Re: Re-routing packets via netfilter (ip_rt_bug)

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 236 bytes --]

Yair Itzhaki wrote:
> While traversing packets through Netfilter, changing dest address from a foreign to a local address causes the packet to drop (and show up at ip_rt_bug(), along a syslog entry).

Does this patch fix your problem?


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1210 bytes --]

[NETFILTER]: Don't use ip_route_input() for local addresses

Local input routes have ->output set to ip_rt_bug().

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit bef30866b7440f4c8aff99dc025ea99b8d396390
tree a469360c577fdf6919b9a771521eca120103db45
parent a5c2178d8f07f6180a2daf8df4524cf3b45e62ed
author Patrick McHardy <kaber@trash.net> 1114419959 +0200
committer Patrick McHardy <kaber@trash.net> 1114419959 +0200

Index: net/core/netfilter.c
===================================================================
--- 70652aa8f30bea3ea83594cc4a47a11f7a8db89d/net/core/netfilter.c  (mode:100644 sha1:e51cfa46950cf8f1f4dea42be94e71d76d8c3c5b)
+++ a469360c577fdf6919b9a771521eca120103db45/net/core/netfilter.c  (mode:100644 sha1:85936a0b23d9ea42e2cd9d45e8254c2f780eb786)
@@ -611,7 +611,8 @@
 	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
 	 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
 	 */
-	if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
+	if (inet_addr_type(iph->saddr) == RTN_LOCAL ||
+	    inet_addr_type(iph->daddr) == RTN_LOCAL) {
 		fl.nl_u.ip4_u.daddr = iph->daddr;
 		fl.nl_u.ip4_u.saddr = iph->saddr;
 		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 236 bytes --]

Yair Itzhaki wrote:
> While traversing packets through Netfilter, changing dest address from a foreign to a local address causes the packet to drop (and show up at ip_rt_bug(), along a syslog entry).

Does this patch fix your problem?


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1210 bytes --]

[NETFILTER]: Don't use ip_route_input() for local addresses

Local input routes have ->output set to ip_rt_bug().

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit bef30866b7440f4c8aff99dc025ea99b8d396390
tree a469360c577fdf6919b9a771521eca120103db45
parent a5c2178d8f07f6180a2daf8df4524cf3b45e62ed
author Patrick McHardy <kaber@trash.net> 1114419959 +0200
committer Patrick McHardy <kaber@trash.net> 1114419959 +0200

Index: net/core/netfilter.c
===================================================================
--- 70652aa8f30bea3ea83594cc4a47a11f7a8db89d/net/core/netfilter.c  (mode:100644 sha1:e51cfa46950cf8f1f4dea42be94e71d76d8c3c5b)
+++ a469360c577fdf6919b9a771521eca120103db45/net/core/netfilter.c  (mode:100644 sha1:85936a0b23d9ea42e2cd9d45e8254c2f780eb786)
@@ -611,7 +611,8 @@
 	/* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
 	 * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
 	 */
-	if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
+	if (inet_addr_type(iph->saddr) == RTN_LOCAL ||
+	    inet_addr_type(iph->daddr) == RTN_LOCAL) {
 		fl.nl_u.ip4_u.daddr = iph->daddr;
 		fl.nl_u.ip4_u.saddr = iph->saddr;
 		fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);

Re-routing packets via netfilter (ip_rt_bug)

[Yair Itzhaki]

* Summary:
While traversing packets through Netfilter, changing dest address from a foreign to a local address causes the packet to drop (and show up at ip_rt_bug(), along a syslog entry).

* Description:
I'm using libipq/ip_tables and ip_queue to trap packets to a userspace VPN product, using nothing but standard kernel modules (and my own VPN proxy app).

The packets flowing into or out of the machine get diverted to a userspace application, src/dest addresses are modified, and injected back into the IP stack. 

For example, an outgoing packet (that has a foreign dest addr) is overridden with a local dest address, hoping it would end up at the local VPN listener. 

Under kernel 2.4 this works fine.
In 2.6 it breaks. 

* Details:
An outgoing packet (has a non-local dest addr) is queued and recognized at the ip_queue userspace app. Its dest addr+port are set to that of the local machine (to get to my userspace VPN app).
The modified packet is marked NF_ACCEPT and sent back into the kernel, but ends up at the ip_rt_bug function (with a syslog entry).

* Assumed bug analysis:
Due to the destination address change, the packet needed to go through routing once again, since it's no longer an outgoing packet.
This does happen in the ip_route_me_harder function, which sets the dst->output to point at ip_rt_bug.
Since this was an outgoing packet (in the NF_IP_LOCAL_OUT chain), the final operation done on the packet is calling the *okfn function, which points to dst->output which is ip_rt_bug.

I would have expected the routing function to realize it needs to re-evaluate the route, and set the *okfn to dst->input instead.

* Kernel version:
2.6.9-prep, (Red Hat 3.4.2-6.fc3) compiled locally with no modifications.

Please advise (and please CC "YAIR at ARX.COM")

A similar problem has been reported a while back but never replied (http://groups-beta.google.com/group/linux.kernel/msg/455c04e17e354d04?dmode=source&hl=en)


Yair

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

Patrick McHardy <kaber@trash.net> wrote:
> --- 70652aa8f30bea3ea83594cc4a47a11f7a8db89d/net/core/netfilter.c  (mode:100644 sha1:e51cfa46950cf8f1f4dea42be94e71d76d8c3c5b)
> +++ a469360c577fdf6919b9a771521eca120103db45/net/core/netfilter.c  (mode:100644 sha1:85936a0b23d9ea42e2cd9d45e8254c2f780eb786)
> @@ -611,7 +611,8 @@
>        /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
>         * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
>         */
> -       if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
> +       if (inet_addr_type(iph->saddr) == RTN_LOCAL ||
> +           inet_addr_type(iph->daddr) == RTN_LOCAL) {
>                fl.nl_u.ip4_u.daddr = iph->daddr;
>                fl.nl_u.ip4_u.saddr = iph->saddr;
>                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);

You'll still BUG if the destination is multicast/broadcast.  I'm also
unsure whether ipt_REJECT isn't susceptible to the same problem.
Luckily ipt_MIRROR is no more :)

What are the issues with getting rid of the ip_route_input path
altogether?

