netdev
[Top] [All Lists]

Re: netfilter NAT vs. pump

To: Werner Almesberger <almesber@xxxxxxxxxxx>, netdev@xxxxxxxxxxx
Subject: Re: netfilter NAT vs. pump
From: Rusty Russell <rusty@xxxxxxxxxxxxxxxx>
Date: Fri, 16 Jun 2000 18:30:14 +1000
In-reply-to: Your message of "Tue, 13 Jun 2000 22:58:55 +0200." <200006132058.WAA27846@xxxxxxxxxxxxxxxx>
Sender: owner-netdev@xxxxxxxxxxx
In message <200006132058.WAA27846@xxxxxxxxxxxxxxxx> you write:
>      - make it happen less often by setting NFC_ALTERED only when
>        something has changed (probably a good idea in any case)

Yep.  And NAT only makes sense for `simple' stuff anyway; NATting
local src=0.0.0.0 packets is just plain wierd.

This patch is trivial and clean.  Can you test it with unpatched pump?
Also sets NFC_ALTERED in compat layer (which doesn't hook in at
LOCAL_OUT anwyay, so is just me being a pedant).

Cheers,
Rusty.
--- working-2.4.0-test1/net/ipv4/netfilter/ip_nat_standalone.c.~1~      Tue Jun 
 6 00:11:01 2000
+++ working-2.4.0-test1/net/ipv4/netfilter/ip_nat_standalone.c  Fri Jun 16 
18:12:21 2000
@@ -60,8 +60,7 @@
        IP_NF_ASSERT(!((*pskb)->nh.iph->frag_off
                       & __constant_htons(IP_MF|IP_OFFSET)));
 
-       /* FIXME: One day, fill in properly. --RR */
-       (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
+       (*pskb)->nfcache |= NFC_UNKNOWN;
 
        /* If we had a hardware checksum before, it's now invalid */
        if ((*pskb)->pkt_type != PACKET_LOOPBACK)
--- working-2.4.0-test1/net/ipv4/netfilter/ip_nat_core.c.~1~    Tue Jun  6 
00:11:01 2000
+++ working-2.4.0-test1/net/ipv4/netfilter/ip_nat_core.c        Fri Jun 16 
18:16:44 2000
@@ -663,8 +663,10 @@
 static void
 manip_pkt(u_int16_t proto, struct iphdr *iph, size_t len,
          const struct ip_conntrack_manip *manip,
-         enum ip_nat_manip_type maniptype)
+         enum ip_nat_manip_type maniptype,
+         __u32 *nfcache)
 {
+       *nfcache |= NFC_ALTERED;
        find_nat_proto(proto)->manip_pkt(iph, len, manip, maniptype);
 
        if (maniptype == IP_NAT_MANIP_SRC) {
@@ -718,7 +720,8 @@
                                  (*pskb)->nh.iph,
                                  (*pskb)->len,
                                  &info->manips[i].manip,
-                                 info->manips[i].maniptype);
+                                 info->manips[i].maniptype,
+                                 &(*pskb)->nfcache);
                }
        }
        helper = info->helper;
@@ -782,7 +785,8 @@
                        manip_pkt(inner->protocol, inner,
                                  skb->len - ((void *)inner - (void *)iph),
                                  &info->manips[i].manip,
-                                 !info->manips[i].maniptype);
+                                 !info->manips[i].maniptype,
+                                 &skb->nfcache);
                /* Outer packet needs to have IP header NATed like
                    it's a reply. */
                } else if (info->manips[i].direction == dir
@@ -795,7 +799,8 @@
                               IP_PARTS(info->manips[i].manip.ip));
                        manip_pkt(0, iph, skb->len,
                                  &info->manips[i].manip,
-                                 info->manips[i].maniptype);
+                                 info->manips[i].maniptype,
+                                 &skb->nfcache);
                }
        }
        READ_UNLOCK(&ip_nat_lock);
--- working-2.4.0-test1/net/ipv4/netfilter/ip_fw_compat.c.~1~   Fri May 12 
13:22:38 2000
+++ working-2.4.0-test1/net/ipv4/netfilter/ip_fw_compat.c       Fri Jun 16 
18:25:21 2000
@@ -83,7 +83,8 @@
        int ret = FW_BLOCK;
        u_int16_t redirpt;
 
-       (*pskb)->nfcache |= NFC_UNKNOWN;
+       /* Assume worse case: any hook could change packet */
+       (*pskb)->nfcache |= NFC_UNKNOWN | NFC_ALTERED;
        (*pskb)->ip_summed = CHECKSUM_NONE;
 
        switch (hooknum) {

--
Hacking time.

<Prev in Thread] Current Thread [Next in Thread>