5

When it comes to packet filtering/management I never actually know what is going on inside the kernel. There are so many different tools that act on the packets, either from userspace (modifying kernel-space subsystems) or directly on kernel-space.

Is there any place where each tool documents the interaction with other tools, or where they act. I feel like there should be a diagram somewhere specifying what is going on for people who aren't technical enough to go and read the kernel code.

So here's my example:

A packet is received on one of my network interfaces and I have:

  • UFW
  • iptables
  • IPv4 subsystem (routing)
  • IPVs
  • eBPF

Ok, so I know that UFW is a frontend for iptables, and iptables is a frontend for Netfiler. So now we're on kernel space and our tools are Netfiler, IPVs, IPv4 and eBPF.

Again, the interactions between Netfilter and the IPv4 subsystems are easy to find since these are very old (not in a bad way) subsystems, so lack of docs would be very strange. This diagram is an overview of the interaction: enter image description here

But what about IPVs and eBPF? What's the actual order in which kernel subsystems act upon the packets when these two are in the kernel?

I always find amazing people who try to go into the guts and help others understand, for example, http://www.austintek.com/LVS/LVS-HOWTO/HOWTO/LVS-HOWTO.filter_rules.html

But shouldn't this be documented in a more official fashion? I'm not looking for an explanation here as to how these submodules interact, I know I could find it myself by searching. My question is more general as to why is there no official documentation that actually tries to explain what is going on inside these kernel subsystems. Is it documented somewhere that I just don't know of? Is there any reason not to try to explain these tools?

I apologize if I'm not making any sense. I just started learning about these things.

Improve this question
2
  • It's a good question, just not for here. Asking for learning materials is explicitly off-topic. You might want to ask that in stackoverflow for example.
    – Eduardo Trápani
    Jan 26, 2022 at 18:10
  • I don't think I'm asking for learning material. I'm asking where is the official Linux documentation for the networking subsystems. I think the documentation is a very important piece of every project. Asking "where can I find the piece of code that does this in this system" is valid. Asking "where are the docs?" should also be valid. Or "is there any reason why this project has no documentation?"
    – AFP_555
    Jan 26, 2022 at 18:14

1 Answer 1

Reset to default
4

Most folks I know who are working with the Linux network stack use the below diagram (which you can find on Wikipedia under CC BY-SA 3.0 license).

enter image description here

As you can see, in addition to the netfilter hooks, it also documents XFRM processing points and some eBPF hook points. tc eBPF programs would be executed as part of the ingress and egress qdiscs. BPF networking hook points other than XDP and tc (e.g., at the socket level) are not documented here.

As far as I know, IPVS is built on top of netfilter so it wouldn't directly appear here.

Improve this answer
1
  • Nice, I think they tried to build IPVs as a submodule of Netfilter but it didn't work out because of latency issues. Anyways, this is a better image than just the Netfilter diagram. Thank you very much.
    – AFP_555
    Jan 27, 2022 at 6:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .