nat drop the icmp redirect packet

nat drop the icmp redirect packet

[Gao feng]

Hi

In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
pc A(whose gateway is C) send a icmp request to pc B.
When gw C receive this packet,it may return a icmp redirect packet to A.
BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
Finally,the icmp redirect packet will be droped no matter the conn has nat or not.

of course,the icmp redirect packet will be correct handled when nat is finished.

Can somebody will give me some suggestion,
or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?

Re: nat drop the icmp redirect packet

[Gao feng]

于 2011年11月28日 09:12, Gao feng 写道:
> Hi
> 
> In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
> pc A(whose gateway is C) send a icmp request to pc B.
> When gw C receive this packet,it may return a icmp redirect packet to A.
> BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
> Finally,the icmp redirect packet will be droped no matter the conn has nat or not.
> 
> of course,the icmp redirect packet will be correct handled when nat is finished.
> 
> Can somebody will give me some suggestion,
> or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?
> --
> To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html
> 

or maybe we can move the ip_rt_send_redirect from FORWARD to POSTROUTING?
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: nat drop the icmp redirect packet

[Gao feng]

Hi pablo
what's your idea?

> 
> or maybe we can move the ip_rt_send_redirect from FORWARD to POSTROUTING?
> --

Re: nat drop the icmp redirect packet

[Patrick McHardy]

On 11/28/2011 02:12 AM, Gao feng wrote:
> Hi
>
> In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
> pc A(whose gateway is C) send a icmp request to pc B.
> When gw C receive this packet,it may return a icmp redirect packet to A.
> BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
> Finally,the icmp redirect packet will be droped no matter the conn has nat or not.
>
> of course,the icmp redirect packet will be correct handled when nat is finished.
>
> Can somebody will give me some suggestion,
> or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?

It doesn't matter whether the ICMP packet has gone through
POST_ROUTING, the conntrack associated with the packet is
that of the original packet causing the ICMP REDIRECT (or
any other kind of ICMP error).

Basically, we don't want hosts talking directly to each other
*if* NAT has been set up since that would obviously break
things. In the case you describe (only destination NAT setup
completed, but null mapping) instead of dropping the packet,
we could set up a null source mapping and let the packet
through under the assumption that the hosts will then start
communicating directly.

This will break if the host receiving the ICMP REDIRECT ignores
it though. What is the specific problem you're trying to solve?

Re: nat drop the icmp redirect packet

[Gao feng]

于 2011年12月01日 02:53, Patrick McHardy 写道:
> On 11/28/2011 02:12 AM, Gao feng wrote:
>> Hi
>>
>> In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
>> pc A(whose gateway is C) send a icmp request to pc B.
>> When gw C receive this packet,it may return a icmp redirect packet to A.
>> BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
>> Finally,the icmp redirect packet will be droped no matter the conn has nat or not.
>>
>> of course,the icmp redirect packet will be correct handled when nat is finished.
>>
>> Can somebody will give me some suggestion,
>> or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?
> 
> It doesn't matter whether the ICMP packet has gone through
> POST_ROUTING, the conntrack associated with the packet is
> that of the original packet causing the ICMP REDIRECT (or
> any other kind of ICMP error).
> 
> Basically, we don't want hosts talking directly to each other
> *if* NAT has been set up since that would obviously break
> things. In the case you describe (only destination NAT setup
> completed, but null mapping) instead of dropping the packet,
> we could set up a null source mapping and let the packet
> through under the assumption that the hosts will then start
> communicating directly.
> 
> This will break if the host receiving the ICMP REDIRECT ignores
> it though. What is the specific problem you're trying to solve?
> 

Thanks Patrick!

As I said,in my case,the *first* ICMP REDIRECT packet will be dropped even
the system has no nat rules,because this REDIRECT packet is triggered
by the original packet in FORWARD chain(ip_forward),and when this REDIRECT
packet goto POSTROUTING chian(nf_nat_fn->nf_nat_icmp_reply_translation),the
original packet is still in FORWARD chain.So the original packet's conntrack
ONLY has IPS_DST_NAT_DONE.

I understand your mean,we should not let REDIRECT to take effect when this conntrack
has nat rule.

I just want to know is there some idea to avoid the first ICMP_REDIRECT packet being dropped?

