Re: [PATCH] Update SNMP basic for full IP address NAT

[Gilles Kerdoncuff <gkerdoncuff.ext@orange-ftgroup.com>]

Patrick McHardy wrote:
> Gilles Kerdoncuff wrote:
>   
>> ** I understand that you'd like to keep the /8 behavior, yet, something
>> still troubles me with the current ip_nat_snmp_basic.c file :
>>
>> The from/to fields of the oct1_map structure are filled-in by calling
>> the NOCT1 (0xFF mask) macro on the tuple IP.
>> Which means that on a 192.168.1.x address, it takes the x part.
>>     
>
> I'm confused - you seem to be right, but quick testing shows it behaves
> correctly and takes the 192 part.
>
>   
This makes things clear. This is one of those little/big endian problems :
I'm using this module on a MIPS platform, you probably tested it on an 
Intel architecture

If you look at ip_conntrack_ftp.c, it uses ntohl routine when extracting 
the tuple IP. This is the way it should be done.

In the SNMP module, add ntohl after the
    map.to = NOCT1(
and
    map.from = NOCT1(
code lines
Run your quick test again, you will see that the bug is there !

I will fix that in my updated patch.


>> ** Anyway, if any use case for the /8 behavior exists, I don't mind
>> adding a parameter to test only the first 8,16,24 or 32 bits of the
>> address, keeping /8 as a default.
>>     
>
> Please do so. But why only 8,16,24,32? I don't believe allowing
> any prefix len will be harder to do.
>   
Ok, I'll do so as soon as I can find a few hours to code and test it.
Thanks a lot.

Gilles.