netdev - adding nat awareness in routing daemons?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Thu, 27 Oct 2011 09:04:31 +0200
From:	David Täht <dave.taht@...il.com>
To:	netdev@...r.kernel.org, bloat-devel@...ts.bufferbloat.net
Subject: adding nat awareness in routing daemons?

after shooting myself in the foot on this several times in the past 
couple months, I thought I'd ask...

Is there a way to determine generically (in linux at least) if outgoing 
addresses on an interface are being NATTed or not? via netlink? I can 
come up with a way to do this via parsing iptables's nat table but 
that's kind of ugly.

The scenario I have is two (or more) routers with their external 
interfaces connected to a shared ethernet/cable segment. Both do NAT on 
their external interfaces for ipv4 (but don't do nat, at least 
currently, for ipv6). Their private networks are usually connected 
together via various means (mesh mostly), which can fail, and it would 
be nice to be able to add the external connectivity as a fallback 
without having to worry about NAT.

e.g. something like

if (nat_status(&this_interface)) {
         if(this_interface & IPV4_NO_NAT) send_route4_calculations();
         if(this_interface & IPV6_NO_NAT) send_route6_calculations();
}

Where I did myself in on this was in the lab

http://io.lab.bufferbloat.net:8080/

-- 
Dave Täht

View attachment "dave_taht.vcf" of type "text/x-vcard" (205 bytes)