Re: [PATCH] xx_nat_proto_gre: do not modify/corrupt GREv0 packets thought NAT

[Patrick McHardy <kaber@trash.net>]

Jorge Boncompte [DTI2] wrote:
> ----- Original Message ----- From: "Patrick McHardy" <kaber@trash.net>
>> Applied, thanks. I removed the FIXME though since its the intended
>> behaviour and not something that needs to be fixed. I'll push it
>> to -stable as well.
> 
> 
>    Well, I don't have an opinion on the comment. My only intention was
> to reflect the fact that we do not NAT those packets as the comment states.


Yes, I left that part intact, I just removed the FIXME.

>    Just for the records:
>    The code can be made to NAT GREv0 packets with a key, at least if the
> orig and repl direction use the same key. This is the normal behaviour
> when you configure GRE tunnels on Cisco gears, Linux "ip tunnel" allows
> to use different keys for transmitting and receiving. I have tested that
> SNAT tracks the packets and that I can use several tunnels between the
> same endpoints with different keys, it did require only some minor
> modifications but to do it right it will need some more changes like to
> expand the key field to a 32bit type again all over the code.
>    If someone ever needs it, just ask.


I think the problem with this is that we don't know whether both keys
are identical at connection setup time and thus might fail to even
track the connection if they are not.

If thats not correct feel free to send a patch on top of the previous
one :)