got some comments:
>
> 1) I didn't know there was ipchains code in kernel 2.4; I supposed
> iptables new code replace totally old ipchains code. Any feedback
> about it would be useful.
>
> 2) Below I enclosed a link to an article from Harald Welte "The journey
> of a packet through the linux 2.4 network stack"; it could help to the
> discussion and getting an improved diagram, if it's possible.
>
> http://www.gnumonks.org/ftp/pub/doc/packet-journey-2.4.html
>
> 3) TODO: include LVS in the diagram. Julian give us this link to study the
> issue and trying to complete the diagram.
>
>
http://www.linuxvirtualserver.org/Joseph.Mack/HOWTO/LVS-HOWTO-19.html#ss19.2
1
>
> 4) Of course, diagram is ready to be shoot it off. Any comment, criticism,
> etc,. is welcome.
>
> Best regards,
>
> Leonardo Balliache
>
>
>
> Network
> -----------+-----------
> |
> +-------+------+
> | mangle |
> | PREROUTING | <- MARK REWRITE
> +-------+------+
> |
> +-------+------+
> | nat |
> | PREROUTING | <- DEST REWRITE
> +-------+------+
> |
> +-------+------+
> | ipchains |
> | FILTER |
> +-------+------+
> |
> +-------+------+
> | QOS |
> | INGRESS | <- controlled by tc
> +-------+------+
> |
> packet is for +-------+------+ packet is for
> this address | INPUT | another address
> +--------------+ ROUTING +---------------+
> | | + PRDB | |
> | +--------------+ |
> +-------+------+ |
> | filter | |
> | INPUT | |
> +-------+------+ |
> | |
> +-------+------+ |
> | Local | |
> | Process | |
> +-------+------+ |
> | |
> +-------+------+ |
> | OUTPUT | +-------+-------+
> | ROUTING | | filter |
> +-------+------+ | FORWARD |
> | +-------+-------+
> +-------+------+ |
> | mangle | |
> | OUTPUT | MARK REWRITE |
> +-------+------+ |
> | |
> +-------+------+ |
> | nat | |
> | OUTPUT | DEST REWRITE |
> +-------+------+ |
> | |
> +-------+------+ |
> | filter | |
> | OUTPUT | |
> +-------+------+ |
> | |
> +----------------+ +--------------------+
> | |
> +--+-------+---+
> | ipchains |
> | FILTER |
> +-------+------+
> |
> +-------+------+
> | nat |
> | POSTROUTING | SOURCE REWRITE
> +-------+------+
> |
> +-------+------+
> | QOS |
> | EGRESS | <- controlled by tc
> +-------+------+
> |
> -----------+-----------
> Network
>
>
> Notes:
>
> 1) The input routing determines local/forward.
> 2) ip rule (policy routing database PRDB) is input routing, more
correctly,
> part of the input routing.
Are you sure? In the previous diagram, the PRDB was checked before the
packet hits the QOS Ingress. If the PRDB indeed is checked after QOS Ingress
(i.e. in INPUT ROUTING), which seems the logical way, is it possible (with a
patch???) to check the tc_index in "ip rule"? This would make it possible to
let the output of the QOS ingress participate in the policy routing.
FYI, there is a iptables patch out there, called mangle5hooks, so the mangle
table registers all 5 netfilter hooks. This implies that the mangle table
has 5 chains instead of 2, PREROUTING, INPUT, OUTPUT, FORWARD and
POSTROUTING.
Cheers,
Jan
> 3) The output routing is performed from "higher layer".
> 4) nexthop and output device are determined both from the input and the
> output routing.
> 5) The forwarding process is called at input routing by functions from
> specific place in the code. It executes after input routing and does
not
> perform nexthop/outdev selection. It's the process of receiving and
> sending the same packet but in the context of all these hooks the code
> that sends ICMP redirects (demanded from input routing), decs the IP
TTL,
> performs dumb NAT and calls the filter chain. This code is used only
for
> forwarded packets.
> 6) Sometimes the word "Forwarding" with "big F", is used for referencing
both,
> the routing and forwarding process.
>
>
> _______________________________________________
> LARTC mailing list / LARTC@mailman.ds9a.nl
> http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
>
>
_______________________________________________
LARTC mailing list / LARTC@mailman.ds9a.nl
http://mailman.ds9a.nl/mailman/listinfo/lartc HOWTO: http://lartc.org/
next prev parent reply other threads:[~2002-06-28 10:49 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-06-27 18:02 [LARTC] kernel packet traveling diagram Leonardo Balliache
2002-06-27 20:44 ` Julian Anastasov
2002-06-28 8:21 ` Stef Coene
2002-06-28 10:49 ` Jan Coppens [this message]
2002-06-30 20:48 ` Leonardo Balliache
2002-06-30 20:58 ` Leonardo Balliache
2002-09-10 22:35 ` [LARTC] Kernel Packet Traveling Diagram Ciprian Niculescu
2002-09-11 11:15 ` Leonardo Balliache
2002-09-11 18:11 ` Stef Coene
2007-07-02 10:11 ` Edouard Thuleau
2007-07-02 12:04 ` Edouard Thuleau
2007-07-02 12:11 ` nano bug
2007-07-02 12:25 ` Mark
2007-07-02 12:47 ` Frank Remetter
2007-07-02 15:08 ` nano bug
2007-07-03 11:41 ` Edouard Thuleau
2007-07-03 12:16 ` Edouard Thuleau
2007-07-04 0:51 ` Andy Furniss
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=marc-lartc-102526144225467@msgid-missing \
--to=jan.coppens@intec.rug.ac.be \
--cc=lartc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.