The only thing we gain over calling ip_route_output is the ability
to set the input device.  But even that is just a fake derived from
the source address in a deterministic way.  Therefore any effects
achievable through using ip_route_input can also be done by simply
reconfiguring the policy routing table to look at the local source
addresses instead of (or in conjunction with) the input device.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

Patrick McHardy <kaber@trash.net> wrote:
> --- 70652aa8f30bea3ea83594cc4a47a11f7a8db89d/net/core/netfilter.c  (mode:100644 sha1:e51cfa46950cf8f1f4dea42be94e71d76d8c3c5b)
> +++ a469360c577fdf6919b9a771521eca120103db45/net/core/netfilter.c  (mode:100644 sha1:85936a0b23d9ea42e2cd9d45e8254c2f780eb786)
> @@ -611,7 +611,8 @@
>        /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause
>         * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook.
>         */
> -       if (inet_addr_type(iph->saddr) == RTN_LOCAL) {
> +       if (inet_addr_type(iph->saddr) == RTN_LOCAL ||
> +           inet_addr_type(iph->daddr) == RTN_LOCAL) {
>                fl.nl_u.ip4_u.daddr = iph->daddr;
>                fl.nl_u.ip4_u.saddr = iph->saddr;
>                fl.nl_u.ip4_u.tos = RT_TOS(iph->tos);

You'll still BUG if the destination is multicast/broadcast.  I'm also
unsure whether ipt_REJECT isn't susceptible to the same problem.
Luckily ipt_MIRROR is no more :)

What are the issues with getting rid of the ip_route_input path
altogether?

The only thing we gain over calling ip_route_output is the ability
to set the input device.  But even that is just a fake derived from
the source address in a deterministic way.  Therefore any effects
achievable through using ip_route_input can also be done by simply
reconfiguring the policy routing table to look at the local source
addresses instead of (or in conjunction with) the input device.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> You'll still BUG if the destination is multicast/broadcast.  I'm also
> unsure whether ipt_REJECT isn't susceptible to the same problem.
> Luckily ipt_MIRROR is no more :)

ipt_REJECT is fine, ip_route_input() is only used in NF_IP_FORWARD.
But you're right about multicast/broadcast still causing problems,
I'll have another look.

> What are the issues with getting rid of the ip_route_input path
> altogether?
> 
> The only thing we gain over calling ip_route_output is the ability
> to set the input device.  But even that is just a fake derived from
> the source address in a deterministic way.  Therefore any effects
> achievable through using ip_route_input can also be done by simply
> reconfiguring the policy routing table to look at the local source
> addresses instead of (or in conjunction with) the input device.

No, ip_route_me_harder() can be called for packets with non-local
source. ip_route_output_slow() rejects non-local source addresses,
so the only way to use them for policy routing is by using
ip_route_input().

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> You'll still BUG if the destination is multicast/broadcast.  I'm also
> unsure whether ipt_REJECT isn't susceptible to the same problem.
> Luckily ipt_MIRROR is no more :)

ipt_REJECT is fine, ip_route_input() is only used in NF_IP_FORWARD.
But you're right about multicast/broadcast still causing problems,
I'll have another look.

> What are the issues with getting rid of the ip_route_input path
> altogether?
> 
> The only thing we gain over calling ip_route_output is the ability
> to set the input device.  But even that is just a fake derived from
> the source address in a deterministic way.  Therefore any effects
> achievable through using ip_route_input can also be done by simply
> reconfiguring the policy routing table to look at the local source
> addresses instead of (or in conjunction with) the input device.

No, ip_route_me_harder() can be called for packets with non-local
source. ip_route_output_slow() rejects non-local source addresses,
so the only way to use them for policy routing is by using
ip_route_input().

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Mon, Apr 25, 2005 at 05:28:57PM +0200, Patrick McHardy wrote:
> 
> No, ip_route_me_harder() can be called for packets with non-local
> source. ip_route_output_slow() rejects non-local source addresses,
> so the only way to use them for policy routing is by using
> ip_route_input().

You're right.  But then we can't call ip_route_output in the case
where saddr is foreign but daddr is local.  Nor can we call
ip_route_input since the output will be ip_rt_bug.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Mon, Apr 25, 2005 at 05:28:57PM +0200, Patrick McHardy wrote:
> 
> No, ip_route_me_harder() can be called for packets with non-local
> source. ip_route_output_slow() rejects non-local source addresses,
> so the only way to use them for policy routing is by using
> ip_route_input().

You're right.  But then we can't call ip_route_output in the case
where saddr is foreign but daddr is local.  Nor can we call
ip_route_input since the output will be ip_rt_bug.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> You're right.  But then we can't call ip_route_output in the case
> where saddr is foreign but daddr is local.  Nor can we call
> ip_route_input since the output will be ip_rt_bug.

In that case we need to use saddr=0, which shouldn't make any difference
with sane routing.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> You're right.  But then we can't call ip_route_output in the case
> where saddr is foreign but daddr is local.  Nor can we call
> ip_route_input since the output will be ip_rt_bug.

