lkml.org 
[lkml]   [2003]   [Dec]   [3]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
Patches in this message
/
DateWed, 03 Dec 2003 11:30:10 +0100
FromZoran Davidovac <>
SubjectRe: 2.4.23 masquerading broken? key.oif = 0; perhaps in bad position ?
Wilmer van der Gaast wrote:
> For security reasons, I upgraded to 2.4.23 last night. Now, suddenly, IP
> masquerading seems to be broken. When I use SNAT instead of
> masquerading, everything works.
> 
> Unfortunately, I think it's hard to reproduce the problem. Right after
> booting .23 for the first time, everything seemed to be okay. The
> problems started just an hour ago, after having the server running for
> fifteen hours without any problems.
> 
> Unfortunately there's not much more information I can provide. I can
> attach my iptables/rule/route file and keep my machine running in case
> anyone needs/wants more information. For now I'll just stick with SNAT.
> It works good enough for me.
> 
> Just FYI, and maybe someone else will have a similar problem.
> 
> Wilmer v/d Gaast. (not on the list)
I remember problem with masquerade on 2.4.22 and there was included attached 
diff on Slackware 9.1

==========================================================================
# This patch is needed in 2.4.22 or else NAT (masquerade) will not work.
# It fixes the "Rusty's broken brain" error/failure.
===== net/ipv4/netfilter/ipt_MASQUERADE.c 1.6 vs edited =====
--- 1.6/net/ipv4/netfilter/ipt_MASQUERADE.c     Tue Aug 12 11:30:12 2003
+++ edited/net/ipv4/netfilter/ipt_MASQUERADE.c  Thu Aug 28 16:54:15 2003
@@ -90,6 +90,7 @@
  #ifdef CONFIG_IP_ROUTE_FWMARK
         key.fwmark = (*pskb)->nfmark;
  #endif
+       key.oif = 0;
         if (ip_route_output_key(&rt, &key) != 0) {
                  /* Funky routing can do this. */
                  if (net_ratelimit())
==========================================================================
interesting is that 2.4.23 is pached BUT

==========================================================================
         key.tos = RT_TOS((*pskb)->nh.iph->tos)|RTO_CONN;
         key.oif = 0;
#ifdef CONFIG_IP_ROUTE_FWMARK
         key.fwmark = (*pskb)->nfmark;
#endif
         if (ip_route_output_key(&rt, &key) != 0) {
                 /* Funky routing can do this. */
==========================================================================
So problem is there perhaps, anyway edit file or patch it with att, patch
ipt_MASQ.diff


-- 
Zoran Davidovac
# This patch is needed in 2.4.22 or else NAT (masquerade) will not work.
# It fixes the "Rusty's broken brain" error/failure.

===== net/ipv4/netfilter/ipt_MASQUERADE.c 1.6 vs edited =====
--- 1.6/net/ipv4/netfilter/ipt_MASQUERADE.c	Tue Aug 12 11:30:12 2003
+++ edited/net/ipv4/netfilter/ipt_MASQUERADE.c	Thu Aug 28 16:54:15 2003
@@ -90,6 +90,7 @@
 #ifdef CONFIG_IP_ROUTE_FWMARK
 	key.fwmark = (*pskb)->nfmark;
 #endif
+	key.oif = 0;
 	if (ip_route_output_key(&rt, &key) != 0) {
                 /* Funky routing can do this. */
                 if (net_ratelimit())--- ipt_MASQUERADE.c.2.4.23	2003-12-03 11:26:45.000000000 +0100
+++ ipt_MASQUERADE.c	2003-12-03 11:27:22.000000000 +0100
@@ -87,10 +87,10 @@
 	key.dst = (*pskb)->nh.iph->daddr;
 	key.src = 0; /* Unknown: that's what we're trying to establish */
 	key.tos = RT_TOS((*pskb)->nh.iph->tos)|RTO_CONN;
-	key.oif = 0;
 #ifdef CONFIG_IP_ROUTE_FWMARK
 	key.fwmark = (*pskb)->nfmark;
 #endif
+	key.oif = 0;
 	if (ip_route_output_key(&rt, &key) != 0) {
                 /* Funky routing can do this. */
                 if (net_ratelimit())
\
 
 \ /
  Last update: 2005-03-22 12:59    [from the cache]
©2003-2008