netdev - Re: [BUG / question] in routing rules, some options (e.g. ipproto, sport) cause rules to be ignored in presence of packet marks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6b707dde-c6f0-ca3e-e817-a09c1e6b3f00@yandex.pl>
Date:   Mon, 29 Mar 2021 17:42:25 +0200
From:   Michal Soltys <msoltyspl@...dex.pl>
To:     Linux Netdev List <netdev@...r.kernel.org>,
        David Miller <davem@...emloft.net>
Subject: Re: [BUG / question] in routing rules, some options (e.g. ipproto,
 sport) cause rules to be ignored in presence of packet marks

On 3/28/21 4:05 PM, Michal Soltys wrote:
> Hi,
> 
> iptables -t mangle -A OUTPUT -j MARK --set-mark 1

After some extra checks, the exact same issue happens if we mangle tos 
instead of mark, so ...

iptables -t mangle -A OUTPUT -j TOS --set-tos 0x02

... will cause same routing issues with incorrect output interface being 
set.

Anyway, I've attached 2 scripts setting up namespace with all those cases.

- run setup-host.sh
- then in the namespace: run setup-namespace.sh
- fire up another bash in ns with tcpdump on right1

nc -u -p 1194 1.2.3.4 12345

This will work fine, as the packet will be routed correctly via right2, 
tcpdump will show nothing

Now add in the namespace:

iptables -t mangle -A OUTPUT -j MARK --set-mark 1

or

iptables -t mangle -A OUTPUT -j TOS --set-tos 0x02

Same nc as above - now the packet will go out via right1, using right2's 
address (initial routing decision).

Unrelated issue - while doing the tests I noticed that routing rules 
based on tos have no effect at all for locally generated packets. Will 
make another post about it though.

Download attachment "setup-namespace.sh" of type "application/x-shellscript" (586 bytes)

Download attachment "setup-host.sh" of type "application/x-shellscript" (260 bytes)