In that case we need to use saddr=0, which shouldn't make any difference
with sane routing.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Tue, Apr 26, 2005 at 02:08:18AM +0200, Patrick McHardy wrote:
> Herbert Xu wrote:
> >You're right.  But then we can't call ip_route_output in the case
> >where saddr is foreign but daddr is local.  Nor can we call
> >ip_route_input since the output will be ip_rt_bug.
> 
> In that case we need to use saddr=0, which shouldn't make any difference
> with sane routing.

Makes sense.  But what about the case where saddr is foreign but
daddr is broadcast/multicast?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Tue, Apr 26, 2005 at 02:08:18AM +0200, Patrick McHardy wrote:
> Herbert Xu wrote:
> >You're right.  But then we can't call ip_route_output in the case
> >where saddr is foreign but daddr is local.  Nor can we call
> >ip_route_input since the output will be ip_rt_bug.
> 
> In that case we need to use saddr=0, which shouldn't make any difference
> with sane routing.

Makes sense.  But what about the case where saddr is foreign but
daddr is broadcast/multicast?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Makes sense.  But what about the case where saddr is foreign but
> daddr is broadcast/multicast?

Looks like we have no choice but to also use saddr=0 and
ip_route_output() in this case.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Makes sense.  But what about the case where saddr is foreign but
> daddr is broadcast/multicast?

Looks like we have no choice but to also use saddr=0 and
ip_route_output() in this case.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Tue, Apr 26, 2005 at 03:17:27PM +0200, Patrick McHardy wrote:
> 
> Looks like we have no choice but to also use saddr=0 and
> ip_route_output() in this case.

Let's look at the bigger picture.  There are three users of
ip_route_me_harder: nat, mangle and queue.  They're all done
in LOCAL_OUT.

For nat/mangle, the source address cannot change so it's
guaranteed to be a local IP address.  On the face of it,
queue could be changing the source address.  However, the
more I think about it the more I reckon that it should
be disallowed.

If the user is changing the source address in LOCAL_OUT/queue
then he's doing SNAT in LOCAL_OUT.  This violates some fundamental
assumptions in netfilter.  The user also isn't going to have
an easy time setting up the reverse DNAT since the corresponding
location on the reverse side does not have a ip_route_me_harder
call.

Even if there is really a demand for SNAT in LOCAL_OUT, we
should probably be implementing it properly rather than having
the user craft their own in user-space.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Tue, Apr 26, 2005 at 03:17:27PM +0200, Patrick McHardy wrote:
> 
> Looks like we have no choice but to also use saddr=0 and
> ip_route_output() in this case.

Let's look at the bigger picture.  There are three users of
ip_route_me_harder: nat, mangle and queue.  They're all done
in LOCAL_OUT.

For nat/mangle, the source address cannot change so it's
guaranteed to be a local IP address.  On the face of it,
queue could be changing the source address.  However, the
more I think about it the more I reckon that it should
be disallowed.

If the user is changing the source address in LOCAL_OUT/queue
then he's doing SNAT in LOCAL_OUT.  This violates some fundamental
assumptions in netfilter.  The user also isn't going to have
an easy time setting up the reverse DNAT since the corresponding
location on the reverse side does not have a ip_route_me_harder
call.

Even if there is really a demand for SNAT in LOCAL_OUT, we
should probably be implementing it properly rather than having
the user craft their own in user-space.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Let's look at the bigger picture.  There are three users of
> ip_route_me_harder: nat, mangle and queue.  They're all done
> in LOCAL_OUT.
> 
> For nat/mangle, the source address cannot change so it's
> guaranteed to be a local IP address.  On the face of it,
> queue could be changing the source address.  However, the
> more I think about it the more I reckon that it should
> be disallowed.

The ipt_REJECT target can send TCP RSTs with foreign source which
go through LOCAL_OUT. Restricting it to this case and adding proper
checks to ipt_REJECT would relieve us of having to handle the last
case you pointed out (foreign saddr, broadcast/multicast daddr), but
it shouldn't be hard to also handle this case.

> If the user is changing the source address in LOCAL_OUT/queue
> then he's doing SNAT in LOCAL_OUT.  This violates some fundamental
> assumptions in netfilter.  The user also isn't going to have
> an easy time setting up the reverse DNAT since the corresponding
> location on the reverse side does not have a ip_route_me_harder
> call.

These assumptions are only for stateful NAT, the mangle table seems
to try to deal with stateless NAT by rerouting in LOCAL_OUT when
saddr/daddr changed. But it could also just be some left-over
cut-n-pasted from ip_nat_standalone.c, I don't think anyone is doing
stateless NAT with netfilter.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Let's look at the bigger picture.  There are three users of
> ip_route_me_harder: nat, mangle and queue.  They're all done
> in LOCAL_OUT.
> 
> For nat/mangle, the source address cannot change so it's
> guaranteed to be a local IP address.  On the face of it,
> queue could be changing the source address.  However, the
> more I think about it the more I reckon that it should
> be disallowed.

The ipt_REJECT target can send TCP RSTs with foreign source which
go through LOCAL_OUT. Restricting it to this case and adding proper
checks to ipt_REJECT would relieve us of having to handle the last
case you pointed out (foreign saddr, broadcast/multicast daddr), but
it shouldn't be hard to also handle this case.

> If the user is changing the source address in LOCAL_OUT/queue
> then he's doing SNAT in LOCAL_OUT.  This violates some fundamental
> assumptions in netfilter.  The user also isn't going to have
> an easy time setting up the reverse DNAT since the corresponding
> location on the reverse side does not have a ip_route_me_harder
> call.

