netdev - Re: Funny Routing change since 2.6.16.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 07 Feb 2007 18:07:03 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Ingo Oeser <netdev@...eo.de>
CC:	netdev@...r.kernel.org
Subject: Re: Funny Routing change since 2.6.16.x

Ingo Oeser wrote:
> Dear network gurus,
> 
> I used to change the source address on an PPPoE connection by using
> these commands:
> 
> /sbin/ifconfig ppp0:1 $SRCADDR
> /sbin/ip route add default dev ppp0 src $SRCADDR
> 
> where SRCADDR is an address in a different network
> than the local and peer address for ppp0.
> 
> That works fine until Linux 2.6.13.1.
> 
> When I use Kernel 2.6.16.32, 2.6.19.2 or 2.6.19.3
> this stops working.
> 
> Funnily it WORKS, when the machine just has to answer.
> It DOESN'T work, when the machine initiates an connection.
> 
> I verified that on the receiving side of a ping with tcpdump.
> 
> I also verified that "ip route get $OTHER_HOST" would use the route 
> with src address  set to "SRCADDR" from above.
> 
> I tried using a default route like "ip route add default via $GATEWAY src $SRCADDR",
> but that doesn't work either.
> 
> I attached the config for the old working kernel and the 2.6.19.3 config
> for reference.
> 
> We noticed no problems with ethernet alias interfaces.
> 
> The (production) machine is a PC doing SNAT, DNAT, MASQUERADE 
> and iptables based stateful inspection firewalling. Policy routing is 
> compiled in, but not used at all.
> 
> If you need the iptables rules anyway, just tell me.

My guess is that you're using MASQUERADE on ppp0, which since 2.6.14
doesn't exclude locally generated packets anymore, so it translates
them to the primary ppp0 address. For replies it works because NAT
is already set up for the incoming packet, without masquerading.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html