Re: ESP spi/sequence tracking and nat

[Pablo Neira <pablo@eurodev.net>]

Hi,

Kashyap Ashwin wrote:

> 1. How can I figure out the direction of the packet in pkt_tuple(). 
> The idea is to store the SEQ/SPI values from the packet either into 
> tuple->src or tuple->dst. I noticed that packet() has a 
> ip_conntrack_info, but pkt_tuple() does not. I am not sure if I can 
> mess ip_conntrack in packet() instead…
>

AFAIK you can't, you know if a packet comes from the original/reply 
direction once you get the tuple from the conntrack table. Trace 
resolve_normal_ct:

1) we create a temporary tuple which will be used to match: get_tuple -> 
pkt_to_tuple
2) now, it's time to look up that tuple in the conntrack table: 
ip_conntrack_find_get

at 1) we don't know which direction the packet came from, we know it at 2).

Please correct me if I'm missing anything.


regards,
Pablo