Understanding Linux Network Internals

Executing the Right Protocol Handler

For each network protocol, regardless of its layer, there is one initialization function. This includes L3 protocols such as IPv4 and IPv6, link layer protocols like ARP, and so on. For a protocol included statically in the kernel, the initialization function executes at boot time; for a protocol compiled as a module, the initialization function executes when the module is loaded. The function allocates internal data structures, notifies other subsystems about the protocol's existence, registers files in /proc, and so on. A key task is to register a handler in the kernel that handles the traffic for a protocol.

In this section, for the sake of simplicity, I'll show how a device driver (which operates on L2) invokes an L3 protocol, but the same principle applies to any protocol on any layer.

When the device driver receives a frame, it stores it into an sk_buff buffer data structure and it initializes the protocol field shown here:

struct sk_buff
{
        ... ... ...
        unsigned short  protocol;
        ... ... ...
};

The value in this field can be an arbitrary value used by the kernel to identify a given protocol, or a field of a MAC header in the incoming frame. The field is consulted by

Figure 13-5. Frame decapsulation, layer by layer, at Server Y

the kernel function netif_receive_skb (described in Chapter 10) to determine which function handler to execute to process ...