From: Harald Welte <laforge@gnumonks.org>
To: Balazs Scheidler <bazsi@balabit.hu>
Cc: Netfilter Development Mailinglist <netfilter-devel@lists.netfilter.org>
Subject: Re: [BUG] yet another icmp reply transition bug
Date: Thu, 31 Oct 2002 10:13:29 +0100 [thread overview]
Message-ID: <20021031101329.K8635@sunbeam.de.gnumonks.org> (raw)
In-Reply-To: <20021030184457.GA7720@balabit.hu>; from bazsi@balabit.hu on Wed, Oct 30, 2002 at 07:44:58PM +0100
[-- Attachment #1: Type: text/plain, Size: 2062 bytes --]
On Wed, Oct 30, 2002 at 07:44:58PM +0100, Balazs Scheidler wrote:
> This is exactly the problem I have posted several times now. (I found it
> during my tproxy development). I have modified ICMP nat so that the inner
> packet is translated at the same time the outer packet is. I saw no real
> reasons to NAT ICMP packets in two phases (other than simmetricity).
Mh. Somehow I never really understdood the implications and the significance
of your findings. I'm sorry for my ignorance.
> When fixing the problem I came up with two solutions:
>
> 1) fix opposite_hook, and allow many possible points of inner header
> translation (e.g. a manip in PREROUTING may mean ICMP reply in
> POSTROUTING _or_ LOCAL_IN _or_ LOCAL_OUT)
This was my initial idea as well. But it becomes horribly complex and
looks more like a hack - the kind of code where you need more comments
than code in order to make it half-way understandable :(
> 2) as the first one doesn't seem too robust to me, I fixed the translation
> and did the whole thing in one step. The inner header is translated at
> the same time the outer header is translated. I have seen no real use in
> having the inconsistent (translated outer, and untranslated inner header)
> packet traverse the IP stack.
This sounds reasonable. The question is: Do we ever have a case where we
cannot translate both, but still want the packet to be passed on? But
in case of uncertainty, passing less information is preferred than yet another
information leak (about internal addresses, ...).
> I've posted my fix several times, I'll post it again if you like.
I'll pick it from the archives, thanks.
Expect more comments soon.
> Bazsi
--
Live long and prosper
- Harald Welte / laforge@gnumonks.org http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
as I'm the dictator." -- George W. Bush Dec 18, 2000
[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]
next prev parent reply other threads:[~2002-10-31 9:13 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2002-10-29 20:15 [BUG] yet another icmp reply transition bug Harald Welte
2002-10-30 18:44 ` Balazs Scheidler
2002-10-31 9:13 ` Harald Welte [this message]
2002-10-31 9:49 ` Balazs Scheidler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20021031101329.K8635@sunbeam.de.gnumonks.org \
--to=laforge@gnumonks.org \
--cc=bazsi@balabit.hu \
--cc=netfilter-devel@lists.netfilter.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.