SNAT and OE

-----BEGIN PGP SIGNED MESSAGE-----


Okay, I've tracked down two things:
      1) if I set up a multihomed system that SNAT still works.
      2) if I do not clear the skb->nfct, then SNAT through ipsec0 works!

What I think it occuring:
     a) packet goes through routing, POSTROUTING, gets SNAT'ed.
     b) packet gets to ipsec0, experiences the %pass.
     c) packet has the conntrack cleared.
     d) packet is re-injected into top of IP stack, gets to POSTROUTING.
     
Now, here is the tricky part. In 2.4, the SNAT code deals with conflicts
between host ports and ports picked by the SNAT code by SNAT'ed the host
to a clean port if there is a conflict. (I think... I have to re-read the
code)

so:  e) since packet, which now appears to be from host, conflicts with
	an SNAT, the POSTROUTING code SNAT's it elsewhere.
     f) packet gets to remote host, SYN/ACK is returned.
     g) SYN/ACK comes back, it NAT'ed back to *host* ports and handed to
	the host. Host says, "HUH", and RST's it.
     h) original connection goes unanswered.


west:/testing/pluto/oe-snat-01# cat /proc/net/ip_conntrack 
tcp      6 109 SYN_SENT src=192.0.1.1 dst=1.2.3.4 sport=1030 dport=3 [UNREPLIED] src=1.2.3.4 dst=192.1.2.45 sport=3 dport=1030 use=1 
tcp      6 2 CLOSE src=192.1.2.45 dst=1.2.3.4 sport=1030 dport=3 src=1.2.3.4 dst=192.1.2.45 sport=3 dport=1024 use=1 
s is what I see from ip_conntrack:

And a trace from the remote host (reverse packets are going via another
interface, since I didn't change the multihoming):

22:32:13.935447 192.1.2.45.1030 > 1.2.3.4.3: S 944534783:944534783(0) win 5840 <mss 1460,sackOK,timestamp 43840[|tcp]> (DF) [tos 0x10] 
22:32:40.286839 192.1.2.45.1030 > 1.2.3.4.3: R 944534784:944534784(0) win 0
(DF)

looking at 1.99's ipsec_tunnel.c, using "cvs annotate":

1.102        (rgb      14-Mar-00): #ifdef SKB_RESET_NFCT
1.102        (rgb      14-Mar-00): 	nf_conntrack_put(skb->nfct);
1.102        (rgb      14-Mar-00): 	skb->nfct = NULL;

Comment says:

1.103        (rgb      16-Mar-00):  * Revision 1.102  2000/03/14 12:26:59  rgb
1.103        (rgb      16-Mar-00):  * Added skb->nfct support for clearing netfilter conntrack bits (MB).
1.103        (rgb      16-Mar-00):  *

This clearly predates OE.

I suggest that perhaps the clearing of nfct should only occur if we create
a new packet (i.e. ESP, AH, etc.)

]       ON HUMILITY: to err is human. To moo, bovine.           |  firewalls  [
]   Michael Richardson, Sandelman Software Works, Ottawa, ON    |net architect[
] [email protected] http://www.sandelman.ottawa.on.ca/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBPm6ACIqHRg3pndX9AQGiXwQArhE1Sl5U1s4dZ4dPgrp34xLpdpgp+uaZ
ir88BXkhneIR3vcoMIB3isQDTvKkyusIWeRUInS7fMEMD1FGECc8tuuHfkYUtJz5
I9kTAOJPvdWmfUsGXMKJb+JguR4Ilhit2aaseDH7oPN4osENIDXBMy77ozhPvnMV
OIo8Wx1Lo30=
=EAlp
-----END PGP SIGNATURE-----