lkml.org 
[lkml]   [2003]   [Dec]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patches in this message
/
Date
From
SubjectRe: 2.4.23 masquerading broken? key.oif = 0; perhaps in bad position ?
Wilmer van der Gaast wrote:
> For security reasons, I upgraded to 2.4.23 last night. Now, suddenly, IP
> masquerading seems to be broken. When I use SNAT instead of
> masquerading, everything works.
>
> Unfortunately, I think it's hard to reproduce the problem. Right after
> booting .23 for the first time, everything seemed to be okay. The
> problems started just an hour ago, after having the server running for
> fifteen hours without any problems.
>
> Unfortunately there's not much more information I can provide. I can
> attach my iptables/rule/route file and keep my machine running in case
> anyone needs/wants more information. For now I'll just stick with SNAT.
> It works good enough for me.
>
> Just FYI, and maybe someone else will have a similar problem.
>
> Wilmer v/d Gaast. (not on the list)
I remember problem with masquerade on 2.4.22 and there was included attached
diff on Slackware 9.1


==========================================================================
# This patch is needed in 2.4.22 or else NAT (masquerade) will not work.
# It fixes the "Rusty's broken brain" error/failure.

===== net/ipv4/netfilter/ipt_MASQUERADE.c 1.6 vs edited =====
--- 1.6/net/ipv4/netfilter/ipt_MASQUERADE.c Tue Aug 12 11:30:12 2003
+++ edited/net/ipv4/netfilter/ipt_MASQUERADE.c Thu Aug 28 16:54:15 2003
@@ -90,6 +90,7 @@
#ifdef CONFIG_IP_ROUTE_FWMARK
key.fwmark = (*pskb)->nfmark;
#endif
+ key.oif = 0;
if (ip_route_output_key(&rt, &key) != 0) {
/* Funky routing can do this. */
if (net_ratelimit())
==========================================================================
interesting is that 2.4.23 is pached BUT

==========================================================================
key.tos = RT_TOS((*pskb)->nh.iph->tos)|RTO_CONN;
key.oif = 0;
#ifdef CONFIG_IP_ROUTE_FWMARK
key.fwmark = (*pskb)->nfmark;
#endif
if (ip_route_output_key(&rt, &key) != 0) {
/* Funky routing can do this. */
==========================================================================
So problem is there perhaps, anyway edit file or patch it with att, patch
ipt_MASQ.diff


--
Zoran Davidovac
# This patch is needed in 2.4.22 or else NAT (masquerade) will not work.
# It fixes the "Rusty's broken brain" error/failure.

===== net/ipv4/netfilter/ipt_MASQUERADE.c 1.6 vs edited =====
--- 1.6/net/ipv4/netfilter/ipt_MASQUERADE.c Tue Aug 12 11:30:12 2003
+++ edited/net/ipv4/netfilter/ipt_MASQUERADE.c Thu Aug 28 16:54:15 2003
@@ -90,6 +90,7 @@
#ifdef CONFIG_IP_ROUTE_FWMARK
key.fwmark = (*pskb)->nfmark;
#endif
+ key.oif = 0;
if (ip_route_output_key(&rt, &key) != 0) {
/* Funky routing can do this. */
if (net_ratelimit())--- ipt_MASQUERADE.c.2.4.23 2003-12-03 11:26:45.000000000 +0100
+++ ipt_MASQUERADE.c 2003-12-03 11:27:22.000000000 +0100
@@ -87,10 +87,10 @@
key.dst = (*pskb)->nh.iph->daddr;
key.src = 0; /* Unknown: that's what we're trying to establish */
key.tos = RT_TOS((*pskb)->nh.iph->tos)|RTO_CONN;
- key.oif = 0;
#ifdef CONFIG_IP_ROUTE_FWMARK
key.fwmark = (*pskb)->nfmark;
#endif
+ key.oif = 0;
if (ip_route_output_key(&rt, &key) != 0) {
/* Funky routing can do this. */
if (net_ratelimit())
\
 
 \ /
  Last update: 2005-03-22 13:59    [W:1.048 / U:0.084 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site