[Bridge] Re: Policy match with a bridge

[Bridge] Re: Policy match with a bridge

[Patrick McHardy]

Tom Eastep wrote:

> | Have you applied the ipsec+netfilter patches ? Without them, packets 
> are
> | only seen encrypted in the OUTPUT chain.
> |
> Yes -- the ipsec+netfilter patches are applied. Here is the same test
> with the bridge removed and the local ip address transfered to one of
> the network cards: 

The problem is ipv4_sabotage_out in the briding code. It prevents the
packet from hitting the LOCAL_OUT hook while it is still unencrypted.
When it hits the bridging code and its LOCAL_OUT hook it's too late.
Not sure how to handle it yet.

Regards
Patrick

[Bridge] Re: Policy match with a bridge

[Tom Eastep]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Patrick McHardy wrote:
| Tom Eastep wrote:
|
|> | Have you applied the ipsec+netfilter patches ? Without them, packets
|> are
|> | only seen encrypted in the OUTPUT chain.
|> |
|> Yes -- the ipsec+netfilter patches are applied. Here is the same test
|> with the bridge removed and the local ip address transfered to one of
|> the network cards:
|
|
| The problem is ipv4_sabotage_out in the briding code. It prevents the
| packet from hitting the LOCAL_OUT hook while it is still unencrypted.
| When it hits the bridging code and its LOCAL_OUT hook it's too late.
| Not sure how to handle it yet.
|

Thanks for the update.

- -Tom
- --
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBIBFOO/MAbZfjDLIRAvS4AJ9eGQhcxVi09h8gmLZ/CpauSYlw1wCePgBQ
trHWmX/wZV/DyIjSz05IGyQ=
=mL/B
-----END PGP SIGNATURE-----

[Bridge] Re: Policy match with a bridge

[Bart De Schuymer]

On Monday 16 August 2004 03:31, Patrick McHardy wrote:
> The problem is ipv4_sabotage_out in the briding code. It prevents the
> packet from hitting the LOCAL_OUT hook while it is still unencrypted.
> When it hits the bridging code and its LOCAL_OUT hook it's too late.
> Not sure how to handle it yet.

I'll have a look at that after I'm finished with the IPv6 bridge firewalling 
stuff.

cheers,
Bart

[Bridge] Re: Policy match with a bridge

[Tom Eastep]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Bart De Schuymer wrote:
> On Monday 16 August 2004 03:31, Patrick McHardy wrote:
>
>>The problem is ipv4_sabotage_out in the briding code. It prevents the
>>packet from hitting the LOCAL_OUT hook while it is still unencrypted.
>>When it hits the bridging code and its LOCAL_OUT hook it's too late.
>>Not sure how to handle it yet.
>
>
> I'll have a look at that after I'm finished with the IPv6 bridge
firewalling
> stuff.
>

Any progress on this?

Thanks,
- -Tom
- --
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net
PGP Public Key   \ https://lists.shorewall.net/teastep.pgp.key
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFBbcbvO/MAbZfjDLIRAmBsAJsFlFdf6+c5tzT8Z5OGG/nnxoL//wCghS8L
hX2rkQdtF2v7YIwRyfRDLIY=
=6sB9
-----END PGP SIGNATURE-----

[Bridge] Re: Policy match with a bridge

[Bart De Schuymer]

On Thursday 14 October 2004 02:23, Tom Eastep wrote:
> Bart De Schuymer wrote:
> > On Monday 16 August 2004 03:31, Patrick McHardy wrote:
> >>The problem is ipv4_sabotage_out in the briding code. It prevents the
> >>packet from hitting the LOCAL_OUT hook while it is still unencrypted.
> >>When it hits the bridging code and its LOCAL_OUT hook it's too late.
> >>Not sure how to handle it yet.
> >
> > I'll have a look at that after I'm finished with the IPv6 bridge
>
> firewalling
>
> > stuff.
>
> Any progress on this?

It's in the back of my mind, but I haven't had time yet to look into the ipsec 
code. I'll try next weekend. It's probably non-trivial, as Patrick didn't see 
a direct solution.

cheers,
Bart

[Bridge] Re: Policy match with a bridge

[Bart De Schuymer]

On Thursday 14 October 2004 02:23, Tom Eastep wrote:
> Bart De Schuymer wrote:
> > On Monday 16 August 2004 03:31, Patrick McHardy wrote:
> >>The problem is ipv4_sabotage_out in the briding code. It prevents the
> >>packet from hitting the LOCAL_OUT hook while it is still unencrypted.
> >>When it hits the bridging code and its LOCAL_OUT hook it's too late.
> >>Not sure how to handle it yet.
> >
> > I'll have a look at that after I'm finished with the IPv6 bridge
>
> firewalling
>
> > stuff.
>
> Any progress on this?

You should be able to do what you want in the iptables mangle OUTPUT chain 
instead of the one in the filter table.
Patrick, a hack solution would be to temporarily change out->hard_start_xmit 
to something else than br_dev_xmit, that way you fool ipv4_sabotage_out.

cheers,
Bart