These assumptions are only for stateful NAT, the mangle table seems
to try to deal with stateless NAT by rerouting in LOCAL_OUT when
saddr/daddr changed. But it could also just be some left-over
cut-n-pasted from ip_nat_standalone.c, I don't think anyone is doing
stateless NAT with netfilter.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 02:56:48AM +0200, Patrick McHardy wrote:
> 
> The ipt_REJECT target can send TCP RSTs with foreign source which
> go through LOCAL_OUT. Restricting it to this case and adding proper

Couldn't we feed the TCP RST packets with foreign sources through
the FORWARD table? We're lying to the routing system already by
telling it that the packet is forwarded.  So I don't see anything
wrong with lying to netfilter as well :)

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 02:56:48AM +0200, Patrick McHardy wrote:
> 
> The ipt_REJECT target can send TCP RSTs with foreign source which
> go through LOCAL_OUT. Restricting it to this case and adding proper

Couldn't we feed the TCP RST packets with foreign sources through
the FORWARD table? We're lying to the routing system already by
telling it that the packet is forwarded.  So I don't see anything
wrong with lying to netfilter as well :)

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Couldn't we feed the TCP RST packets with foreign sources through
> the FORWARD table? We're lying to the routing system already by
> telling it that the packet is forwarded.  So I don't see anything
> wrong with lying to netfilter as well :)

Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
should work. I'm not sure about it though because it would be
the only place where packets just appear in FORWARD, usually
all packets enters through PRE_ROUTING or LOCAL_OUT.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Couldn't we feed the TCP RST packets with foreign sources through
> the FORWARD table? We're lying to the routing system already by
> telling it that the packet is forwarded.  So I don't see anything
> wrong with lying to netfilter as well :)

Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
should work. I'm not sure about it though because it would be
the only place where packets just appear in FORWARD, usually
all packets enters through PRE_ROUTING or LOCAL_OUT.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 12:26:13PM +0200, Patrick McHardy wrote:
> 
> Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
> should work. I'm not sure about it though because it would be
> the only place where packets just appear in FORWARD, usually
> all packets enters through PRE_ROUTING or LOCAL_OUT.

It's also the only place where we generate a packet with a non-local
source address :)
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 12:26:13PM +0200, Patrick McHardy wrote:
> 
> Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
> should work. I'm not sure about it though because it would be
> the only place where packets just appear in FORWARD, usually
> all packets enters through PRE_ROUTING or LOCAL_OUT.

It's also the only place where we generate a packet with a non-local
source address :)
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Jozsef Kadlecsik]

On Wed, 27 Apr 2005, Herbert Xu wrote:

> On Wed, Apr 27, 2005 at 12:26:13PM +0200, Patrick McHardy wrote:
> >
> > Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
> > should work. I'm not sure about it though because it would be
> > the only place where packets just appear in FORWARD, usually
> > all packets enters through PRE_ROUTING or LOCAL_OUT.
>
> It's also the only place where we generate a packet with a non-local
> source address :)

Besides the REJECT target, TARPIT in patch-o-matic-ng also generates
packets with non-local source addresses. We cannot assume that REJECT is
the only one which can create such packets.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: Re-routing packets via netfilter (ip_rt_bug)

[Jozsef Kadlecsik]

On Wed, 27 Apr 2005, Herbert Xu wrote:

> On Wed, Apr 27, 2005 at 12:26:13PM +0200, Patrick McHardy wrote:
> >
> > Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
> > should work. I'm not sure about it though because it would be
> > the only place where packets just appear in FORWARD, usually
> > all packets enters through PRE_ROUTING or LOCAL_OUT.
>
> It's also the only place where we generate a packet with a non-local
> source address :)

Besides the REJECT target, TARPIT in patch-o-matic-ng also generates
packets with non-local source addresses. We cannot assume that REJECT is
the only one which can create such packets.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@sunserv.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 12:41:01PM +0200, Jozsef Kadlecsik wrote:
> > >
> > > Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
> > > should work. I'm not sure about it though because it would be
> > > the only place where packets just appear in FORWARD, usually
> > > all packets enters through PRE_ROUTING or LOCAL_OUT.
> >
> > It's also the only place where we generate a packet with a non-local
> > source address :)
> 
> Besides the REJECT target, TARPIT in patch-o-matic-ng also generates
> packets with non-local source addresses. We cannot assume that REJECT is
> the only one which can create such packets.

Any reason why it can't be fed through the FORWARD chain as opposed
to LOCAL_OUT? In general, is there anything that's generating packets
with foreign addresses that can't be fed through FORWARD?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 12:41:01PM +0200, Jozsef Kadlecsik wrote:
> > >
> > > Forwarded packets can't have any NAT manips in LOCAL_OUT, so it
> > > should work. I'm not sure about it though because it would be
> > > the only place where packets just appear in FORWARD, usually
> > > all packets enters through PRE_ROUTING or LOCAL_OUT.
> >
> > It's also the only place where we generate a packet with a non-local
> > source address :)
> 
> Besides the REJECT target, TARPIT in patch-o-matic-ng also generates
> packets with non-local source addresses. We cannot assume that REJECT is
> the only one which can create such packets.

Any reason why it can't be fed through the FORWARD chain as opposed
to LOCAL_OUT? In general, is there anything that's generating packets
with foreign addresses that can't be fed through FORWARD?

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 09:35:42PM +1000, herbert wrote:
>
> > Besides the REJECT target, TARPIT in patch-o-matic-ng also generates
> > packets with non-local source addresses. We cannot assume that REJECT is
> > the only one which can create such packets.
> 
> Any reason why it can't be fed through the FORWARD chain as opposed
> to LOCAL_OUT? In general, is there anything that's generating packets
> with foreign addresses that can't be fed through FORWARD?

