Re: [PATCH] MASQUERADE handling of device events

[Phil Oester <kernel@linuxace.com>]

On Sun, Nov 21, 2004 at 01:58:28PM +1100, Rusty Russell wrote:
> The MASQUERADE target use to destroy connections when an interface
> went down.  We changed this to merely remove the ASSURED bit, and
> destroy them if the same interface came up with a different IP
> address.  Unfortunately, as Phil Oester pointed out, that code was
> crap for PPP connections, since we (1) compared ifa_address instead of
> ifa_local, (2) identified interfaces by ifindex, which increments as a
> PPP device downs and ups, and (3) caused all connections to be flushed
> when we added an IP address.
> 
> So that code was reverted after 2.6.10-rc2.
> 
> This code stores the interface name, rather than trying to use the
> ifindex, and only deletes connections if *no* ifa_local on the
> interface matches the connection, so simply adding a new IP address is
> a NOOP.

But even using the interface name is unreliable.  Consider the user who
uses multiple PPP connections.  Both go down at the same time, and
come back with the 'old' ppp1 now named ppp0.  Or consider a PopTop
PPTP server which has dozens of ppp interfaces (although using masq here
is admittedly unlikely).

Perhaps my original patch which special-cased ppp would be better?

http://lists.netfilter.org/pipermail/netfilter-devel/2004-November/017294.html

Phil