Re: [RFC, PATCH 5/5]: netfilter+ipsec - policy checks

[Alexander Samad <alex@samad.com.au>]

[-- Attachment #1: Type: text/plain, Size: 2610 bytes --]

On Fri, Mar 19, 2004 at 05:31:43PM +1100, Alexander Samad wrote:
> I have applied these to 2.6.4 (debian source) and compiles okay and
> seems to work okay, ie the NAT + IPSEC
> 
> my 2c

Done some more testing and there seems to be a problem with the NAT
table 


Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source
destination
   12   720            all  --  *      *       0.0.0.0/0 192.168.5.2
    0     0 DROP       all  --  *      *       169.254.0.0/16 0.0.0.0/0
54378 5744K ACCEPT     all  --  *      *       0.0.0.0/0 0.0.0.0/0           state NEW

Chain POSTROUTING (policy ACCEPT 6 packets, 240 bytes)
 pkts bytes target     prot opt in     out     source destination
    0     0            all  --  *      *       0.0.0.0/0 192.168.5.2
 2872  537K MASQUERADE  all  --  *      eth0    192.168.8.0/22 0.0.0.0/0
    0     0 MASQUERADE  all  --  *      ppp+    192.168.8.0/22 0.0.0.0/0
 165K   25M ACCEPT     all  --  *      *       0.0.0.0/0 0.0.0.0/0           state NEW

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source destination
    0     0            all  --  *      *       0.0.0.0/0 192.168.5.2
 169K   25M ACCEPT     all  --  *      *       0.0.0.0/0 0.0.0.0/0           state NEW


There is an ipsec tunnel out of eth0 setup like

conn abcd
	leftsubnet 192.168.8.0/22
	rightsubnet 192.168.5.0/24

when I ping from 192.168.10.244 through to 192.168.5.2 it doesn't seem
to it through to POSTROUTING, the counter in PREROUTING increase.

My initial search for this was why I did not need a rule to stop the
MASQ from happening

This is using the 2.6 stack (2.6.4 debain)

Alex

> 
> On Thu, Mar 18, 2004 at 10:19:04PM -0800, David S. Miller wrote:
> > On Thu, 18 Mar 2004 17:32:39 +0100
> > Patrick McHardy <kaber@trash.net> wrote:
> > 
> > > This patch makes xfrm_policy_check locate the correct policy after NAT.
> > > For protocols which do policy checks in their receive routines the
> > > reference to nfct has to be kept until policy checks are done, the
> > > other ones still drop it in ip_local_deliver_finish.
> > 
> > This patch looks fine to me.
> > 
> > Other than the minor comments I've made the most unhappy I am
> > with the input patch, and you agree it's grotty too.  Let's look
> > for a better solution, perhaps with new top-level SKB state,
> > and then we can put all of your work in after you're made the other
> > minor fixes I've asked for as well.
> > 
> > Thanks Patrick.
> > 
> > 
> > 



[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]