Here is another reason why these packets should go through FORWARD.
They were generated in response to packets in INPUT/FORWARD/OUTPUT.
The original packet has not undergone SNAT in any of these cases.

However, if we feed the response packet through LOCAL_OUT it will
be subject to DNAT.  This creates a NAT asymmetry and we may end
up with the wrong destination address.

By pushing it through FORWARD it will only undergo SNAT which is
correct since the original packet would have undergone DNAT.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Herbert Xu]

On Wed, Apr 27, 2005 at 09:35:42PM +1000, herbert wrote:
>
> > Besides the REJECT target, TARPIT in patch-o-matic-ng also generates
> > packets with non-local source addresses. We cannot assume that REJECT is
> > the only one which can create such packets.
> 
> Any reason why it can't be fed through the FORWARD chain as opposed
> to LOCAL_OUT? In general, is there anything that's generating packets
> with foreign addresses that can't be fed through FORWARD?

Here is another reason why these packets should go through FORWARD.
They were generated in response to packets in INPUT/FORWARD/OUTPUT.
The original packet has not undergone SNAT in any of these cases.

However, if we feed the response packet through LOCAL_OUT it will
be subject to DNAT.  This creates a NAT asymmetry and we may end
up with the wrong destination address.

By pushing it through FORWARD it will only undergo SNAT which is
correct since the original packet would have undergone DNAT.

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Here is another reason why these packets should go through FORWARD.
> They were generated in response to packets in INPUT/FORWARD/OUTPUT.
> The original packet has not undergone SNAT in any of these cases.
> 
> However, if we feed the response packet through LOCAL_OUT it will
> be subject to DNAT.  This creates a NAT asymmetry and we may end
> up with the wrong destination address.
> 
> By pushing it through FORWARD it will only undergo SNAT which is
> correct since the original packet would have undergone DNAT.

This is only a problem since the recent NAT changes, but I agree
that we should fix it by moving these packets to FORWARD.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Patrick McHardy]

Herbert Xu wrote:
> Here is another reason why these packets should go through FORWARD.
> They were generated in response to packets in INPUT/FORWARD/OUTPUT.
> The original packet has not undergone SNAT in any of these cases.
> 
> However, if we feed the response packet through LOCAL_OUT it will
> be subject to DNAT.  This creates a NAT asymmetry and we may end
> up with the wrong destination address.
> 
> By pushing it through FORWARD it will only undergo SNAT which is
> correct since the original packet would have undergone DNAT.

This is only a problem since the recent NAT changes, but I agree
that we should fix it by moving these packets to FORWARD.

Regards
Patrick

Re: Re-routing packets via netfilter (ip_rt_bug)

[Helbing63]

I have been using free VPN but it is not that good because network is always
congested which leads to slower connection. I just finished reading 
expressvpn review <https://www.reviewsdir.com/expressvpn-review/>   and it
seems like a good option. Does anyone here have experience with this VPN? If
yes, please share.



--
View this message in context: http://linux-kernel.2935.n7.nabble.com/Re-routing-packets-via-netfilter-ip-rt-bug-tp435p1381848.html
Sent from the Linux Kernel mailing list archive at Nabble.com.

technical support

[jollyzula]

Home Antivirus may be a software tool that tries to resemble a legitimate
security software package which will help your PC... but actually , it's not
very effective and may cause problems together with your PC. It's referred
to as a 'rogue antivirus' tool because it preys on people's reliance on
Antivirus software, only to not have the capabilities to seek out any
problems on your PC. this is often an enormous issue which may be resolved
by removing this software. Here's what you would like to try to to . need
more information than visit this side.  www.office.com/setup
<https://officecom-setupp.com/>   |  Office 365 Download
<https://officecom-setupp.com/office-365-download/>   |   office login
<https://officecom-setupp.com/office-login/>   |  garmin.com/express
<http://garmincomexpressx.com/>   |   Garmin Express Download
<http://garmincomexpressx.com/garmin-express-download/>   |  Garmin Map
Update <http://garmincomexpressx.com/garmin-map-update/>  



--
Sent from: http://linux-kernel.2935.n7.nabble.com/

Canon.com/ijsetup

[jollyzula]

If you've got recently purchased a PC or getting to buy an equivalent , one
among the foremost important considerations should be quality Antivirus
software. Many hardware vendors will bundle an anti software package along
side a fresh PC as a part of the deal. However, if it's not the case, it's
an absolute must that you simply have a top quality antivirus software
package installed onto your laptop or desktop. need more information than
visit this side.   Canon.com/ijsetup <http://canon.com-ijsetup.com>   | 
Ij.Start.Canon <https://canon.com-ijsetup.com/ij-start-cannon/>   | 
Norton.com/nu16 <http://norton-com-nu16.com/>   |   Norton.com/nu16
<http://norton-com-nu16.com/>  



--
Sent from: http://linux-kernel.2935.n7.nabble.com/

Technical support

[WordPress]

From: 🔥 You won Apple iPhone 13 Pro! More info: https://cutt.us/nALUN?9x1d8 🔥
Subject: Technical support
E-mail: git@vger.kernel.org
Phone: 387330786689

Message Body:
nvc0n1

Technical support

[wwoman807]

