All of lore.kernel.org
 help / color / mirror / Atom feed
From: David Miller <davem@davemloft.net>
To: Jason@zx2c4.com
Cc: netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Subject: Re: [PATCH v4 net 0/5] icmp: account for NAT when sending icmps from ndo layer
Date: Thu, 13 Feb 2020 14:19:21 -0800 (PST)	[thread overview]
Message-ID: <20200213.141921.2246207693168419669.davem@davemloft.net> (raw)
In-Reply-To: <20200211194709.723383-1-Jason@zx2c4.com>

From: "Jason A. Donenfeld" <Jason@zx2c4.com>
Date: Tue, 11 Feb 2020 20:47:04 +0100

> The ICMP routines use the source address for two reasons:
> 
> 1. Rate-limiting ICMP transmissions based on source address, so
>    that one source address cannot provoke a flood of replies. If
>    the source address is wrong, the rate limiting will be
>    incorrectly applied.
> 
> 2. Choosing the interface and hence new source address of the
>    generated ICMP packet. If the original packet source address
>    is wrong, ICMP replies will be sent from the wrong source
>    address, resulting in either a misdelivery, infoleak, or just
>    general network admin confusion.
> 
> Most of the time, the icmp_send and icmpv6_send routines can just reach
> down into the skb's IP header to determine the saddr. However, if
> icmp_send or icmpv6_send is being called from a network device driver --
> there are a few in the tree -- then it's possible that by the time
> icmp_send or icmpv6_send looks at the packet, the packet's source
> address has already been transformed by SNAT or MASQUERADE or some other
> transformation that CONNTRACK knows about. In this case, the packet's
> source address is most certainly the *wrong* source address to be used
> for the purpose of ICMP replies.
> 
> Rather, the source address we want to use for ICMP replies is the
> original one, from before the transformation occurred.
 ...

Series applied, thank you.


      parent reply	other threads:[~2020-02-13 22:19 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-11 19:47 [PATCH v4 net 0/5] icmp: account for NAT when sending icmps from ndo layer Jason A. Donenfeld
2020-02-11 19:47 ` [PATCH v4 net 1/5] icmp: introduce helper for nat'd source address in network device context Jason A. Donenfeld
2020-02-11 19:47 ` [PATCH v4 net 2/5] gtp: use icmp_ndo_send helper Jason A. Donenfeld
2020-02-11 19:47 ` [PATCH v4 net 3/5] sunvnet: " Jason A. Donenfeld
2020-02-11 19:47 ` [PATCH v4 net 4/5] wireguard: device: " Jason A. Donenfeld
2020-02-11 19:47 ` [PATCH v4 net 5/5] xfrm: interface: " Jason A. Donenfeld
2020-02-13 22:19 ` David Miller [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200213.141921.2246207693168419669.davem@davemloft.net \
    --to=davem@davemloft.net \
    --cc=Jason@zx2c4.com \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.