Matching UDP broadcasts using RELATED

Matching UDP broadcasts using RELATED

[yu5p97f02-O/bDAPVd7B0N+BqQ9rBEUg]

For protocols which work by initiating a request using a UDP broadcast and
expecting a reply for a specific host, is there any way to match the reply
back to the original broadcast.

An example of something that does this is smbmount, a request is broadcast to
the localnet with a port set to the netbios-ns port, and then smbmount expects
a reply from a particular host to the initiating port.

-- 

Re: Matching UDP broadcasts using RELATED

[Loïc Minier]

yu5p97f02@sneakemail.com - Sun, Jan 04, 2004:

> For protocols which work by initiating a request using a UDP broadcast and
> expecting a reply for a specific host, is there any way to match the reply
> back to the original broadcast.
> 
> An example of something that does this is smbmount, a request is broadcast to
> the localnet with a port set to the netbios-ns port, and then smbmount expects
> a reply from a particular host to the initiating port.

 I think this should go in a conntrack module, but there's always the
 possibility for you to write such rules manually with the "recent"
 module.  See ``iptables -m recent --help''.

   Regards,

-- 
Loïc Minier <lool@dooz.org>

Re: Matching UDP broadcasts using RELATED

[Antony Stone]

On Sunday 04 January 2004 2:14 am, yu5p97f02@sneakemail.com wrote:

> For protocols which work by initiating a request using a UDP broadcast and
> expecting a reply for a specific host, is there any way to match the reply
> back to the original broadcast.
>
> An example of something that does this is smbmount, a request is broadcast
> to the localnet with a port set to the netbios-ns port, and then smbmount
> expects a reply from a particular host to the initiating port.

Not with the existing connection tracking code, no.

It shouldn't be too hard to write a conntrack helper for such a protocol which 
enables reply packets to be recognised as Related, however - all it would 
need to do is match:

  destination IP = original source IP
  destination port = original source port
  source IP is within network range of original broadcast destination IP
  source port = original destination port

If you wanted to do a 'quick and dirty' version then you could even not bother 
about the source IP, and match packets where just the other three were 
correct - this would then be an almost trivial hack of the current conntrack 
code, I expect.

Regards,

Antony.

-- 
Ramdisk is not an installation procedure.

                                                     Please reply to the list;
                                                           please don't CC me.