From: Balazs Scheidler <bazsi@balabit.hu>
To: Harald Welte <laforge@gnumonks.org>
Cc: Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>
Subject: Re: [BUG] yet another icmp reply transition bug
Date: Thu, 31 Oct 2002 10:49:50 +0100 [thread overview]
Message-ID: <20021031094950.GA2368@balabit.hu> (raw)
In-Reply-To: <20021031101329.K8635@sunbeam.de.gnumonks.org>
On Thu, Oct 31, 2002 at 10:13:29AM +0100, Harald Welte wrote:
> On Wed, Oct 30, 2002 at 07:44:58PM +0100, Balazs Scheidler wrote:
>
> > This is exactly the problem I have posted several times now. (I found it
> > during my tproxy development). I have modified ICMP nat so that the inner
> > packet is translated at the same time the outer packet is. I saw no real
> > reasons to NAT ICMP packets in two phases (other than simmetricity).
>
> Mh. Somehow I never really understdood the implications and the significance
> of your findings. I'm sorry for my ignorance.
no problem.
>
> > When fixing the problem I came up with two solutions:
> >
> > 1) fix opposite_hook, and allow many possible points of inner header
> > translation (e.g. a manip in PREROUTING may mean ICMP reply in
> > POSTROUTING _or_ LOCAL_IN _or_ LOCAL_OUT)
>
> This was my initial idea as well. But it becomes horribly complex and
> looks more like a hack - the kind of code where you need more comments
> than code in order to make it half-way understandable :(
that's what I meant on 'not robust' ;)
>
> > 2) as the first one doesn't seem too robust to me, I fixed the translation
> > and did the whole thing in one step. The inner header is translated at
> > the same time the outer header is translated. I have seen no real use in
> > having the inconsistent (translated outer, and untranslated inner header)
> > packet traverse the IP stack.
>
> This sounds reasonable. The question is: Do we ever have a case where we
> cannot translate both, but still want the packet to be passed on? But
> in case of uncertainty, passing less information is preferred than yet another
> information leak (about internal addresses, ...).
The same manip is applied to both the inner and outer headers. So I think
there's no case when we don't know what to do. (once we have that single
manip)
conntrack happens prior to NAT, so the icmp packet is already taken as
related to a session, conntracking will not be affected.
The only possible problem I see is packet confirmation (a quick look shows
that it doesn't care about ICMP though)
PS: I've been running with this fix applied for ages now, and I saw no
problems.
--
Bazsi
PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1
prev parent reply other threads:[~2002-10-31 9:49 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-29 20:15 [BUG] yet another icmp reply transition bug Harald Welte
2002-10-30 18:44 ` Balazs Scheidler
2002-10-31 9:13 ` Harald Welte
2002-10-31 9:49 ` Balazs Scheidler [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20021031094950.GA2368@balabit.hu \
--to=bazsi@balabit.hu \
--cc=laforge@gnumonks.org \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.