netdev - Re: [Bugme-new] [Bug 9812] New: Kernel does not deliver packets going through the INPUT chain even if the app is listening on IN_ADDR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20080125051404.3bbefab3.akpm@linux-foundation.org>
Date:	Fri, 25 Jan 2008 05:14:04 -0800
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	netdev@...r.kernel.org
Cc:	bugme-daemon@...zilla.kernel.org, pawel@...ocz.com
Subject: Re: [Bugme-new] [Bug 9812] New: Kernel does not deliver packets
 going through the INPUT chain even if the app is listening on IN_ADDR_ANY

> On Fri, 25 Jan 2008 03:59:27 -0800 (PST) bugme-daemon@...zilla.kernel.org wrote:
> http://bugzilla.kernel.org/show_bug.cgi?id=9812
> 
>            Summary: Kernel does not deliver packets going through the INPUT
>                     chain even if the app is listening on IN_ADDR_ANY
>            Product: Networking
>            Version: 2.5
>      KernelVersion: 2.6.22-14
>           Platform: All
>         OS/Version: Linux
>               Tree: Mainline
>             Status: NEW
>           Severity: normal
>           Priority: P1
>          Component: Netfilter/Iptables
>         AssignedTo: networking_netfilter-iptables@...nel-bugs.osdl.org
>         ReportedBy: pawel@...ocz.com
> 
> 
> Latest working kernel version: never worked
> Earliest failing kernel version:
> Distribution: ubuntu 7.10
> 
> Problem Description:
> 
> I have a farm of web servers behind a load balancer in DSR mode.
> I would like to be able to dump packets with any IP address on the web servers
> through the load balancer and have web servers reply to these requests.
> Currently for every IP web servers are supposed to reply to, I have to
> configure the IP on all servers on their loopback interfaces. The web server
> listens on IN_ADDR_ANY and I am forcing packets into the INPUT chain via
> iptables/netfilter but the kernel never replies to any connection requests. I
> only see the counter for OutNoRoutes increasing.
> 
> Steps to reproduce:
> 
> web server:
> 
> #iptables -A PREROUTING -i eth0 -t mangle -p tcp --dport 80 -j MARK --set-mark
> 1 
> #ip route add to local default dev lo protocol kernel table 1
> #ip rule add fwmark 1 table 1 priority 1
> 
> client:
> 
> #ip route add 1.1.1.1/32 via <web server IP> dev eth0
> 
> while making requests to 1.1.1.1:80 from the client you can see increasing
> OutNoRoutes counter but no connection ever takes place.
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html