Re: [PATCH] MASQUERADE handling of device events

[Rusty Russell <rusty@rustcorp.com.au>]

On Tue, 2004-11-23 at 13:16 -0800, Phil Oester wrote:
> On Sun, Nov 21, 2004 at 01:58:28PM +1100, Rusty Russell wrote:
> > The MASQUERADE target use to destroy connections when an interface
> > went down.  We changed this to merely remove the ASSURED bit, and
> > destroy them if the same interface came up with a different IP
> > address.  Unfortunately, as Phil Oester pointed out, that code was
> > crap for PPP connections, since we (1) compared ifa_address instead of
> > ifa_local, (2) identified interfaces by ifindex, which increments as a
> > PPP device downs and ups, and (3) caused all connections to be flushed
> > when we added an IP address.
> > 
> > So that code was reverted after 2.6.10-rc2.
> > 
> > This code stores the interface name, rather than trying to use the
> > ifindex, and only deletes connections if *no* ifa_local on the
> > interface matches the connection, so simply adding a new IP address is
> > a NOOP.
> 
> But even using the interface name is unreliable.  Consider the user who
> uses multiple PPP connections.  Both go down at the same time, and
> come back with the 'old' ppp1 now named ppp0.

Sure, in which case the connections will be dropped, as they would be in
the naive case.  This entire idea is best-effort, like NAT itself 8)

I think it's worth trying, at least, but obviously the core team can
override me.

> Perhaps my original patch which special-cased ppp would be better?

Drawing a link between point-to-point and addresses being static is
wrong, IMHO.

Rusty.
-- 
A bad analogy is like a leaky screwdriver -- Richard Braakman