Re: [PATCH] xx_nat_proto_gre: do not modify/corrupt GREv0 packets thought NAT

[Patrick McHardy <kaber@trash.net>]

Jorge Boncompte [DTI2] wrote:
> ----- Original Message ----- From: "Patrick McHardy" <kaber@trash.net>
>> I think the problem with this is that we don't know whether both keys
>> are identical at connection setup time and thus might fail to even
>> track the connection if they are not.
> 
> 
>    Yes, you are right, we don't know if both keys are identical as there
> is nothing like a "key exchange" before. So we will only support, as I
> stated, the connections that have the same key. And I even did not try
> to DNAT the packets.


The problem is that this at the same time causes us *not* to work
properly anymore with connections with different keys, right?

>    I have not thinked much about it but for a "full"(only connections
> with same key) solution we would need something alongside the
> xt_tcpudp.c (and userspace code) where we could match different keys to
> allow the DNAT code to redirect the connections to different hosts.
>    The SNAT part only should be easy but I don't know if that is likely
> to be accepted. What's your opinion?


I'll take it a patch if doesn't break something else (like connections
with different keys).