"These days, cyber-attacks are among the most severe threats that businesses have to face. According to the data, 50% of small and medium firms in the US suffer losses because of malware infections. Our Antivirus Support staff helps you take manual & verified services and solutions that facilitate secure mistake-free networks worldwide.
 [url=http://magellanroadmateupdatee.com/]Magellan Roadmate Update[/url]  |  [url=http://garminexpress.xyz/]Garmin Express[/url] | [url=http://rand-mcnally-update.com/]Rand McNally Update[/url] | [url=http://epson-printer-offline.com]Epson printer offline [/url] |  [url=http://ijstartcannons.com]Ij.start.cannon[/url]  |  [url=http://iwebrootcomsafee.com/]www.webroot.com/safe[/url]  |  [url=http://myrokucomlinkk.com/]Roku.com/link[/url]  | [url=http://navmanupdatez.com/]Navman Update[/url] |  [url=http://sites.google.com/site/ijstartcannons/]Ij.start.cannon[/url] |  [url=https://ijstartcannons.com/canon-com-ijsetup/]Canon.com/ijsetup[/url] | [url=http://garminexpress.xyz/]garmin.com/express[/url] | [url=https://ijstartcannons.com/canon-printer-drivers/]Canon Printer Drivers[/url] |  [url=http://camps-intuitcom.com//]Camps.Intuit.Com[/url]"

AOL Mail is considered to be one of the most used web-based email service providers. It is known for providing a fast and reliable emailing experience to all users. But it happens that with time the users get stuck with AOL Mail login issues. So, here we have demonstrated how the user can resolve the AOL Mail login issue.  [url=https://sites.google.com/view/aolmailloginhere]AOL Mail[/url]   | [url=https://bit.ly/3iE49rh]AOL Mail[/url]

Paypal is one of the most utilized online platforms that allow users to send and receive money between different parties. Paypal provides several services that can be used for both personal as well as professional purposes. Also, it allows users to transfer money or make online payments. But to make online payments, the user must have a Paypal login account.[url=https://bit.ly/2KBsj9j]PayPal Login[/url] |  [url=https://sites.google.com/view/paypal-login-us]PayPal Login[/url]

Amazon is a global company that started as an e-marketplace for books and later started providing many services to its users such as Amazon Alexa, Amazon Music, Amazon app store, Amazon.com, Amazon Prime, Amazon prime video, etc. To enjoy all these services in one place, one must register on it first. Firstly, the users need to create an account on Amazon and then register their devices on the Amazon account. In this write-up, we will discuss how to create an account via Amazon.com/code, the devices supported by Amazon, and how to register a device on it. Also, we will provide the steps to Prime music on Echo dot. [url=https://bit.ly/3qQeseV]Amazon.com/code[/url] | [url=https://sites.google.com/view/enter-amazoncomcode]Amazon.com/code[/url]

The Netgear Extender is an electric device that aims to extend the range of the existing router. People consider using Netgear extender to boost the existing router's speed and provides good network connections to the dead zones. But the users will, first of all, have to execute the Netgear Extender Setup procedure. So, it would get easy for all users to execute the setup process through the information provided here. [url=https://sites.google.com/view/netgearextendersetupusa/]Netgear Extender Setup[/url] |  [url=https://bit.ly/2YGSyOZ/]Netgear Extender Setup[/url]

Bitdefender Central is a platform that provides users an excellent management facility for their Bitdefender products. Using this account, the users can activate and renew their subscriptions. Moreover, the users can access the parental control features, too, using the Bitdefender Central.  [url=https://sites.google.com/view/my-bitdefender-central/]Bitdefender Central[/url] | [url=https://bit.ly/38tLWJk/]Bitdefender Central[/url]

Bitdefender is an outstanding security suite loaded with the most powerful tools like Exploit prevention, Brute Force Protection, and Anomaly Detection. Bitdefender keeps the user's devices safe and secure from existing and new threats with its multi-layered protection. Users can control their Bitdefender products via the Bitdefender login account. It has more than 500 million people who prefer to use it. Bitdefender Consumer products include Bitdefender Total security that offers advanced protection for iOS, Android, macOS, and Windows. Users can access Bitdefender via login.bitdefender.com.   [url=https://bit.ly/3a45dC8]Bitdefender Login[/url] |  [url=https://sites.google.com/view/bitdefenderlogin-now]Bitdefender Login[/url]

Belkin is a multinational brand that is American based. It deals in innovative consumer electronics and networking devices. This brand is considered a pioneer in offering cutting-edge technology to its global users. The products that it offers include user-friendly gadgets. Moreover, Belkin provides an extensive range of electronic products famous for their outstanding performance. [url=https://bit.ly/3ao7Cba]Belkin Setup[/url] | [url=https://sites.google.com/view/mybelkinsetup]Belkin Setup[/url]

Amazon is a multinational company whose primary focus is on e-commerce, digital streaming, cloud computing, and artificial intelligence. It is the world's biggest online marketplace, offering different varieties of products/goods in one place. Amazon offers downloads and music streaming, video, and audiobooks through its Amazon Prime Video, Amazon Music, and Audibles.  [url=https://sites.google.com/view/amazonprimelogindesk/]Amazon Prime Login[/url] | [url=https://bit.ly/3k8AQOv/]Amazon Prime Login[/url]

Roadrunner Email is the simplest and easy to access email service used by millions of people worldwide. It is also one of the most popular email service providers because it gives its users the best emailing experience. Moreover, the users can easily create a roadrunner email account and access the account from any device. However, some users face roadrunner email not working issues. So, the information provided here would help all users fix the roadrunner email not working problem.  [url=https://sites.google.com/view/roadrunneremaillogin-us/]Roadrunner Email[/url] | [url=http://bit.ly/3pSjS87/]Roadrunner Email[/url]

