Linux Networking (III)

Today's Lecture

• Linux Networking
  • Netfilter
  • Input Chains

Netfilter

• A framework for packet mangling in kernel
• Hooks
  • Network stacks provides "hooks" in its input/output chains
  • Module (who wants to mangle the packets) registers to be called at those "hooks"
  • When a packet reaches a "hook" in the input/output chain, it is passed to the registered module
• Each protocol family can have different "hooks"
  • IPv4: 5 hooks

Netfilter Hooks (IPv4)

Netfilter Hook Function

• NF_HOOK macro:
  • NF_HOOK(pf, hook, skb, indev, outdev, okfn)
• For each registered module under the hook nf_hooks[pf][hook]
  • Pass the packet to the module and wait for the "verdict"
  • If verdict is drop, drop the packet
  • If verdict is okay, continue next module
• If final verdict is okay, call okfn(skb)

More About Netfilter

• Applications
  • Packet filter: firewall
  • Packet mangling: NAT, private network
  • Traffic control: QoS
• Documentation:
  • URL: http://netfilter.samba.org/documentation/

IP Output (UDP)

• sys_send() calls sock_sendmsg()
• Then calls inet_sendmsg()
• Then calls udp_sendmsg()
  • Find the route to destination at rt
• Then calls ip_build_xmit()
  • Allocate skb (sk_buff)
  • Get the fragment from user space
• Then send out with NF hooks
  • NF_HOOK(PF_INET, NF_IP_LOCAL_OUT, skb, NULL, rt->u.dst.dev, output_maybe_reroute);

Route Table Structure

• rt: of type struct rtable
• rt->u.dst: of type struct dst_entry, with fields:
  • struct net_device *dev;
  • int (*input)(struct sk_buff*);
  • int (*output)(struct sk_buff*);
  • ...
• rt->u.dst.output() functions:
  • ip_output(), ip_mc_output(), ip_rt_bug()
• rt->u.dst.input() functions
  • ip_local_deliver(), ip_mr_input(), ip_forward(), ...

Last Step in IP Output

• ip_build_xmit()
  • Duplicates rt->u.dst to skb->dst
  • Calls NF_HOOK(...)
• Then calls output_maybe_reroute(skb)
  • Calls skb->dst->output(skb)
  • For okay unicast route: rt->u.dst.output ==> ip_output
• ip_output()
  • calls ip_finish_output(), which calls
  • NF_HOOK(PF_INET, NF_IP_POST_ROUTING, skb, NULL, dev, ip_finish_output2)

Interface with Device Driver

• ip_finish_output2()
  • calls skb->hh->hh_output()
  • or skb->neigh->output()
  • Eventually, calls dev_queue_xmit()
• dev_queue_xmit()

  spin_lock_bh(&dev->queue_lock);
  q->enqueue(skb, q);
  qdisc_run(dev);	// kick the device!
  spin_unlock_bh(&dev->queue_lock);
  

Start from Input Chain

• sys_recvfrom() calls sock_recvmsg()
  • Save user buffer address ubuf in msg.msg_iov
• sock_recvmsg() calls sock->ops->recvmsg()
  • Which is inet_recvmsg() (for PF_INET)
• inet_recvmsg() calls sk->prot->recvmsg()
  • Which is udp_recvmsg() (for UDP)
• udp_recvmsg()
  • Calls skb_recv_datagram()
  • Copy datagram to user space (msg->msg_iov)

Receive Function From the Top

• skb_recv_datagram()

  	do {
  		skb = skb_dequeue(&sk->receive_queue);
  	} while (wait_for_packet(sk, err, &timeo) == 0);
  

• skb_dequeue()
  • Return first in the queue, or NULL if empty
• wait_for_packet()
  • Put this process into the sk->sleep wait queue, and give up CPU (set to TASK_INTERRUPTIBLE)
  • Upon return: remove from sk->sleep and set process to TASK_RUNNING

Input Chain from the Bottom

• Upon packet arrival, the network stack should
  • Put the packet onto sk->receive_queue
  • Wake up processes in sk->sleep queue
• Starting point: interrupt handling in a network device driver
  • Pull the packet from the device
  • Allocate a sk_buff
  • Calls netif_rx(skb)
  • Examine it with a simple driver: drivers/net/3c501.c

netif_rx()

• int netif_rx(struct sk_buff *skb)
  • Check for packet backlogs
  • Add skb to this CPU's input packet queue (softnet_data[this_cpu]->input_pkt_queue)
  • Raise soft irq (NET_RX_SOFTIRQ) on this CPU
• NET_RX_SOFTIRQ handler: net_rx_action()
  • Called by scheduler to execute later
• net_rx_action()
  • For each packet in the input packet queue (backlog),
  • Find the matching packet type (pt) and call the corresponding function pt->func(skb, skb->dev, pt)

Registering Packet Type

• The list of packet types we can handle
  • IP, IPX, IPv6, ...
• Data type: struct packet_type
  • unsigned short type
  • int (*func) (...)
• To register a new type: dev_add_pack(struct packet_type *)
  • Ex: ip_init() calls dev_add_pack(&ip_packet_type)
  • ip_packet_type.func is ip_rcv()

IP Input

• ip_rcv()
  • Checks the IP header, then calls
  • NF_HOOK(PF_INET, NF_IP_PRE_ROUTING, skb, dev, NULL, ip_rcv_finish)
• ip_rcv_finish()
  • Checks the route table
  • Call skb->dst->input(skb), which is ip_local_delivery() for incoming unicast
• ip_local_delivery(skb) calls
  • NF_HOOK(PF_INET, NF_IP_LOCAL_IN, skb, skb->dev, NULL, ip_local_deliver_finish)

Demultiplexing

• ip_local_deliver_finish()
  • Find the protocol type from inet_protos[ ]
  • Calls ipprot->handler(skb)
• Protocol type: struct inet_protocol
  • Important field: int (*handler)(struct sk_buff *skb)
  • For UDP: handler() is udp_rcv()
  • To register a new protocol: call inet_add_protocol()
  • inet_init() calls inet_add_protocol() and adds all supported protocols (UDP, TCP, ICMP, IGMP)

UDP Receive

• udp_rcv()
  • Look up the corresponding socket structure (sk)
  • Calls udp_queue_rcv_skb(sk,skb)
• Which calls sock_queue_rcv_skb(sk,skb)
• Which calls
  • skb_queue_tail(&sk->receive_queue, skb)
  • sk->data_ready(sk,skb->len)
• sk->data_ready() is sock_def_readable()
  • Wake up process in sk->sleep queue

Example with UDP