From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen Clark Subject: Re: clone packet with new destination address Date: Tue, 02 Nov 2010 09:44:29 -0400 Message-ID: <4CD015BD.2000408@earthlink.net> References: <4CC1843F.8050903@earthlink.net> <4CCEB69B.5080905@earthlink.net> <4CCECEDD.2030107@earthlink.net> Reply-To: sclark46@earthlink.net Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Changli Gao , netfilter-devel@vger.kernel.org To: Jan Engelhardt Return-path: Received: from elasmtp-curtail.atl.sa.earthlink.net ([209.86.89.64]:54726 "EHLO elasmtp-curtail.atl.sa.earthlink.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751803Ab0KBNog (ORCPT ); Tue, 2 Nov 2010 09:44:36 -0400 In-Reply-To: Sender: netfilter-devel-owner@vger.kernel.org List-ID: On 11/01/2010 03:29 PM, Jan Engelhardt wrote: > On Monday 2010-11-01 15:29, Stephen Clark wrote: > >> On 11/01/2010 09:09 AM, Jan Engelhardt wrote: >> >>> >>>> This seems to me like it would make a lot more sense, instead of >>>> having to make changes to the packet on two different systems. >>>> >>> You can do the changes on a single machine if you want to. >>> >> >> I am not sure on how to go about doing that, looking at the code for >> TEE it looks like the cloned packet bypasses any of the remaining >> iptables chains. So where would I change the destination address? >> > Right. You need a kernel>= 2.6.35 (xt_TEE is included) > for cloned packets to go through the tables again. > > >> Also if I am mistaken and it does hit one of the remaining iptables >> chains how do I tell it is not the original but the cloned packet I >> want to change to the new destination address? >> > Good question. Given the possibilities I think an extra route towards > the logging server that specifies a realm value, that is then > matchable in -A OUTPUT -m realm, is in order. > > Hmm..., Sounds like maybe an easier way to do this is to use libipq and the QUEUE target to select the packets of interest - then make a copy of the packet in userspace and use a raw socket to send the copy with the new destination address on its way. Does this sound reasonable? -- "They that give up essential liberty to obtain temporary safety, deserve neither liberty nor safety." (Ben Franklin) "The course of history shows that as a government grows, liberty decreases." (Thomas Jefferson)