lkml.org 
[lkml]   [1998]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: 2.1.102: ipchains: REJECT does only DENY - network gurus please
On Mon, May 18, 1998 at 08:44:49PM +0200, Steffen Zahn wrote:
> >>>>> "ak" == ak <ak@muc.de> writes:
>
> ak> Masquerading rules don't send ICMP messages.
>
>
> ak> But there is another problem I first did think of. It means that
> ak> Linux 2.1 will never send "normal" DEST_UNREACH/NET_UNREACH
> ak> messages because that code uses icmp_send too. So we need to solve
> ak> it.
>
> That is exactly my problem. In the case of offline operation the server
> also drops all masquerading rules. And even if I don't use firewall
> reject rules and just have no route to a destination B set on the server
> the client A will not get anything back (Network unreachable etc.)
> if A tries to reach B via the server.

Ok, this patch should fix it. Please test it.

It actually fixes two bugs: net_unreach was never send because of a
missing "-" and it allows sending ICMPs in the firewall checks when there
is no route. I replaced the unused RTCF_LOG flag with RTCF_BADROUTE.

Index: linux/include/linux/in_route.h
===================================================================
RCS file: /vger/u4/cvs/linux/include/linux/in_route.h,v
retrieving revision 1.4
diff -u -u -r1.4 linux/include/linux/in_route.h
--- linux/include/linux/in_route.h 05:47:11 1.4
+++ linux/include/linux/in_route.h 20:15:30
@@ -18,7 +18,8 @@
#define RTCF_MASQ 0x00400000
#define RTCF_SNAT 0x00800000
#define RTCF_DOREDIRECT 0x01000000
-#define RTCF_LOG 0x02000000
+/* #define RTCF_LOG 0x02000000 */
+#define RTCF_BADROUTE 0x02000000
#define RTCF_DIRECTSRC 0x04000000
#define RTCF_DNAT 0x08000000
#define RTCF_BROADCAST 0x10000000
Index: linux/net/ipv4/route.c
===================================================================
RCS file: /vger/u4/cvs/linux/net/ipv4/route.c,v
retrieving revision 1.50
diff -u -u -r1.50 linux/net/ipv4/route.c
--- linux/net/ipv4/route.c 06:23:25 1.50
+++ linux/net/ipv4/route.c 20:15:33
@@ -1097,7 +1097,7 @@
rth->u.dst.input= ip_local_deliver;
if (res.type == RTN_UNREACHABLE) {
rth->u.dst.input= ip_error;
- rth->u.dst.error= err;
+ rth->u.dst.error= -err;
}
rth->rt_flags = flags|RTCF_LOCAL;
rth->rt_type = res.type;
@@ -1105,6 +1105,7 @@
return 0;

no_route:
+ flags |= RTCF_BADROUTE;
spec_dst = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE);
res.type = RTN_UNREACHABLE;
goto local_input;
Index: linux/net/ipv4/icmp.c
===================================================================
RCS file: /vger/u4/cvs/linux/net/ipv4/icmp.c,v
retrieving revision 1.41
diff -u -u -r1.41 linux/net/ipv4/icmp.c
--- linux/net/ipv4/icmp.c 22:12:10 1.41
+++ linux/net/ipv4/icmp.c 20:15:34
@@ -539,7 +539,7 @@
*/

saddr = iph->daddr;
- if (!(rt->rt_flags&RTCF_LOCAL))
+ if (!(rt->rt_flags& RTCF_LOCAL) || (rt->rt_flags & RTCF_BADROUTE))
saddr = 0;

tos = icmp_pointers[type].error ?

-Andi

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu

\
 
 \ /
  Last update: 2005-03-22 13:42    [W:0.060 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site