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: nat drop the icmp redirect packet

[Patrick McHardy]

On 12/01/2011 01:59 AM, Gao feng wrote:
> 于 2011年12月01日 02:53, Patrick McHardy 写道:
>> On 11/28/2011 02:12 AM, Gao feng wrote:
>>> Hi
>>>
>>> In func nf_nat_icmp_reply_translation,the icmp packet will be droped when the nat is not finished.
>>> pc A(whose gateway is C) send a icmp request to pc B.
>>> When gw C receive this packet,it may return a icmp redirect packet to A.
>>> BUT now,the icmp request packet has not go to POSTROUTING,So the nat is not finished.
>>> Finally,the icmp redirect packet will be droped no matter the conn has nat or not.
>>>
>>> of course,the icmp redirect packet will be correct handled when nat is finished.
>>>
>>> Can somebody will give me some suggestion,
>>> or should I just add a sysctl to let the user decide drop or receive this icmp redirect packet when nat is not finished?
>> It doesn't matter whether the ICMP packet has gone through
>> POST_ROUTING, the conntrack associated with the packet is
>> that of the original packet causing the ICMP REDIRECT (or
>> any other kind of ICMP error).
>>
>> Basically, we don't want hosts talking directly to each other
>> *if* NAT has been set up since that would obviously break
>> things. In the case you describe (only destination NAT setup
>> completed, but null mapping) instead of dropping the packet,
>> we could set up a null source mapping and let the packet
>> through under the assumption that the hosts will then start
>> communicating directly.
>>
>> This will break if the host receiving the ICMP REDIRECT ignores
>> it though. What is the specific problem you're trying to solve?
>>
> Thanks Patrick!
>
> As I said,in my case,the *first* ICMP REDIRECT packet will be dropped even
> the system has no nat rules,because this REDIRECT packet is triggered
> by the original packet in FORWARD chain(ip_forward),and when this REDIRECT
> packet goto POSTROUTING chian(nf_nat_fn->nf_nat_icmp_reply_translation),the
> original packet is still in FORWARD chain.So the original packet's conntrack
> ONLY has IPS_DST_NAT_DONE.
>
> I understand your mean,we should not let REDIRECT to take effect when this conntrack
> has nat rule.
>
> I just want to know is there some idea to avoid the first ICMP_REDIRECT packet being dropped

Yes, as I said, we could set up a NULL source mapping on the
conntrack of the original packet and let the REDIRECT through.
The user might have configured a source NAT rule though which
would become ineffective by this.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: nat drop the icmp redirect packet

[Gao feng]

于 2011年12月01日 18:20, Patrick McHardy 写道:
> Yes, as I said, we could set up a NULL source mapping on the
> conntrack of the original packet and let the REDIRECT through.
> The user might have configured a source NAT rule though which
> would become ineffective by this.
> 

Hi Patrick:

Yes,you are right.

You mean we have no idea of the ICMP REDIRECT packet being droppen
when nat is not finished?


--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: nat drop the icmp redirect packet

[Patrick McHardy]

On 02.12.2011 06:32, Gao feng wrote:
> 于 2011年12月01日 18:20, Patrick McHardy 写道:
>> Yes, as I said, we could set up a NULL source mapping on the
>> conntrack of the original packet and let the REDIRECT through.
>> The user might have configured a source NAT rule though which
>> would become ineffective by this.
>>
> 
> Hi Patrick:
> 
> Yes,you are right.
> 
> You mean we have no idea of the ICMP REDIRECT packet being droppen
> when nat is not finished?

We can't determine whether we could let it through at that point.
The safe choice is to drop it.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: nat drop the icmp redirect packet

[Gao feng]

于 2011年12月02日 20:58, Patrick McHardy 写道:
> On 02.12.2011 06:32, Gao feng wrote:
>> 于 2011年12月01日 18:20, Patrick McHardy 写道:
>>> Yes, as I said, we could set up a NULL source mapping on the
>>> conntrack of the original packet and let the REDIRECT through.
>>> The user might have configured a source NAT rule though which
>>> would become ineffective by this.
>>>
>>
>> Hi Patrick:
>>
>> Yes,you are right.
>>
>> You mean we have no idea of the ICMP REDIRECT packet being droppen
>> when nat is not finished?
> 
> We can't determine whether we could let it through at that point.
> The safe choice is to drop it.
> --

Good Morning Patrick

I got it,thank you very much.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html