netdev - Re: stateless nat *please* tell me how I'm supposed to use it

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <4DDA4F34.8070309@slagter.name>
Date:	Mon, 23 May 2011 14:12:36 +0200
From:	Erik Slagter <erik@...gter.name>
To:	netdev@...r.kernel.org
CC:	rpartearroyo@...entia.com
Subject: Re: stateless nat *please* tell me how I'm supposed to use it

Hi everybody,

I am a little disappointed that nobody can or wants to tell me how
stateless nat is supposed to be used. As no other documentation exists
on this subject, this gives the impression this knowledge is a secret?

For people that run into the same problem, I can tell that I've found
the solution, with help from Rodrigo Partearroyo González. The key is
that packet munging on this level is only useful if performed before
routing and as the (normal) egress qdisc is called only just before the
handing the packet to the device, the stateless nat is performed by the
"ingress" qdisc and so the nat action / filter needs to be attached to
the, to be added, tc ingress qdisc. And then it works, e.g.

tc qdisc add dev eth0 ingress
tc filter add dev eth0 parent ffff: protocol ip prio 10 u32 match ip src
1.2.3.4 action nat egress 1.2.3.4/32 5.6.7.8

I guess the "pedit" and related actions work alike.

Now I am still wondering what the "tc action" syntax is for.

Erik Slagter.

Download attachment "smime.p7s" of type "application/pkcs7-signature" (5110 bytes)