Re: [PATCH/RFC 01/10] Implement local diversion of IPv4 skbs

[Balazs Scheidler <bazsi@balabit.hu>]

On Wed, 2007-01-10 at 07:46 +0100, Patrick McHardy wrote:
> KOVACS Krisztian wrote:

> > +			rth->u.dst.lastuse = jiffies;
> > +			dst_hold(&rth->u.dst);
> > +			rth->u.dst.__use++;
> > +			RT_CACHE_STAT_INC(in_hit);
> > +			rcu_read_unlock();
> > +
> > +			dst_release(skb->dst);
> > +			skb->dst = (struct dst_entry*)rth;
> > +
> > +			if (sk) {
> > +				sock_hold(sk);
> > +				skb->sk = sk;
> 
> This looks racy, the socket could be closed between the lookup and
> the actual use. Why do you need the socket lookup at all, can't
> you just divert all packets selected by iptables?
> 
> I'm wondering if it would be possible to use normal input routing
> combined with netfilter marks to do the diversion ..
> 

The problem is that userspace proxies open ports dynamically (think of
FTP data channels), you cannot add iptables rule for every such
redirection. So one rule for every dynamic redirection is a no-go.

If we'd add a single rule, which would do some kind of lookup and then
mark packets, would again introduce a state inside tproxy that'd need to
be synchronized with the socket table. We explicitly wanted to avoid
such tables.

And additionally, using the mark this way would prevent the admin to use
it they way he/she likes. 

-- 
Bazsi