Re: Re-routing packets via netfilter (ip_rt_bug)

From: Herbert Xu (herbert_at_gondor.apana.org.au)
Date: 04/27/05

  • Next message: H. Peter Anvin: "Re: Mercurial 0.3 vs git benchmarks" 
    Date:	Wed, 27 Apr 2005 09:28:57 +1000
To: Patrick McHardy <kaber@trash.net>

    On Tue, Apr 26, 2005 at 03:17:27PM +0200, Patrick McHardy wrote:
    >
    > Looks like we have no choice but to also use saddr=0 and
    > ip_route_output() in this case.

    Let's look at the bigger picture. There are three users of
    ip_route_me_harder: nat, mangle and queue. They're all done
    in LOCAL_OUT.

    For nat/mangle, the source address cannot change so it's
    guaranteed to be a local IP address. On the face of it,
    queue could be changing the source address. However, the
    more I think about it the more I reckon that it should
    be disallowed.

    If the user is changing the source address in LOCAL_OUT/queue
    then he's doing SNAT in LOCAL_OUT. This violates some fundamental
    assumptions in netfilter. The user also isn't going to have
    an easy time setting up the reverse DNAT since the corresponding
    location on the reverse side does not have a ip_route_me_harder
    call.

    Even if there is really a demand for SNAT in LOCAL_OUT, we
    should probably be implementing it properly rather than having
    the user craft their own in user-space.

    Cheers, 

    -- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/
  • Next message: H. Peter Anvin: "Re: Mercurial 0.3 vs git benchmarks"

    Relevant Pages