Re: clone packet with new destination address

[Stephen Clark <sclark46@earthlink.net>]

On 11/01/2010 03:29 PM, Jan Engelhardt wrote:
> On Monday 2010-11-01 15:29, Stephen Clark wrote:
>    
>> On 11/01/2010 09:09 AM, Jan Engelhardt wrote:
>>      
>>>        
>>>> This seems to me like it would make a lot more sense, instead of
>>>> having to make changes to the packet on two different systems.
>>>>          
>>> You can do the changes on a single machine if you want to.
>>>        
>>
>> I am not sure on how to go about doing that, looking at the code for
>> TEE it looks like the cloned packet bypasses any of the remaining
>> iptables chains. So where would I change the destination address?
>>      
> Right. You need a kernel>= 2.6.35 (xt_TEE is included)
> for cloned packets to go through the tables again.
>
>    
>> Also if I am mistaken and it does hit one of the remaining iptables
>> chains how do I tell it is not the original but the cloned packet I
>> want to change to the new destination address?
>>      
> Good question. Given the possibilities I think an extra route towards
> the logging server that specifies a realm value, that is then
> matchable in -A OUTPUT -m realm, is in order.
>
>    
Hmm...,

Sounds like maybe an easier way to do this is to use libipq and the 
QUEUE target to
select the packets of interest - then make a copy of the packet in 
userspace and
use a raw socket to send the copy with the new destination address on 
its way.

Does this sound reasonable?

-- 

"They that give up essential liberty to obtain temporary safety,
deserve neither liberty nor safety."  (Ben Franklin)

"The course of history shows that as a government grows, liberty
decreases."  (Thomas Jefferson)