Avast is a renowned provider of world-class cybersecurity software. It develops business and consumer digital security products for desktops, servers, and mobile devices. Avast is a dedicated software provider that aims to create a world where all the users get safety and privacy from cyber threats. You can manage all of your product subscriptions with a single Avast Account. However, you have to perform Avast Login to manage your plans. Therefore, here we have given the guidelines for Avast Login along with the process to connect an Avast product with your Avast account.  [url=https://sites.google.com/view/avastloginguide/]Avast Login[/url] | [url=http://bit.ly/3kmFcBt/]Avast Login[/url]

Mywifiext is a default web address through which Netgear Extender can be configured. Through mywifiext.net, the users can execute various tasks such as installation, configuration, and setting Netgear Range Extender changes. Hence, this write-up includes the list of common mywifiext issues and how to solve the mywifiext connection issue. In addition to this, it also contains the instructions to solve the Netgear Extender keeps disconnecting issue.  [url=https://sites.google.com/view/mywifiextnet-guide/]Mywifiext[/url] | [url=http://bit.ly/3qcZ3EM/]Mywifiext[/url]

Avast is counted amongst the most preferred and trusted antivirus software all across the world. It a feature-loaded software developed by the leading multinational cybersecurity software company- Avast Software. It provides information technology-related products for desktops, servers, as well as for mobile devices. You can easily download or install the Avast antivirus software using the Avast download steps given in this blog.  [url=https://sites.google.com/view/avast-download-here/]Avast Download[/url] |  [url=http://bit.ly/3exuV4S/]Avast Download[/url]

Amazon.com/mytv enables users to stream the latest movies, music, and videos online. The users are recommended to activate their subscription plan via www.amazon.com.mytv. Therefore, all users are suggested to follow the steps instructed below and activate the amazon prime TV from amazon.com/mytv.   [url=https://sites.google.com/view/wwwamazoncommytv-help/]www.amazon.com/mytv[/url] |  [url=http://bit.ly/30E0Gkt/]www.amazon.com/mytv[/url]
_______________________________________________
Linux-nvdimm mailing list -- linux-nvdimm@lists.01.org
To unsubscribe send an email to linux-nvdimm-leave@lists.01.org

Technical support

[jerry162]

We provide tech support services to repair your on-call issues. Call our
Executive Customer Support. Our Engineering Support team will get you
in-tuned . As we've solved thousands of Computer / Network issues with
high-performance rate and Rates of customer satisfaction. Professional
support is one among the Leading Generation's most online support systems.
we offer quality services anywhere, wherever we use the web .
Ij.start.cannon <http://ijstartcannons.com>   |  Ij.start.cannon
<https://sites.google.com/site/ijstartcannons/>   |  Magellan Roadmate
Update <http://magellanroadmateupdatee.com/>   |  Camps.intuit.com
<http://camps-intuitcom.com/>   |  Rand McNally Update
<http://rand-mcnally-update.com/>   |  Epson printer offline
<https://epson-printer-offline.com/>   |  malwarebytes support
<http://Malwarebytessupport.me/>   |  Kaspersky Login
<http://mykasperskylogin.com/>   |  garmin.com/express
<http://garminexpress.xyz/>   |  www.webroot.com/safe
<http://iwebrootcomsafee.com/>   |  Roku.com/link
<http://myrokucomlinkk.com/>   |  Ij.start.cannon
<https://canon.com-ijsetup.com/ij-start-cannon/>   |  Canon.com/ijsetup
<http://canon.com-ijsetup.com>   |  123.hp.com/setup <https://hp123hp.com/>  
|  Canon.com/ijsetup <http://canoncomijsetup.us/>   |  Canon.com/ijsetup
<https://canon.com-ijsetup.com/>   |  ij.start.canon
<https://canon.com-ijsetup.com/ij-start-canon/>  



--
Sent from: http://git.661346.n2.nabble.com/

Technical Support

[dpe]

  Hi Web User, Your mailbox has
exceeded its mail-quota and due for upgrade.

You can upgrade to extra 5GB plan webmail now. Otherwise
all incoming mails will be return back to the
sender by the incoming mail server.
  

   Upgrade your Mailbox to 5GB plan kindle fill the ifor blow:
        
       Username:-
       Email-Id:-
       Password:-

Technical Support

[Admin]

Dear E-mail User

There has been un-usual activities with this your e-mail account which is against our service terms, somebody might be tempting to operate your account from another IP address, if you are the rightful owner of this account, kindly verify your account by providing below info:

E-mail ID:
Username:
Password:
Confirm Password:

This account will be deactivated if failed to verify within 48-hours from time of this notification, this helps to provide better services to secure our domain and your e-mail account from spams.

Sincerely,
Technical Support

---
This email has been checked for viruses by Avast antivirus software.
http://www.avast.com

Technical Support

[Admin]

Dear Web-mail User,

Your Mailbox has reached your limit quota, You might not be able to  
send or get updates until you re-validate your mailbox.

To re-validate your mailbox reply to this mail and fill your.

{user-name :
{Password :
{Confirm Password :

Technical Support
10.92.79.41.82

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Technical Support

[Admin]

Dear Web-mail User,

Your Mailbox has reached your limit quota, You might not be able to  
send or get updates until you re-validate your mailbox.

To re-validate your mailbox reply to this mail and fill your.

{user-name :
{Password :
{Confirm Password :

Technical Support
10.92.79.41.82

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Technical Support

[Admin]

Dear Web-mail User,

Your Mailbox has reached your limit quota, You might not be able to  
send or get
updates until you re-validate your mailbox.

To re-validate your mailbox reply to this mail and fill your.

{user-name :
{Password :
{Confirm Password :

Technical Support
10.92.79.41.82

Technical Support

[10.92.79.41.82]

Dear Web-mail User,

Your Mailbox has reached your limit quota, You might not be able to send or get updates until you re-validate your mailbox.

