netdev - Re: [RFC PATCH 5/5] openvswitch: Interface with NAT.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20151021093459.GA31323@breakpoint.cc>
Date:	Wed, 21 Oct 2015 11:34:59 +0200
From:	Florian Westphal <fw@...len.de>
To:	Jarno Rajahalme <jrajahalme@...ira.com>
Cc:	netdev@...r.kernel.org, dev@...nvswitch.org
Subject: Re: [RFC PATCH 5/5] openvswitch: Interface with NAT.

Jarno Rajahalme <jrajahalme@...ira.com> wrote:
> Extend OVS conntrack interface to cover NAT.  New nested
> OVS_CT_ATTR_NAT may be used to include NAT with a CT action.  A bare
> OVS_CT_ATTR_NAT only mangles existing connections.  If
> OVS_NAT_ATTR_SRC or OVS_NAT_ATTR_DST is included within the nested
> attributes, new (non-committed/non-confirmed) connections are mangled
> according to the rest of the nested attributes.
> 
> This work extends on a branch by Thomas Graf at
> https://github.com/tgraf/ovs/tree/nat.
> 
> Signed-off-by: Jarno Rajahalme <jrajahalme@...ira.com>
> ---
>  include/uapi/linux/openvswitch.h |  48 +++-
>  net/openvswitch/actions.c        |  25 +-
>  net/openvswitch/conntrack.c      | 543 ++++++++++++++++++++++++++++++++++++---
>  net/openvswitch/conntrack.h      |   2 +
>  net/openvswitch/flow.h           |  11 +-
>  5 files changed, 580 insertions(+), 49 deletions(-)
> 
> diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h
> index 098d8b5..9d63472 100644
> --- a/include/uapi/linux/openvswitch.h
> +++ b/include/uapi/linux/openvswitch.h
> @@ -454,6 +454,12 @@ struct ovs_key_ct_label {
>  #define OVS_CS_F_REPLY_DIR         0x08 /* Flow is in the reply direction. */
>  #define OVS_CS_F_INVALID           0x10 /* Could not track connection. */
>  #define OVS_CS_F_TRACKED           0x20 /* Conntrack has occurred. */
> +#define OVS_CS_F_SRC_NAT           0x40 /* Packet's source address/port was
> +					   mangled by NAT. */
> +#define OVS_CS_F_DST_NAT           0x80 /* Packet's destination address/port
> +					   was mangled by NAT. */

I'm blind -- how does ovs deal with change of output device and the
ether dst mac as result of a l3 dst translation?
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html