lkml.org 
[lkml]   [1998]   [Jan]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: 2.0.33: IP MASQ subtly BROKEN
Date
> So whats happening: A subtle bug in IP masquarding is causing the incoming
> packets to be 'demasquarded' on the ppp interface before it crosses the
> firewall, thus causing the tcpdump to lie.

It isnt a bug. The order of the firewall is

Input rule
Masquerading and Forwarding Rule
Output rule

Thats precisely defined.

What is less than perfectly defined in 2.0.x and depends on timing issues
it shouldnt is "what does tcpdump on the box doing the forwarding see". To
get an honest answer look from the outside or use skb_copy not skb_clone
for dumped packets - thats a lot slower but correct. 2.1.x does the
right thing but its not trivial and therefore "safe" to backport.

Note btw that diald doesnt exactly fit the pattern either as it snoops in
different ways on active and inactive links.

Alan


\
 
 \ /
  Last update: 2005-03-22 13:41    [W:0.056 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site