Preliminary NetBIOS datagram NAT filter

Preliminary NetBIOS datagram NAT filter

[Constantine Sapuntzakis]

http://suif.stanford.edu/~csapuntz/ip_nat_netbios.c

Using this, I was able to join a Windows NT domain and login into the
domain from behind a NAT.

I had a hard time understanding all the parameters to the various
methods, so I probably got it wrong for anything except for source NAT
(which I tested). I'd appreciate any help from more experienced
developers.

Here's the problem with NetBIOS. NetBIOS datagrams contain the source
IP address and
source port as bytes 4-9 of the UDP payload. These need to be
rewritten while traversing a NAT.

Here are some questions:

- the HOWTO seems to indicate you want to override
hlpr->tuple.dst.u.udp.port but all the examples override
hlpr->tuple.src.u.udp.port  to filter all traffic to a port. Which is
right?

- will this NAT helper work with two computers with different IP
addresses behind a NAT? i.e. if both computers send packets with
source port 138 and destination port 138, will it correctly move the
source port number of one of the packets. Or do I have to call some
extra functions.

- will this code work for other things that rewrite the source
address? What do I need to do to make it work?

Thanks,
-Costa

Re: Preliminary NetBIOS datagram NAT filter

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 2048 bytes --]

On Wed, Feb 23, 2005 at 08:38:43PM -0800, Constantine Sapuntzakis wrote:
> http://suif.stanford.edu/~csapuntz/ip_nat_netbios.c
> 
> Using this, I was able to join a Windows NT domain and login into the
> domain from behind a NAT.
> 
> I had a hard time understanding all the parameters to the various
> methods, so I probably got it wrong for anything except for source NAT
> (which I tested). I'd appreciate any help from more experienced
> developers.
> 
> Here's the problem with NetBIOS. NetBIOS datagrams contain the source
> IP address and
> source port as bytes 4-9 of the UDP payload. These need to be
> rewritten while traversing a NAT.

so how do you determine that what you are modyfying is really a netbios
packet?  just using the port number is too little.  maybe you can do
some plausibility checks on the whole packet, and also verify that bytes
4-9 are the same as the ip (source?) address in the packet.

> - the HOWTO seems to indicate you want to override
> hlpr->tuple.dst.u.udp.port but all the examples override
> hlpr->tuple.src.u.udp.port  to filter all traffic to a port. Which is
> right?

src.

> - will this NAT helper work with two computers with different IP
> addresses behind a NAT? i.e. if both computers send packets with
> source port 138 and destination port 138, will it correctly move the
> source port number of one of the packets. Or do I have to call some
> extra functions.

i'm not really sure how the netbios protocol works. therefore I cannot
really comment on what you're doing and whether it's the right thing to
do.  normally, you implement a conntrack helper before writing a nat
helper.

-- 
- Harald Welte <laforge@netfilter.org>                 http://netfilter.org/
============================================================================
  "Fragmentation is like classful addressing -- an interesting early
   architectural error that shows how much experimentation was going
   on while IP was being designed."                    -- Paul Vixie

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 189 bytes --]