KOVACS Krisztian wrote:
> Hi,
>
> On szo, jan 12, 2008 at 11:47:44 +0800, Ming-Ching Tiew wrote:
>
>> 2 ) IP FREEBIND packets spoofed with foreign source address will not
>> leave the system when there is a FWMARK in the mangle table OUTPUT
>> chain. This patch is created by me based on the information given by
>> Kovacs, code quality is highly questionable as I barely understood
>> what's it is all about, but it seems to work.
>>
>> --- linux-2.6.22-org/net/ipv4/netfilter.c 2007-12-13
>> 20:55:45.000000000 +0800
>> +++ linux-2.6.22-new/net/ipv4/netfilter.c 2007-12-13
>> 20:55:03.000000000 +0800
>> @@ -24,7 +24,7 @@
>> /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
>> * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
>> */
>> - if (addr_type == RTN_LOCAL) {
>> +// if (addr_type == RTN_LOCAL) {
>> fl.nl_u.ip4_u.daddr = iph->daddr;
>> if (type == RTN_LOCAL)
>> fl.nl_u.ip4_u.saddr = iph->saddr;
>> @@ -37,10 +37,10 @@
>> /* Drop old route. */
>> dst_release((*pskb)->dst);
>> (*pskb)->dst = &rt->u.dst;
>> - } else {
>> +// } else {
>> /* non-local src, find valid iif to satisfy
>> * rp-filter when calling ip_route_input. */
>> - fl.nl_u.ip4_u.daddr = iph->saddr;
>> +/* fl.nl_u.ip4_u.daddr = iph->saddr;
>> if (ip_route_output_key(&rt, &fl) != 0)
>> return -1;
>>
>> @@ -53,7 +53,7 @@
>> dst_release(&rt->u.dst);
>> dst_release(odst);
>> }
>> -
>> +*/
>> if ((*pskb)->dst->error)
>> return -1;
>>
>
> We should probably first ask on netfilter-devel@ why this whole route
> lookup thing is necessary...
>
>
I sort of just forward this to netfilter-devel.
For those who in netfilter-devel but not in tproxy mail list, a little
background here :-
I discovered after applying the tproxy4 patch which allows one to spoof
originating traffic with a foreign IP address ( for the purpose of doing
transparent proxy ) that after doing it, traffics with foreign IP will
not leave the system if there is a FWMARK in the mangle table OUTPUT
chain. Any MARK will screw up the routing.
And the patch above seems to be able to get the packets out of the machine
again.
So the motivation here perhaps someone here could throw some light as to
how this situation is best handled.
Regards.
-
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
