Re: Host can receive martian_source packet when dnat on bridge

Op do, 02-11-2006 te 20:46 +0800, schreef lepton:
> I found some times we can receive martian_source packet
> after dnat on bridge.
> 
> After looking into some code, I found the problem is related
> a patch posted here before, why we added the check for rt->rt_type==RTN_LOCAL
> here? what problem is this patch fixed for?
> 
> With this patch, if redirect take place on a martin_source packet, the
> packet will not be dropped(because we ignore the result of route_input,
> then we call route_output_key with a zero source addr).

The patch was to deal with the problem that ip_route_output_key
reportedly returns 0 for redirected packets, which would normally mean
the packet is dropped and the message "Performing cross-bridge DNAT
requires IP forwarding to be enabled" is printed. By checking for
RTN_LOCAL, these redirected packets aren't stopped.

Are you saying that except for martian source packets and other
anomalies, redirected packets aren't dropped if this patch isn't used?

cheers,
Bart



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642