Changing source/destination address for local packets

Changing source/destination address for local packets

[Tomas Mandys]

Hi,
I playing in my RTPPROXY module (finally almost ready) with change of source 
and destination addresses. It works but there is problem when is changed 
address for locally generated packets to another local address.


IP: 192.168.1.1
UDP packet:  192.168.1.1:10000  -->  192.168.1.1:50000
OUTPUT hook changes destination address (like DNAT) resp. dest port only: 
50000 --> 20000
POSTROUTING changes source port (like SNAT): 10000 --> 60000
now PREROUTING is called but conntrack (ip_conntrack_get) is related to 
session 192.168.1.1:10000  -->  192.168.1.1:50000 
(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip/udp.port) instead
address from (*pskb)->nh.iph->daddr (192.168.1.1:60000), pudph->dest 
(192.168.1.1:20000).

I think it's caused that (*pskb)->nfct is left unchanged.

I tried to refresh conntrack in PREROUTING but unsucessfully:

if (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip != 
(*pskb)->nh.iph->daddr ||
          ntohs(ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.udp.port) != 
ntohs(pudph->dest)) {

1) if (ip_conntrack_in(hooknum, pskb, in, out, NULL) == NF_DROP) {
          return NF_DROP;
    }
    ct = ip_conntrack_get(*pskb, &ctinfo);
   ip_conntrack_in  ... symbol not known

2) nf_conntrack_put((*pskb)->nfct);  /* causes kernel crash */
    nf_ct_untrack(*pskb);
 kernel crashes

3) maybe PREROUTING hook with higher priority than has ip_conntrack_in() 
callback
and reset (*pskb)->nfct.
not checked
}

Note I actually I do not need such RTPPROXY (local<->local) scenario but I 
think such behaviour is not correct.

Note also seems that locally generated UDP packets have bad UDPH checksum (udp 
data not checksumed and seems like not 0xFFFFed or so).

I'm sorry if this issues have been discussed or even fixed, I had no time to 
follow changes.

Kernel: 2.6.17.8

Thanks
Tomas

http://www.2p.cz

Re: Changing source/destination address for local packets

[Patrick McHardy]

Tomas Mandys wrote:
> Hi,
> I playing in my RTPPROXY module (finally almost ready) with change of source 
> and destination addresses. It works but there is problem when is changed 
> address for locally generated packets to another local address.
> 
> 
> IP: 192.168.1.1
> UDP packet:  192.168.1.1:10000  -->  192.168.1.1:50000
> OUTPUT hook changes destination address (like DNAT) resp. dest port only: 
> 50000 --> 20000
> POSTROUTING changes source port (like SNAT): 10000 --> 60000
> now PREROUTING is called but conntrack (ip_conntrack_get) is related to 
> session 192.168.1.1:10000  -->  192.168.1.1:50000 
> (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip/udp.port) instead
> address from (*pskb)->nh.iph->daddr (192.168.1.1:60000), pudph->dest 
> (192.168.1.1:20000).


You need to change the conntrack tuples as well if you mangle
a packet in case you're not using the standard NAT functions
for this (which you probably should). If you change the destination
address to a local one you additionally need to perform rerouting
(you *should* do that whenever you change the destination in OUTPUT,
but for this case it really is necessary).

Re: Changing source/destination address for local packets

[Tomas Mandys]

Dne pondělí 25 červen 2007 18:09 Patrick McHardy napsal(a):
> Tomas Mandys wrote:
> > Hi,
> > I playing in my RTPPROXY module (finally almost ready) with change of
> > source and destination addresses. It works but there is problem when is
> > changed address for locally generated packets to another local address.
> >
> >
> > IP: 192.168.1.1
> > UDP packet:  192.168.1.1:10000  -->  192.168.1.1:50000
> > OUTPUT hook changes destination address (like DNAT) resp. dest port only:
> > 50000 --> 20000
> > POSTROUTING changes source port (like SNAT): 10000 --> 60000
> > now PREROUTING is called but conntrack (ip_conntrack_get) is related to
> > session 192.168.1.1:10000  -->  192.168.1.1:50000
> > (ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.ip/udp.port) instead
> > address from (*pskb)->nh.iph->daddr (192.168.1.1:60000), pudph->dest
> > (192.168.1.1:20000).
>
> You need to change the conntrack tuples as well if you mangle
> a packet in case you're not using the standard NAT functions
> for this (which you probably should). If you change the destination
> address to a local one you additionally need to perform rerouting
> (you *should* do that whenever you change the destination in OUTPUT,
> but for this case it really is necessary).

I'm changing destination address in OUTPUT resp. destination UDP port only in 
this case, source port will be changed in POSTROUTING. Session#1 is 
identified by source/dest address before rerouting is done to source2/dest2 - 
this is second session! But when packet leaves POSTROUTING then enters 
PREROUTING immediately, conntrack high priority callback see  
(*pskb)->nfct != NULL and won't check IP and provides non corresponding info. 
I must drop such packets because it's confusing.

Note I cannot use NAT it's is different task. There are 2 (conntract) sessions 
and RTPPROXY is responsible for routing. 

I'm going to write a HOWTO.

-- 
--------------------------------------------------------
ing. Tomas Mandys              email: tomas.mandys@2p.cz
2p plus, s.r.o.                mobil: +420-604690589
Na Skalce 23, 150 00 Praha 5   tel:   +420-234139232
Czech republic                 fax:   +420-251561418
http://www.2p.cz               ICQ:   14187044 
--------------------------------------------------------