Giters

lzh2nix / articles

用 issue 来管理个人博客

Home Page:https://github.com/lzh2nix/articles

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

A Crash Course in Linux Networking

lzh2nix opened this issue · comments

commented

缘起(2023.4.1)

最近在查询 macvlan 相关资料时发现了datahacker.blog 这个站点, 作者整理了很多netwok 相关的资料, 质量也是上乘. 还整理出了一个89页的pdf 来系统的讲解 linux 下的network, 之前遇到 network 相关的问题都是直接查 google 解决问题, 看到这个小册子的时候感觉是应该系统的学习一下这块儿知识了.

back To Top

commented

networking 要解决什么问题(2023.4.2)

linux 下各种网络工具最终要解决的两个问题是:

  • 从本地发出的包应该怎么出去(route)
  • 对接受的包进行怎么样的处理(filter)
    然后整个 networking 的架构都是为这两个目标服务.

back To Top

commented

Linux network 简史(2023.4.2)

Pasted image 20230401221030

其实在目前的 Netfilter 框架中我们依然可以看到 ipfwadm 的影子. IN, OUT, FORWARD chains 依然是 iptables 里面使用最多的chain.

1997 RPDB(Routing Policy DataBase) 诞生也就是我们现在还是一直使用的ip route, ip rule, 以及route ifconfig, netstat的基础.

2000 iptables 正式在 2.3 内核中引入. 在 ipchains 基础上引入了PREROUTING, POSTROUTING以及用户可以自定义chain.

2000 netfilter 在2.4 版本中引入了. 与其说这是一个功能不如说是一套框架, 有一下几个功能:

  • packet filter
  • NAT 转换
  • packet logging
  • userspace packet queueing and packet mangling
  • 提供网络协议栈的hook

2014 3.13 内核中nftables 在内核中正式被引入, 最大的特点是可以直接和内核的netfilter进行交互.
Pasted image 20230402073546

说实话nftables 虽然很牛逼, 但是替换iptables 是在是太难了(遗留代码对其依赖实在是太多了)

back To Top

commented

Network Routes(2023.4.3)

A route informs your server where to find other network devices it wants to talk to, based on the destination network address.

route 信息告诉了服务器怎么路由消息(where), iptables 就是告诉服务器哪些消息可以处理(what).

linux 可以通过 ip route 和route 来管理路由, 不过route 已经处于 deprecated 状态, 实际使用中应尽量使用ip route.

一个packet 的处理流程:
image

具体的Routing 流程:
image

back To Top

commented

RPDB(2023.4.5)

目前linux 都是基于策略的路由 Routing Policy DataBase(RPDB). 通过RPDB将routing 地址, route rules 和route table 给结合起来. 在rule 里定义了路由规则, 被match到之后执行具体的动作, 一个常规网络包的处理流:

image

一条ip rule 规则是由 match filter 和 action 两部分组成
Pasted image 20230405072219

下面是一个常见的ip rule(这里就用fom 和fwmark 规则)

0:      from all lookup local 
100:    from all fwmark 0x10 lookup 131 
200:    from 223.82.64.253 lookup 131 
32766:  from all lookup main 
32767:  from all lookup default

ip Rule 处理流程:

  1. Network packets are processed one at a time
  2. The same rules process both incoming and outgoing packets
  3. Packets are evaluated against a list of rules, in order of priority, beginning with rule 0
  4. First rule matching the packet is executed
  5. If the action is a table lookup and the lookup fails, evaluate the next rule

IP Route 处理流:

  1. The route with the longest matching prefix is chosen
  2. If more than one match is the same length, the route with the best preference values is chosen
  3. If more than one match exists, if ToS is specified, routes that don't match the ToS are dropped
  4. If more than one route still exists, then the first ordered matching route in the list is chosen
  5. If no matching route is found, the kernel returns to the Rule table and moves onto the next rule

系统几个特殊的table(Master Routing Table):

[root@localhost ~]# cat /etc/iproute2/rt_tables
# reserved values
255	local
254	main
253	default
0	unspec
  • local Local and broadcast addresses
  • main Operated on by route and ip route processes; default when no policy specified
  • default Reserved for post-processing rules

Routing table的最佳实践:

  1. Ensure table name and number are both unique!
  2. Do not modify default values in the file
  3. New table references should be numbered between 100 and 200

ip route 命令级别解释:

[root@localhost ~]# ip route
default via 172.16.11.2 dev ens256 proto dhcp src 172.16.11.160 metric 100

从ens256 的 172.16.11.160 出去的包转发给172.16.11.2(网关)

172.16.11.0/24 dev ens256 proto kernel scope link src 172.16.11.160 metric 100

从ens256 的 172.16.11.160 出去然后转发给172.16.11.0/24的包 src ip 设置为172.16.11.160.

具体命令变化规则太多, 可以看man page:
ip route: https://man7.org/linux/man-pages/man8/ip-route.8.html
ip rule: https://man7.org/linux/man-pages/man8/ip-rule.8.html

back To Top