From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Dmitry Popov <dp@highloadlab.com>
Cc: Jan Engelhardt <jengelh@inai.de>, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH] xtables-addons: xt_RAWNAT: skb writable part might not include whole l4 header (ipv4 case).
Date: Wed, 15 May 2013 17:04:45 +0200 [thread overview]
Message-ID: <20130515150445.GA5614@localhost> (raw)
In-Reply-To: <20130513135020.ea2e50fc6327fb3ffe9cb667@highloadlab.com>
On Mon, May 13, 2013 at 01:50:20PM +0400, Dmitry Popov wrote:
> On Wed, 8 May 2013 23:32:16 +0200 (CEST)
> Jan Engelhardt <jengelh@inai.de> wrote:
>
> > The only way to solve the NAT problem is to do without it.
> > Full NAT is not simple at all, it requires DPI.
> > RAWNAT is just a dumb l3addr replacer and does not help
> > getting multi-connection sessions (such as 959ish FTP) going.
>
> Well, in means of full nat - yes. I have no statistics of how people use
> nf_nat/xt_RAWNAT, but in my tasks I have a lot of packets that do
> not need DPI.
Not only DPI. You're also leaking your network topology though ICMP
error messages, as the internal header is not mangled.
prev parent reply other threads:[~2013-05-15 15:04 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-05 18:05 [PATCH] xtables-addons: xt_RAWNAT: skb writable part might not include whole l4 header (ipv4 case) Dmitry Popov
2013-05-05 18:24 ` Dmitry Popov
2013-05-08 11:32 ` Jan Engelhardt
2013-05-08 15:12 ` Dmitry Popov
2013-05-08 21:32 ` Jan Engelhardt
2013-05-13 9:50 ` Dmitry Popov
2013-05-15 15:04 ` Pablo Neira Ayuso [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130515150445.GA5614@localhost \
--to=pablo@netfilter.org \
--cc=dp@highloadlab.com \
--cc=jengelh@inai.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).