Re: [PATCH] ebtables dst cache overflow/SNAT fix

The SNAT rule should match on packets being bridged.

I think that matching IP traffic needs to be received on a bridge port on the test
machine.

I simply set up a bridge group with 2 ethernet ports. I sent traffic
from another machine to one of the bridge ports. The traffic was flood
forwarded to the second port.

The SNAT rule I used in the lab:

iptables -t nat -I POSTROUTING -s ! 192.168.100.1 -j SNAT --to 192.168.88.1

In the field where this problem was discovered the routers were simply SNAT'ing
for customers in a bridge group.

The field routers were running 2.4.26 with ebtables-brnf-6_vs_2.4.26.
I've also tested 2.4.27 with ebtables-brnf-7_vs_2.4.27 but I see the same
problem.

I noticed that with the SNAT rule, packets received on a bridge port
passed through net/ipv4/netfilter/ip_nat_core.c:ip_nat_route_input().
That's where the skb->dst pointer was being set prior to the
br_nf_pre_routing_finish() call.

Hope this helps.

Thanks,
Scott

On Wed, 22 Sep 2004, Bart De Schuymer wrote:

>>Date: Wed, 22 Sep 2004 21:43:48 +0200
>>From: Bart De Schuymer <[email protected]>
>>To: Scott Yoder <syoder-/[email protected]>,
>>     [email protected]
>>Subject: Re: [Ebtables-devel] [PATCH] ebtables dst cache overflow/SNAT fix
>>
>>On Wednesday 22 September 2004 00:33, Scott Yoder wrote:
>>> Hi all,
>>>
>>> I've come across a problem when using SNAT, bridging and ebtables which
>>> leads to "dst cache overflow" errors and major routing problems.
>>>
>>> All I have to do is configure a bridge group, install a SNAT rule on the
>>> bridge interface and sit back and wait.
>>
>>I can't seem to trigger this. A simple "iptables -t nat -A POSTROUTING -s
>>$SOURCE -j SNAT --to-source $TOSOURCE" doesn't give a non-NULL skb->dst in
>>br_nf_pre_routing_finish(). Do I need to do anything else to trigger this?
>>
>>cheers,
>>Bart
>>


-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php