MASQUERADE + DHCP problem

MASQUERADE + DHCP problem

[Patrick McHardy]

Hi,

in 2.6.13 I removed this part from MASQUERADE to get more consistency
in source address selection:

-	/* FIXME: For the moment, don't do local packets, breaks
-	   testsuite for 2.3.49 --RR */
-	if ((*pskb)->sk)
-		return NF_ACCEPT;
-

Unfortunately this broke pump, it uses a regular UDP socket for
DHCP requests while no IP address is configured and fails in
MASQUERADE because no IP can be found. I'm not much in favour
of putting the check back in, so I want to discuss other
possiblities to keep pump working.

So far what's come to my mind is:
1) Tell users not to masquerade DHCP queries - makes most sense
   in my opinion, but breaks existing setups
2) Add a special hack to masquerade to handle DHCP while no
   local address exists by looking at the port and src/dst
   address. Incredibly ugly and wrong :)
3) Combination of the above - add the hack and print a warning
   to tell users to fix their ruleset, remove the hack after
   6 month

None of them is perfect, any other suggestions are welcome.

Re: MASQUERADE + DHCP problem

[Rusty Russell]

On Sun, 2005-09-11 at 17:07 +0200, Patrick McHardy wrote:
> 2) Add a special hack to masquerade to handle DHCP while no
>    local address exists by looking at the port and src/dst
>    address. Incredibly ugly and wrong :)

If IP src is 0.0.0.0, let it through untouched.  Those packets are
presumably not supposed to be masqueraded, so it's the Right Think
AFAICT.

Will that fix DHCP?
Rusty.
-- 
A bad analogy is like a leaky screwdriver -- Richard Braakman

Re: MASQUERADE + DHCP problem

[Patrick McHardy]

Rusty Russell wrote:
> On Sun, 2005-09-11 at 17:07 +0200, Patrick McHardy wrote:
> 
>>2) Add a special hack to masquerade to handle DHCP while no
>>   local address exists by looking at the port and src/dst
>>   address. Incredibly ugly and wrong :)
> 
> 
> If IP src is 0.0.0.0, let it through untouched.  Those packets are
> presumably not supposed to be masqueraded, so it's the Right Think
> AFAICT.
> 
> Will that fix DHCP?

Absolutely. Since these packets never get routed, the only possibility
when they can occur is when a local raw socket with IP_HDRINCL chooses
a source address of 0. In that case it definitely seems right to leave
the packet alone.

Thanks!

Patrick

Re: MASQUERADE + DHCP problem

[David S. Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Mon, 12 Sep 2005 01:57:22 +0200

> Rusty Russell wrote:
> > If IP src is 0.0.0.0, let it through untouched.  Those packets are
> > presumably not supposed to be masqueraded, so it's the Right Think
> > AFAICT.
> > 
> > Will that fix DHCP?
> 
> Absolutely. Since these packets never get routed, the only possibility
> when they can occur is when a local raw socket with IP_HDRINCL chooses
> a source address of 0. In that case it definitely seems right to leave
> the packet alone.

That's a really great idea Rusty.

Patrick, I think this needs to go into -stable as well,
once you have a patch ready, right?

Re: MASQUERADE + DHCP problem

[Patrick McHardy]

David S. Miller wrote:
> Patrick, I think this needs to go into -stable as well,
> once you have a patch ready, right?

Yes. I already have a patch queued, I'll send it together
with some others tonight.