Re: [PATCH v4 net 0/5] icmp: account for NAT when sending icmps from ndo layer

[David Miller <davem@davemloft.net>]

From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Tue, 11 Feb 2020 20:47:04 +0100

> The ICMP routines use the source address for two reasons:
> 
> 1. Rate-limiting ICMP transmissions based on source address, so
>    that one source address cannot provoke a flood of replies. If
>    the source address is wrong, the rate limiting will be
>    incorrectly applied.
> 
> 2. Choosing the interface and hence new source address of the
>    generated ICMP packet. If the original packet source address
>    is wrong, ICMP replies will be sent from the wrong source
>    address, resulting in either a misdelivery, infoleak, or just
>    general network admin confusion.
> 
> Most of the time, the icmp_send and icmpv6_send routines can just reach
> down into the skb's IP header to determine the saddr. However, if
> icmp_send or icmpv6_send is being called from a network device driver --
> there are a few in the tree -- then it's possible that by the time
> icmp_send or icmpv6_send looks at the packet, the packet's source
> address has already been transformed by SNAT or MASQUERADE or some other
> transformation that CONNTRACK knows about. In this case, the packet's
> source address is most certainly the *wrong* source address to be used
> for the purpose of ICMP replies.
> 
> Rather, the source address we want to use for ICMP replies is the
> original one, from before the transformation occurred.
 ...

Series applied, thank you.