netdev
[Top] [All Lists]

Re: Re-routing packets via netfilter (ip_rt_bug)

To: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Subject: Re: Re-routing packets via netfilter (ip_rt_bug)
From: Patrick McHardy <kaber@xxxxxxxxx>
Date: Wed, 27 Apr 2005 02:56:48 +0200
Cc: Yair@xxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, netfilter-devel@xxxxxxxxxxxxxxxxxxx, netdev@xxxxxxxxxxx
In-reply-to: <20050426232857.GA18358@gondor.apana.org.au>
References: <E1DQ1Ct-00055s-00@gondolin.me.apana.org.au> <426D0CB9.4060500@trash.net> <20050425213400.GB29288@gondor.apana.org.au> <426D8672.1030001@trash.net> <20050426003925.GA13650@gondor.apana.org.au> <426E3F67.8090006@trash.net> <20050426232857.GA18358@gondor.apana.org.au>
Sender: netdev-bounce@xxxxxxxxxxx
User-agent: Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.7.6) Gecko/20050324 Debian/1.7.6-1
Herbert Xu wrote:
Let's look at the bigger picture.  There are three users of
ip_route_me_harder: nat, mangle and queue.  They're all done
in LOCAL_OUT.

For nat/mangle, the source address cannot change so it's
guaranteed to be a local IP address.  On the face of it,
queue could be changing the source address.  However, the
more I think about it the more I reckon that it should
be disallowed.

The ipt_REJECT target can send TCP RSTs with foreign source which go through LOCAL_OUT. Restricting it to this case and adding proper checks to ipt_REJECT would relieve us of having to handle the last case you pointed out (foreign saddr, broadcast/multicast daddr), but it shouldn't be hard to also handle this case.

If the user is changing the source address in LOCAL_OUT/queue
then he's doing SNAT in LOCAL_OUT.  This violates some fundamental
assumptions in netfilter.  The user also isn't going to have
an easy time setting up the reverse DNAT since the corresponding
location on the reverse side does not have a ip_route_me_harder
call.

These assumptions are only for stateful NAT, the mangle table seems to try to deal with stateless NAT by rerouting in LOCAL_OUT when saddr/daddr changed. But it could also just be some left-over cut-n-pasted from ip_nat_standalone.c, I don't think anyone is doing stateless NAT with netfilter.

Regards
Patrick

<Prev in Thread] Current Thread [Next in Thread>