Messages in this thread | | | Date | Wed, 27 Apr 2005 02:56:48 +0200 | From | Patrick McHardy <> | Subject | Re: Re-routing packets via netfilter (ip_rt_bug) |
| |
Herbert Xu wrote: > Let's look at the bigger picture. There are three users of > ip_route_me_harder: nat, mangle and queue. They're all done > in LOCAL_OUT. > > For nat/mangle, the source address cannot change so it's > guaranteed to be a local IP address. On the face of it, > queue could be changing the source address. However, the > more I think about it the more I reckon that it should > be disallowed.
The ipt_REJECT target can send TCP RSTs with foreign source which go through LOCAL_OUT. Restricting it to this case and adding proper checks to ipt_REJECT would relieve us of having to handle the last case you pointed out (foreign saddr, broadcast/multicast daddr), but it shouldn't be hard to also handle this case.
> If the user is changing the source address in LOCAL_OUT/queue > then he's doing SNAT in LOCAL_OUT. This violates some fundamental > assumptions in netfilter. The user also isn't going to have > an easy time setting up the reverse DNAT since the corresponding > location on the reverse side does not have a ip_route_me_harder > call.
These assumptions are only for stateful NAT, the mangle table seems to try to deal with stateless NAT by rerouting in LOCAL_OUT when saddr/daddr changed. But it could also just be some left-over cut-n-pasted from ip_nat_standalone.c, I don't think anyone is doing stateless NAT with netfilter.
Regards Patrick - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |