lkml.org 
[lkml]   [2002]   [Aug]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Want to test a patch: H323-masquerading in Linux 2.4 (SuSE 8.0)
    On Mon, Aug 26, 2002 at 10:17:20AM -0600, Thunder from the hill wrote:
    > I've put a patch by David Hildeshagen (url...) at
    > <URL:http://m1b.de/content/know/linux/nat_h323_suse80.html> which was
    > ported to Linux Kernel 2.4.18, as from SuSE 8.0. (I've manually resolved
    > all the rejects.)
    >
    > Works for me. Maybe somebody is interested in testing the whole thing. I'm
    > looking forward to comments.
    >
    > Kind regards, Reinhard.
    >
    > That's the translation, for the interested...

    thanks for the translation. 8)

    I'd like to point out that there are some problems with the H.323 NAT
    modules:

    + for (i = 0; data < (data_limit - 5); data++, i++) {
    + data_ip = *((u_int32_t *)data);
    + if (data_ip == iph->saddr) {
    + data_port = *((u_int16_t *)(data + 4));

    These modules scan byte by byte the packets for source IPs in order
    to perform NAT, and will modify the contained data based on what they
    find.

    Consider the chances of your IP address coming up in some essentially
    random data. For example, if I had the ip address (iirc) 3.0.0.163
    then the effect if the nat modules would be to rewrite the RFC1006
    header which is part of these packets, thereby destroying the packet
    completely. (iirc the 4 byte RFC1006 header on packets leaving me
    contained the values 0x03 0x00 0x00 0xa3; since they'll always start
    with 0x03 0x00 <16-bit len>, anyone using a 3.0.x.x IP address with
    these modules are likely to rewrite the RFC1006 header.)

    My main point here is that given the right IP address and this method
    of "NAT"ing the contained data, any data contained within the packet
    will be altered in some manner causing unexpected failures.

    Unfortunately H.323 is a rather opaque protocol which appears to
    require lots of knowledge about the data contained within the packet
    to decode it properly.

    (Oh, and guess who renumbered their network to eliminate the NAT rather
    than run the H.323 netfilter modules. Umm, and the IETF appear to have
    lost RFC1006 from their web site; either that or Mozilla is getting
    stressed again. However, RFC1006 has been updated by RFC2126 and the
    TPKT header can be found within that document.)

    --
    Russell King (rmk@arm.linux.org.uk) The developer of ARM Linux
    http://www.arm.linux.org.uk/personal/aboutme.html

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-03-22 13:28    [W:3.731 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site