1. Thomas Graf <tgraf@suug.ch>
Netconf 2006
Thomas Graf

2. Netlink Status Moving towards type safe interface
Tons of bugs got fixed, some of them exploitable

3. Generic Netlink Lacking some documentation
Users: TIPC, taskstats, NetLabel,
TODO:
Conditional dumps, requires interface to access genl hdr/attrs via cb->skb or keep genl_info alive throughout dump iterations
Finalize userspace tools

4. libnl status rtnetlink 90% complete starting to get shipped
near 1.0 release (for real this time)
New Stuff:
genl
xfrm
keep caches up to date based on events

5. Cheap Routing Namespaces
ingress
eth0
local table
/32 mark 1
/32 mark 10
vlan0
vlan1
mark=1
mark=2
route must be added with !NLM_F_EXCL to avoid EEXISTS

6. Cheap Routing Namespaces
egress
table 1
Application
/24 dev vlan0
default via
setsockopt(..., SO_MARK, 1)
table 2
/24 dev vlan1
/24 dev vlan1
default via
rule mark == 1 lookup 1
rule mark == 2 lookup 2

7. SO_MARK similar semantics as SO_PRIORITY inherited to tcp replies
can create sending namespaces by influencing route lookup

8. Virtual Device
ingress
eth0
eth1
vlan0
vlan1
vlan2
tc action mirred
virt0
virt1
Application binds to virt0, assignment is dynamic w/o need
for the application to rebind.

9. skb->mark nfmark has become generic, may just rename it to mark
remove dependency on netfilter
Increases usability due to easier configuration

10. tc action: mark Sets skb->mark to static value
translates selector to mark value
allows to execute expensive selector once and use fast mark selector afterwards

11. Mark support for ifa address
Add mark to struct in_ifaddr/in6_ifaddr
Assigns an address to a namespace
Results in auto generated routes to inherit make

12. Extending Routing Rules
New action FR_ACT_GOTO
Jump to rule <priority> if selector matches
100: from any to any fwmark 0x10 goto 4000
200: from /24 to any UNREACHABLE
300: from any to /16 to any LOOKUP 10
400: from any to any BLACKHOLE
4000: from /24 to any lookup 20
4100: from any to any lookup default

13. Extending Routing Rules
Routing direction based selector
Pass cause of lookup to fib_lookup() (input, output, local_addr_check)
Bitmask in struct fib_rule specifying for which lookups to enable a rule
ip rule add from /24 for INPUT lookup 200

14. Extending Routing Rules
Future Directions
Consider packet data pointer as part of flowi where available to allow basing routing decisions on packet inspection
Attach an ematch tree to a fib rule