Re: Host can receive martian_source packet when dnat on bridge

In most case, redirected packets will not go here ( ip_route_input will
return 0).
I do some test:

ifconfig br0 192.168.3.100
iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to 3128

Redirect is working without this patch.

So what is the exactly case that redirected packets will get dropped?

Thanks

2006/11/3, Bart De Schuymer <[email protected]>:
>
> Op do, 02-11-2006 te 20:46 +0800, schreef lepton:
> > I found some times we can receive martian_source packet
> > after dnat on bridge.
> >
> > After looking into some code, I found the problem is related
> > a patch posted here before, why we added the check for
> rt->rt_type==RTN_LOCAL
> > here? what problem is this patch fixed for?
> >
> > With this patch, if redirect take place on a martin_source packet, the
> > packet will not be dropped(because we ignore the result of route_input,
> > then we call route_output_key with a zero source addr).
>
> The patch was to deal with the problem that ip_route_output_key
> reportedly returns 0 for redirected packets, which would normally mean
> the packet is dropped and the message "Performing cross-bridge DNAT
> requires IP forwarding to be enabled" is printed. By checking for
> RTN_LOCAL, these redirected packets aren't stopped.
>
> Are you saying that except for martian source packets and other
> anomalies, redirected packets aren't dropped if this patch isn't used?
>
> cheers,
> Bart
>
>
>

-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642

_______________________________________________
Ebtables-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ebtables-devel