lkml.org 
[lkml]   [1998]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: 2.1.102: ipchains: REJECT does only DENY - network gurus please
[cc'ed to Alexey Kuznetsov, because he is the routing guru]

On Sun, May 17, 1998 at 04:29:12PM +0200, Steffen Zahn wrote:
> >>>>> "Andi" == Andi Kleen <ak@muc.de> writes:
>
> Andi> What it says - there is no output route for iph->saddr. Can you
> Andi> ping 192.168.0.2? What is the actual value of saddr/iph->saddr
> Andi> on this place?
>
> Yes, I can ping 192.168.0.2 (client taliesin) from 192.168.0.1 (server zahn).
> netstat -r gives:
> Kernel IP routing table
> Destination Gateway Genmask Flags MSS Window irtt Iface
> 192.168.0.0 * 255.255.255.0 U 0 0 0 eth0
>
> May 17 16:15:32 zahn vmunix: icmp_send: ip_route_output(&rt, iph->saddr 200A8C0, saddr 14040C2, RT_TOS(tos), 0)
>
> This means iph->saddr is 192.168.0.2, saddr is 194.64.64.1 .
> 194.64.64.1 was the destination of the original packet that I want
> to reject here.
> There is currently no route to the address 194.64.64.1,
> only when I am connected to my ISP, that is also the reason why I want to
> reject that packet using ipchains.

Why use firewalling at all then? The forwarder will send a DEST_UNREACHable
when it can't find a route automatically. In extreme cases you could use
a reject route.

ip_route_output rejects the packet because it has no route to the source
address. When ip_route_input can't find a route for an incoming packet
it redirects the packets to the local interface and creates a temporary
routing cache entry. This entry has the RTCF_LOCAL flag set. Now icmp.c
has this check:

saddr = iph->daddr;
if (!(rt->rt_flags&RTCF_LOCAL))
saddr = 0;
meaning that saddr will contain the not routable address and when
ip_route_output() sees the martian address it'll return an error and
no ICMP is send.

Possible fixes:
1) Don't do that. With workaround as outlined above [always create routes
for your firewall rules, and use reject routes for the rest]
2) Remove the check from icmp.c. This means icmps in reply to packets for
the local host might carry the wrong source address (of a different interface).
3) Define a new flag RTCF_BADROUTE that is set by ip_route_input in the
no_route case and change the icmp.c check to:

saddr = iph->daddr;
if ((rt->rt_flags & (RTCF_LOCAL|RTCF_BADROUTE)) != RTCF_LOCAL)
saddr = 0;
(3) is probably the best solution, but it is really worth to care
about this weird case? Alexey, what do you mean?

-A.



-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [from the cache]
©2003-2014 Jasper Spaans. Advertise on this site