netdev
[Top] [All Lists]

Re: PROBLEM: Netfilter inconsistency?

To: Ulrich Mohr <ue2m@xxxxxxxxxxxxxxxxxxx>
Subject: Re: PROBLEM: Netfilter inconsistency?
From: Harald Welte <laforge@xxxxxxxxxxxx>
Date: Fri, 15 Feb 2002 08:43:13 +0100
Cc: linux-kernel@xxxxxxxxxxxxxxx, David Miller <davem@xxxxxxxxxx>, Netfilter Development Mailinglist <netfilter-devel@xxxxxxxxxxxxxxx>, netdev@xxxxxxxxxxx
In-reply-to: <Pine.HPX.4.44.0202150031110.27588-200000@xxxxxxxxxxxxxxxxxxxxxxxxxxx>; from ue2m@xxxxxxxxxxxxxxxxxxx on Fri, Feb 15, 2002 at 01:01:49AM +0100
Mail-followup-to: Harald Welte <laforge@xxxxxxxxxxxx>, Ulrich Mohr <ue2m@xxxxxxxxxxxxxxxxxxx>, linux-kernel@xxxxxxxxxxxxxxx, David Miller <davem@xxxxxxxxxx>, Netfilter Development Mailinglist <netfilter-devel@xxxxxxxxxxxxxxx>, netdev@xxxxxxxxxxx
References: <Pine.HPX.4.44.0202150031110.27588-200000@xxxxxxxxxxxxxxxxxxxxxxxxxxx>
Sender: owner-netdev@xxxxxxxxxxx
User-agent: Mutt/1.3.17i
On Fri, Feb 15, 2002 at 01:01:49AM +0100, Ulrich Mohr wrote:

Hi!

> When the LOCAL_OUT hook is called via ip_build_and_send_packet or
> ip_build_xmit, then ip_select_ident is called prior to the call to
> the LOCAL_OUT hook and will not change after the call to the hook.
> 
> When the LOCAL_OUT hook is called via ip_queue_xmit, then the
> ip_select_ident is called after the call to the netfilter hook, and
> the value of the id field in the ip-header changes after a reinject.
> 
[...]

> I tried to make the call to ip_select_ident before the hooks are called,
> and I did not see any side effects (the if field was set directly after
> the hook was called anyway on all execution paths, and it did not depend
> on any information which was not present prior to the hook was called).
> http, scp, ftp & icmp are working fine with this modification.

>From a netfiler point of view I don't see any problems with your approach,
and in fact it seems cleaner to have a consistent behaviour with regard
to the id field.

But since the change is not inside the netfilter code, but in the core
networking, it's up to the core networking maintainers to decide if this
patch is acceptable or might break something.
> 
> I insert the patch I did to ip_output.c on Kernel v. 2.4.10.

Please always use unified diff - it's difficult to understand your patch
just from reading it since it doesn't contain context (diff -u)

> Thank you,
>       Uli

-- 
Live long and prosper
- Harald Welte / laforge@xxxxxxxxxxxx               http://www.gnumonks.org/
============================================================================
GCS/E/IT d- s-: a-- C+++ UL++++$ P+++ L++++$ E--- W- N++ o? K- w--- O- M+ 
V-- PS++ PE-- Y++ PGP++ t+ 5-- !X !R tv-- b+++ !DI !D G+ e* h--- r++ y+(*)

<Prev in Thread] Current Thread [Next in Thread>
  • Re: PROBLEM: Netfilter inconsistency?, Harald Welte <=