Linux Kernel Architecture

Chapter 12: Networks

ihl:4;

#endif

__u8 tos;

__u16 tot_len;

__u16 id;

__u16 frag_off;

__u8 ttl;

__u8 protocol;

__u16 check;

__u32 saddr;

__u32 daddr;

/*The options start here. */

};

Theip_rcvfunction is the point of entry into the network layer. The onward route of a packet through

the kernel is illustrated in Figure 12-15.

ip_rcv

ip_local_deliver

Routing Forwardingip_forward

Transport Layer (TCP, UDP)

Host to Host Layer (Ethernet, etc.)

Netfilter:

NF_IP_PRE_ROUTING

Netfilter:

NF_IP_LOCAL_IN

Netfilter:

NF_IP_LOCAL_OUT

Netfilter:

NF_IP_FORWARD

Poll Mechanism

Netfilter:

NF_IP_POST_ROUTING

ip_output

ip_queue_xmit

Routing

dev_queue_xmit

Figure 12-15: Route of a packet through the IP layer.

The program flow for send and receive operations is not always separate and may be interleaved if

packets are only forwarded via the computer. The packets are not passed to higher protocol layers (or to

an application) but immediately leave the computer bound for a new destination.

12.8.2 Receiving Packets

Once a packet (respectively, the corresponding socket buffer with appropriately set pointers) has been

forwarded toip_rcv, the information received must be checked to ensure that it is correct. The main

check is that the checksum calculated matches that stored in the header. Other checks include, for

example, whether the packet has at least the size of an IP header and whether the packet is actually

IP Version 4 (IPv6 employs its own receive routine).

After these checks have been made, the kernel does not immediately continue with packet processing but

allows a netfilter hook to be invoked so that the packet data can be manipulated in userspace. A netfilter

hook is a kind of ‘‘hook‘‘ inserted at defined points in the kernel code to enable packets to be manipulated