netdev - Re: [iproute2] tc action mirred question

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 11 Sep 2009 17:28:44 -0400
From:	jamal <hadi@...erus.ca>
To:	Xiaofei Wu <xiaofei_wu08@...oo.com>
Cc:	linux netdev <netdev@...r.kernel.org>
Subject: Re: [iproute2] tc action mirred    question

On Fri, 2009-09-11 at 11:45 -0700, Xiaofei Wu wrote:
> I run your example ( mirror  lo -> eth0) on Sep. 10th, got almost the same result(in my last email) as yours.
> I think interface 'lo' is very special.
> 
> When I do the following (eth0 -> lo), the results are very strange.
> 1> run 'tc qdisc add dev eth0 handle 1: root prio'
> 
> 2>  tc filter add dev eth0 parent 1: protocol ip prio 10 u32 \
> match ip src 192.168.1.0/32 flowid 1:16 \
> action pedit munge offset -14 u16 set 0x0023 \
> munge offset -12 u32 set 0xcdafecda \
> munge offset -8 u32 set 0x0023cdaf \
> munge offset -4 u32 set 0xd0740800 pipe \
> action mirred egress mirror dev lo
> 
> window1  run ' ping 192.168.1.1'
> window2  'tcpdump -i lo -e', I can not capture any packets.
> 

I think you are doing something wrong. Are there really packets
being generated with that source address.
I just did:
----
tc qdisc add dev eth0 handle 1: root prio

tc filter add dev eth0 parent 1: protocol ip prio 10 u32 match ip dst
10.0.0.27 flowid 1:16 action pedit munge offset -14 u16 set 0x0023 munge
offset -12 u32 set 0xcdafecda munge offset -8 u32 set 0x0023cdaf munge
offset -4 u32 set 0xd0740800 pipe action mirred egress mirror dev lo
----

I then ping 10.0.0.27 and i can see the packets on tcpdump lo,

> mirror  lo -> eth0 ok, eth0 -> lo  can not work ???
> 
> 2'> change 'action mirred egress mirror dev lo' to 'action mirred egress mirror dev eth1' ,
> 'tcpdump -i eth1 -e'    also capture nothing.
> Does this mean something wrong with ' action pedit ...' ?   ("offset must be on 32 bit boundaries"?)
> 


Just make sure it all works first. Perhaps you need to run tcpdump with
-n to avoid name lookup or make sure you are not just arping and not
issuing icmp etc.


>  
> >> lo -> eth0
> >> But I want to only modify the dst MAC, src MAC of the mirroring packets, transmit them to next hop. 
> >> (not modify the dst,src MAC of the packets to 'lo').  What should I do?
> 
> >Ok, so modifying then mirroring wont work on ingress;->
> >One thing you can try is first to mirror lo->eth0, then pedit only
> >specific flow on eth0 that came from lo.
> 
> How to do this. Could you show me the example commands?   Thank you.
> 

Add the rule to mirror on lo
Add the rule to pedit for mirrored packet on eth0

cheers,
jamal


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html