Linux Kernel - Advanced Topics: Networking
Duration: 3 days

Target Audience Developers with knowledge of the Linux Kernel (as provided by the Linux Kernel Programming course, or equivalent)
Synopsis Go deeper into the Linux Kernel - by getting to know its networking subsystem. In-Depth coverage of the networking stack, focusing on Ethernet, IPv4 and IPv6 processing. Additional discussion of the routing subsystem, NetFilter/IPTables and NetLink sockets. Meant as a follow-up to the Linux Kernel Programming course.
Prerequisites Linux Kernel Programming, as per the course or its equivalent, is vital, as this course picks up where it left off, and builds upon it. Knowledge of Linux at a user level, and user mode programming. Familiarity with POSIX is highly recommended, at the very least BSD sockets. Knowledge of
Objectives
  • Describe the architecture of the Linux networking stack
  • Know the Linux Networking stack at the source code level
  • Explain the path of network packets take - from the interface level to the socket level and back - through the various Kernel handlers
  • Create a fully functional IP filtering driver using NetFilter
  • Explain, interface with and hook socket API calls
Exercises This course allocates plenty of time for hands-on practice.
The hands-on exercises include:
  • Creating a fullly functional NetFilter Hook
  • Intercepting BSD socket API calls from the Kernel level
  • Manipulation of live TCP/IP packets
Modules
1. The Linux Networking Stack
4 hours
A brief review of the Linux Networking stack, and fundamental Kernel concepts we build the rest of the course on. Topics include:
  • BSD Socket API from user mode - refresher
    • Review of system call mechanism in Linux, focusing on User/Kernel mode traversal
      • Interrupt Handlers and SoftIRQs in the Kernel
        2. Down the Rabbit Hole
        2 hours
        		Implementation of the BSD Socket API, and following the path of data from the socket to the network
        • Key Kernel structures:
          • Struct sk
            • Struct sk_buff
              • Struct proto
                • Struct inet_protocol
                3. Up The Rabbit Hole
                4 hours
                		Following the path data takes from its initial reception as individual packets, through routing decisions and up to the socket level. We focus in depth on the standard Linux Ethernet 10/100/1000 driver
                  • The Network Interrupt Handler
                    • NAPI
                      • net_rx_action()
                        • netif_receive_skb()
                          • ip_rcv()
                            • udp/tcp_v4_rcv()
                              4. NetFilter
                              2 hours
                              		NetFilter/IPTables is the Linux Kernel built-in packet filtering/firewall mechanism. Implemented as a series of callbacks in key points throughout the packet processing mechanism, it allows developers to hook packets along the processing path.
                              • Explaining NetFilter
                                • IPTables
                                  • Hook locations:
                                    • NF_IP_PRE_ROUTING
                                      • NF_IP_LOCAL_IN
                                        • NF_IP_FORWARD
                                          • NF_IP_LOCAL_OUT
                                            • NF_IP_POST_ROUTING
                                            • Registering custom hooks
                                              5. Linux as a Bridge
                                              2 hours
                                              		Detailed discussion of Linux bridging functionality, exposed by CONFIG_BRIDGE. Bridging splits off from normal packet processing when the MAC address of a frame is discovered to be different from the host's own.
                                              • Bridging Logic
                                                • br_input and br_handle_frame
                                                  • Handling VLANs
                                                    • NetFilter/EBTables
                                                      6. The Routing Subsystem
                                                      4 hours
                                                      		Focusing on the routing architecture of the Linux Kernel, we discuss Linux's internal maintenance of IPv4 and IPv6 routing tables, including:
                                                      • Routing Table implementation
                                                        • Forwarding Information Base (FIB) and fib_rules
                                                          • Efficient lookup of next hops
                                                            • NetLink Routing Sockets