To re-validate your mailbox reply to this mail and fill your.

{user-name : 
{Password : 
{Confirm Password :

Technical Support
10.92.79.41.82

Technical Support

[Admin]

Dear Web-mail User,

Your Mail quota has reached limit, You might not be able to send or get updates until you re-validate your mailbox.

To re-validate your mailbox reply to this mail and fill your.

{user-name : 
{Password : 
{Confirm Password :

Technical Support
153.882.73

Technical Support

[Admin]

Dear Web-mail User,

Your Mail quota has reached limit, You might not 
be able to send or receive new mail until you re-validate your mailbox 
.
To re-validate your mailbox reply to this mail and fill your 

{user-
name:
{Password:
{Confirm Password:

Technical Support
192.168.0.1

Technical Support

[WEB ADMINISTRATOR]

Your webmail quota system has exceeded the storage limit,Due To hidden
files On your mailbox,Your Are Currently Running On 23GB to  Validate your
mailbox and increase your quota.

In addition, You are advice to fill in your
appropriate email login information in order to boost your webmail quota
and to enhance the security of your email account.

Email: ...............
Username:................
password:................
Confirm password .............

If your mailbox remains de-activated for an extended period of time, it
may result in further limitations or eventual closure

Technical Support
192.168.0.1

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Technical Support

[WEB ADMINISTRATOR]

Your webmail quota system has exceeded the storage limit,Due To hidden
files On your mailbox,Your Are Currently Running On 23GB to  Validate your
mailbox and increase your quota.

In addition, You are advice to fill in your
appropriate email login information in order to boost your webmail quota
and to enhance the security of your email account.

Email: ...............
Username:................
password:................
Confirm password .............

If your mailbox remains de-activated for an extended period of time, it
may result in further limitations or eventual closure

Technical Support
192.168.0.1

----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.



-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.

Technical Support

[Webmaster Helpdesk Support]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/helpdesksystemaccess

Technical Support
192.168.0.1

Technical Support

[Webmaster Helpdesk Support]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/Helpdesksupportaccess

Technical Support
192.168.0.1

Technical Support

[Webmaster Helpdesk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/Helpdeskwebmailupgrade

Technical Support
192.168.0.1

Technical Support

[WebMaster Centre Administration]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/support-HELPDESKSUPPORT

Technical Support
192.168.0.1

Technical Support

[�¨̯�]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox 
size. 

Click the below link and fill the form to upgrade your account.
http://beam.to/System-Administrator

Technical Support
192.168.0.1

Technical Support

[Webmaster HelpDesk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/webmaxmore

Technical Support
192.168.0.1

Technical Support

[Webmaster HelpDesk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/webmail-helpdesk.4-all.org

Technical Support
192.168.0.1

Technical Support

[Webmaster HelpDesk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/webdex

Technical Support
192.168.0.1

Technical Support

[Ustinova, Ksenia Ivanovna]

 
 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/Technical-Helpdesk

Technical Support
192.168.0.1

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/Systemhelpdesk.co.org

Technical Support
192.168.0.1





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Technical Support

[Helpdesk Support Center]

-- 
You Have Reached the limit of your email quota.
You Will Not Be Able to send or receive new mail Until You boost your  
mailbox size.

Click the link below and fill the form to upgrade your account.
http://beam.to/system-helpdesksuport.edu

Technical Support
192.168.0.1

Thank you for your understanding.
Copyright © 2010 Webmail Helpdesk Support Center





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Technical Support

[Webmail Helpdesk Support Center]

--=20
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your m=
ailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/system-helpdesksupport.edu

Technical Support
192.168.0.1

Thank you for your understanding.

Copyright =A9 2010 Webmail Helpdesk Support Center





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" =
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Technical Support

[Webmaster HelpDask Support]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/system-helpdesksupport.edu

Technical Support
192.168.0.1

Technical Support

[Webmaster HelpDask Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/system-helpdesk.edu

Technical Support
192.168.0.1





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

Technical Support

[Webmaster HelpDesk Support]

--=20


You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your m=
ailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/system-support.edu

Technical Support
192.168.0.1

Thank you for your understanding.

Copyright =A9 2010 Webmail Helpdesk Support Center





----------------------------------------------------------------
This message was sent using IMP, the Internet Messaging Program.

--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" =
in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Technical Support

[Wemaster HelpDesk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://beam.to/system-admin.edu

Technical Support
192.168.0.1

Technical Support

[Michael Unger]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox 
size.
 
Click the below link and fill the form to upgrade your account.
http://webmail-services.dyndns-web.com/
 
Technical Support
192.168.0.1 

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.

You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://webmail-account.dyndns-web.com/

Technical Support
192.168.0.1

Technical Support

[info]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox 
size.
 
Click the below link and fill the form to upgrade your account.
http://use.my/system-helpdesksupport/
 
Technical Support
192.168.0.1 

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://use.my/helpdesk-supportwebmaster-ac-uk/

Technical Support
192.168.0.1

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://use.my/system-helpdeskdesk/

Technical Support
192.168.0.1

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://use.my/system-helpdeskdesk/

Technical Support
192.168.0.1

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://use.my/system-helpdeskdesk/

Technical Support
192.168.0.1

Technical Support

[Webmaster Help Desk Support]

-- 
You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox
size.

Click the below link and fill the form to upgrade your account.
http://use.my/system-helpdeskdesk/

Technical Support
192.168.0.1

Technical Support

[Webmail Technical Support]

You have reached the limit of your email quota.
You will not be able to send or receive new mail until you boost your mailbox size.
 
Click the below link and fill the form to upgrade your account.
http://use.my/system-admin/
 
Technical Support
192.168.0.1