netdev - Re: [PATCH] NAT and requests to unrouted targets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <45F90905.4000408@trash.net>
Date:	Thu, 15 Mar 2007 09:51:17 +0100
From:	Patrick McHardy <kaber@...sh.net>
To:	Martin Schiller <mschiller@....de>
CC:	netdev@...r.kernel.org,
	Netfilter Development Mailinglist 
	<netfilter-devel@...ts.netfilter.org>
Subject: Re: [PATCH] NAT and requests to unrouted targets

Martin Schiller wrote:
> This patch changes the behaivor of the iptables nat module to the style
> before release 2.6.16 so it is possible again to use the "ping -I <iface>
> <target>" command to send icmp requests to a target for which no route
> exists.

Please attach patches inline and send netfilter related patches to
netfilter-devel@...ts.netfilter.org.

Quoted for reference:

diff -uNpr linux-2.6.19.org/net/ipv4/netfilter/ip_nat_standalone.c
linux-2.6.19/net/ipv4/netfilter/ip_nat_standalone.c
--- linux-2.6.19.org/net/ipv4/netfilter/ip_nat_standalone.c
2006-11-29 22:57:37.000000000 +0100
+++ linux-2.6.19/net/ipv4/netfilter/ip_nat_standalone.c 2007-03-15
08:25:11.000000000 +0100
@@ -191,11 +191,13 @@ ip_nat_in(unsigned int hooknum,
           int (*okfn)(struct sk_buff *))
 {
        unsigned int ret;
+       __be32 saddr = (*pskb)->nh.iph->saddr;
        __be32 daddr = (*pskb)->nh.iph->daddr;

        ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
        if (ret != NF_DROP && ret != NF_STOLEN
-           && daddr != (*pskb)->nh.iph->daddr) {
+           && ((*pskb)->nh.iph->saddr != saddr
+               || (*pskb)->nh.iph->daddr != daddr)) {
                dst_release((*pskb)->dst);
                (*pskb)->dst = NULL;
        }

I don't see how this would change anything, the PRE_ROUTING hook
doesn't change the source address, so the comparison is unnecessary,
additionally the dst_release is only needed for loopback because
packets received from a real interface don't have a route attached
at this time.

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html