From: KOVACS Krisztian <hidden@sch.bme.hu>
To: David Miller <davem@davemloft.net>
Cc: hidden@sch.bme.hu, kaber@trash.net, netdev@vger.kernel.org,
netfilter-devel@vger.kernel.org
Subject: Re: [net-next PATCH 06/16] Handle TCP SYN+ACK/ACK/RST transparency
Date: Wed, 1 Oct 2008 16:46:22 +0200 [thread overview]
Message-ID: <20081001144622.GC25672@sch.bme.hu> (raw)
In-Reply-To: <20081001.074250.261632354.davem@davemloft.net>
Hi,
On Wed, Oct 01, 2008 at 07:42:50AM -0700, David Miller wrote:
> From: KOVACS Krisztian <hidden@sch.bme.hu>
> Date: Wed, 01 Oct 2008 16:24:31 +0200
>
> > The TCP stack sends out SYN+ACK/ACK/RST reply packets in response to
> > incoming packets. The non-local source address check on output bites
> > us again, as replies for transparently redirected traffic won't have a
> > chance to leave the node.
> >
> > This patch selectively sets the FLOWI_FLAG_ANYSRC flag when doing
> > the route lookup for those replies. Transparent replies are enabled if
> > the listening socket has the transparent socket flag set.
> >
> > Signed-off-by: KOVACS Krisztian <hidden@sch.bme.hu>
>
> I had to make some modifications to make this build.
>
> I took two include/net/ip.h modifications from patch 7:
>
> 1) Adding flags to ip_reply_arg struct
> 2) definition of IP_REPLY_ARG_NOSRCCHECK
>
> and the result is included below and added to net-next-2.6
Oops, my fault, sorry. Should have been more careful when juggling around
with patches yesterday...
--
KOVACS Krisztian
next prev parent reply other threads:[~2008-10-01 14:46 UTC|newest]
Thread overview: 61+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-10-01 14:24 [net-next PATCH 00/16] Transparent proxying patches, take six KOVACS Krisztian
2008-10-01 14:24 ` [net-next PATCH 03/16] Allow binding to non-local addresses if IP_TRANSPARENT is set KOVACS Krisztian
2008-10-01 14:31 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 13/16] iptables tproxy core KOVACS Krisztian
2008-10-02 9:19 ` Patrick McHardy
2008-10-01 14:24 ` [net-next PATCH 07/16] Make Netfilter's ip_route_me_harder() non-local address compatible KOVACS Krisztian
2008-10-01 14:45 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 06/16] Handle TCP SYN+ACK/ACK/RST transparency KOVACS Krisztian
2008-10-01 14:42 ` David Miller
2008-10-01 14:46 ` KOVACS Krisztian [this message]
2008-10-01 14:24 ` [net-next PATCH 12/16] Split Netfilter IPv4 defragmentation into a separate module KOVACS Krisztian
2008-10-02 9:18 ` Patrick McHardy
2008-10-01 14:24 ` [net-next PATCH 09/16] Export UDP socket lookup function KOVACS Krisztian
2008-10-01 14:48 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 14/16] iptables socket match KOVACS Krisztian
2008-10-02 9:26 ` Patrick McHardy
2008-10-02 10:26 ` KOVACS Krisztian
2008-10-02 10:35 ` Patrick McHardy
2008-10-03 14:04 ` Jan Engelhardt
2008-10-01 14:24 ` [net-next PATCH 15/16] iptables TPROXY target KOVACS Krisztian
2008-10-02 9:28 ` Patrick McHardy
2008-10-01 14:24 ` [net-next PATCH 02/16] Implement IP_TRANSPARENT socket option KOVACS Krisztian
2008-10-01 14:30 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 08/16] Port redirection support for TCP KOVACS Krisztian
2008-10-01 14:47 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 11/16] Don't lookup the socket if there's a socket attached to the skb KOVACS Krisztian
2008-10-01 14:24 ` [net-next PATCH 16/16] Add documentation KOVACS Krisztian
2008-10-01 16:22 ` Randy Dunlap
2008-10-02 9:37 ` [RESEND net-next " KOVACS Krisztian
2008-10-02 9:38 ` Patrick McHardy
2008-10-03 14:01 ` [net-next " Jan Engelhardt
2008-10-07 7:01 ` KOVACS Krisztian
2008-10-07 19:50 ` David Miller
2008-10-07 20:02 ` KOVACS Krisztian
2008-10-07 20:47 ` Patrick McHardy
2008-10-07 20:53 ` David Miller
2008-10-08 0:32 ` Philip Craig
2008-10-01 14:24 ` [net-next PATCH 04/16] Make inet_sock.h independent of route.h KOVACS Krisztian
2008-10-01 14:34 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 10/16] Don't lookup the socket if there's a socket attached to the skb KOVACS Krisztian
2008-10-01 14:50 ` David Miller
2008-10-01 15:38 ` KOVACS Krisztian
2008-10-01 15:51 ` David Miller
2008-10-02 15:43 ` KOVACS Krisztian
2008-10-02 17:09 ` Arnaldo Carvalho de Melo
2008-10-02 19:58 ` David Miller
2008-10-03 8:57 ` KOVACS Krisztian
2008-10-03 13:47 ` Arnaldo Carvalho de Melo
2008-10-07 7:36 ` KOVACS Krisztian
2008-10-07 12:36 ` Arnaldo Carvalho de Melo
2008-10-07 18:42 ` David Miller
2008-10-07 7:42 ` [net-next PATCH] Add udplib_lookup_skb() helpers (was: [net-next PATCH 10/16] Don't lookup the socket if there's a socket attached to the skb) KOVACS Krisztian
2008-10-07 12:34 ` Arnaldo Carvalho de Melo
2008-10-07 19:39 ` [net-next PATCH] Add udplib_lookup_skb() helpers David Miller
2008-10-07 7:59 ` [net-next PATCH] Don't lookup the socket if there's a socket attached to the skb (was: Re: [net-next PATCH 10/16] Don't lookup the socket if there's a socket attached to the skb) KOVACS Krisztian
2008-10-07 12:36 ` Arnaldo Carvalho de Melo
2008-10-07 19:41 ` [net-next PATCH] Don't lookup the socket if there's a socket attached to the skb David Miller
2008-10-01 14:24 ` [net-next PATCH 01/16] Loosen source address check on IPv4 output KOVACS Krisztian
2008-10-01 14:28 ` David Miller
2008-10-01 14:24 ` [net-next PATCH 05/16] Conditionally enable transparent flow flag when connecting KOVACS Krisztian
2008-10-01 14:36 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20081001144622.GC25672@sch.bme.hu \
--to=hidden@sch.bme.hu \
--cc=davem@davemloft.net \
--cc=kaber@trash.net \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).