lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 15 Mar 2007 09:51:17 +0100 From: Patrick McHardy <kaber@...sh.net> To: Martin Schiller <mschiller@....de> CC: netdev@...r.kernel.org, Netfilter Development Mailinglist <netfilter-devel@...ts.netfilter.org> Subject: Re: [PATCH] NAT and requests to unrouted targets Martin Schiller wrote: > This patch changes the behaivor of the iptables nat module to the style > before release 2.6.16 so it is possible again to use the "ping -I <iface> > <target>" command to send icmp requests to a target for which no route > exists. Please attach patches inline and send netfilter related patches to netfilter-devel@...ts.netfilter.org. Quoted for reference: diff -uNpr linux-2.6.19.org/net/ipv4/netfilter/ip_nat_standalone.c linux-2.6.19/net/ipv4/netfilter/ip_nat_standalone.c --- linux-2.6.19.org/net/ipv4/netfilter/ip_nat_standalone.c 2006-11-29 22:57:37.000000000 +0100 +++ linux-2.6.19/net/ipv4/netfilter/ip_nat_standalone.c 2007-03-15 08:25:11.000000000 +0100 @@ -191,11 +191,13 @@ ip_nat_in(unsigned int hooknum, int (*okfn)(struct sk_buff *)) { unsigned int ret; + __be32 saddr = (*pskb)->nh.iph->saddr; __be32 daddr = (*pskb)->nh.iph->daddr; ret = ip_nat_fn(hooknum, pskb, in, out, okfn); if (ret != NF_DROP && ret != NF_STOLEN - && daddr != (*pskb)->nh.iph->daddr) { + && ((*pskb)->nh.iph->saddr != saddr + || (*pskb)->nh.iph->daddr != daddr)) { dst_release((*pskb)->dst); (*pskb)->dst = NULL; } I don't see how this would change anything, the PRE_ROUTING hook doesn't change the source address, so the comparison is unnecessary, additionally the dst_release is only needed for loopback because packets received from a real interface don't have a route attached at this time. - To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists