ipq+AF8-set+AF8-verdict problem in bridge+-iptables

ipq+AF8-set+AF8-verdict problem in bridge+-iptables

[Yong]

 Hello Harald,
 
 Thank you for your emails!
 
 I want to use the iptable_queue in bridge+iptables environment. I can get the packet in userspace using -j QUEUE command. However, If I change the packet size. for example, I change the ping icmp packet size to 400, the packet Ethernet header is changed. In my test, the MAC address is changed to 0xffffffffff. I can capture this packet using sniffer tool. Since the MAC address is changed, the other computer cannot receive the ICMP packet.
 
 It seems that the bridge iptables patch changed something in the function ipq_set_verdict(). 
 
 Regarding the MTU issue, you are right. the ipq_set_verdict function does not perform the IP fragment. If I send a packet larger than MTU, it is missing. Is it by design?
 
 Can I modify the ipq_set_verdict function to perform the IP fragment?  Is there any patch for this IP fragment issue?
 
 Thank you again for your help!
 
 Yong
 
> ----- Original Message ----- 
> From: "Harald Welte" <laforge@netfilter.org>
> To: "Yong Li" <sdssly@sina.com>
> Cc: <netfilter-devel@lists.netfilter.org>
> Sent: Monday, July 14, 2003 4:07 PM
> Subject: Re: ipq_set_verdict problem in bridge+iptables
> 
> On Sun, Jul 13, 2003 at 11:11:16AM +0800, Yong Li wrote:
> > Hello All,
> > 
> > I encountered a problem with the ipq_set_verdict function. I want to modify
> > the packet content and size using the ipq_set_verdict function. However, I
> > found I cannot change the IP packet size more than 400+ bytes. Is it a known
> > issue?
> 
> what do you mean by 'I cannot' ? What happens?  Is an error returned to
> the ipq_set_verdict() call?  Is the packet silently discarded?  Is the
> packet truncated?
> 
> Anyway, it should work.  But if you exceed the outgoing interface's MTU,
> I could imagine that no fragmentation happens...
> 
> > Thanks in advance!
> > Yong

Re: ipq+AF8-set+AF8-verdict problem in bridge+-iptables

[Bart De Schuymer]

On Wednesday 16 July 2003 03:09, Yong wrote:
>  I want to use the iptable_queue in bridge+iptables environment. I can get
> the packet in userspace using -j QUEUE command. However, If I change the
> packet size. for example, I change the ping icmp packet size to 400, the
> packet Ethernet header is changed. In my test, the MAC address is changed
> to 0xffffffffff. I can capture this packet using sniffer tool. Since the
> MAC address is changed, the other computer cannot receive the ICMP packet.

>  It seems that the bridge iptables patch changed something in the function
> ipq_set_verdict().

Please test the patch below.

cheers,
Bart

--- linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c.old	2003-07-16 19:35:07.000000000 +0200
+++ linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c	2003-07-16 19:39:05.000000000 +0200
@@ -353,6 +353,11 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
 			}
 			if (e->skb->sk)
 				skb_set_owner_w(newskb, e->skb->sk);
+#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
+			/* bridged packets already have their Ethernet header */
+			if (e->skb->nf_bridge)
+				memcpy(newskb->data - 16, e->skb->data - 16, 16);
+#endif
 			kfree_skb(e->skb);
 			e->skb = newskb;
 		}

Re: ipq+AF8-set+AF8-verdict problem in bridge+-iptables

[Yong]

Hi Bart,

I have added the 0.0.10 patch and your patch. I can send the large ICMP packet now. Thank you for your help!

Yong
----- Original Message ----- 
From: "Bart De Schuymer" <bdschuym@pandora.be>
To: "Yong" <sdssly@sina.com>; "Harald Welte" <laforge@netfilter.org>
Cc: <netfilter-devel@lists.netfilter.org>
Sent: Thursday, July 17, 2003 1:49 AM
Subject: Re: ipq_set_verdict problem in bridge+iptables


> On Wednesday 16 July 2003 03:09, Yong wrote:
> >  I want to use the iptable_queue in bridge+iptables environment. I can get
> > the packet in userspace using -j QUEUE command. However, If I change the
> > packet size. for example, I change the ping icmp packet size to 400, the
> > packet Ethernet header is changed. In my test, the MAC address is changed
> > to 0xffffffffff. I can capture this packet using sniffer tool. Since the
> > MAC address is changed, the other computer cannot receive the ICMP packet.
> 
> >  It seems that the bridge iptables patch changed something in the function
> > ipq_set_verdict().
> 
> Please test the patch below.
> 
> cheers,
> Bart
> 
> --- linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c.old 2003-07-16 19:35:07.000000000 +0200
> +++ linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c 2003-07-16 19:39:05.000000000 +0200
> @@ -353,6 +353,11 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
>   }
>   if (e->skb->sk)
>   skb_set_owner_w(newskb, e->skb->sk);
> +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
> + /* bridged packets already have their Ethernet header */
> + if (e->skb->nf_bridge)
> + memcpy(newskb->data - 16, e->skb->data - 16, 16);
> +#endif
>   kfree_skb(e->skb);
>   e->skb = newskb;
>   }
> 
> 
> 

Re: ipq+AF8-set+AF8-verdict problem in bridge+-iptables

[Bart De Schuymer]

On Thursday 17 July 2003 04:47, Yong wrote:
> I am using the bridge-nf-0.0.7-against-2.4.19.diff patch. I cannot find the
> skb->nf_bridge member. It seems that I need to use another patch. Is it
> true? Can I add the bridge-nf-0.0.10-against-2.4.20.diff patch directly on
> my Linux 2.4.20?

I'd use 2.4.21 with the 2.4-ebtables-brnf patch, see 
http://sourceforge.net/projects/ebtables/


cheers,
Bart

Re: ipq+AF8-set+AF8-verdict problem in bridge+-iptables

[Yong]

Hi Bart,

Thank you for your help.

I am using the bridge-nf-0.0.7-against-2.4.19.diff patch. I cannot find the skb->nf_bridge member. It seems that I need to use another patch. Is it true? Can I add the bridge-nf-0.0.10-against-2.4.20.diff patch directly on my Linux 2.4.20?

Thank you again!

Yong

----- Original Message ----- 
From: "Bart De Schuymer" <bdschuym@pandora.be>
To: "Yong" <sdssly@sina.com>; "Harald Welte" <laforge@netfilter.org>
Cc: <netfilter-devel@lists.netfilter.org>
Sent: Thursday, July 17, 2003 1:49 AM
Subject: Re: ipq_set_verdict problem in bridge+iptables


> On Wednesday 16 July 2003 03:09, Yong wrote:
> >  I want to use the iptable_queue in bridge+iptables environment. I can get
> > the packet in userspace using -j QUEUE command. However, If I change the
> > packet size. for example, I change the ping icmp packet size to 400, the
> > packet Ethernet header is changed. In my test, the MAC address is changed
> > to 0xffffffffff. I can capture this packet using sniffer tool. Since the
> > MAC address is changed, the other computer cannot receive the ICMP packet.
> 
> >  It seems that the bridge iptables patch changed something in the function
> > ipq_set_verdict().
> 
> Please test the patch below.
> 
> cheers,
> Bart
> 
> --- linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c.old 2003-07-16 19:35:07.000000000 +0200
> +++ linux-2.6.0-test1/net/ipv4/netfilter/ip_queue.c 2003-07-16 19:39:05.000000000 +0200
> @@ -353,6 +353,11 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, st
>   }
>   if (e->skb->sk)
>   skb_set_owner_w(newskb, e->skb->sk);
> +#if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
> + /* bridged packets already have their Ethernet header */
> + if (e->skb->nf_bridge)
> + memcpy(newskb->data - 16, e->skb->data - 16, 16);
> +#endif
>   kfree_skb(e->skb);
>   e->skb = newskb;
>   }
> 
> 
>