forked from Minki/linux
d5608a0578
Detect and rewrite a prefix embedded in an ICMPv6 original packet that was rewritten by a corresponding DNPT/SNPT rule so it will be recognised by the host that sent the original packet. Example Rules in effect on the 1:2:3:4::/64 + 5:6:7:8::/64 side router: * SNPT src-pfx 1:2:3:4::/64 dst-pfx 5:6:7:8::/64 * DNPT src-pfx 5:6:7:8::/64 dst-pfx 1:2:3:4::/64 No rules on the 9🅰️b:c::/64 side. 1. 1:2:3:4::1 sends UDP packet to 9🅰️b:c::1 2. Router applies SNPT changing src to 5:6:7:8::ffef::1 3. 9🅰️b:c::1 receives packet with (src 5:6:7:8::ffef::1 dst 9🅰️b:c::1) and replies with ICMPv6 port unreachable to 5:6:7:8::ffef::1, including original packet (src 5:6:7:8::ffef::1 dst 9🅰️b:c::1) 4. Router forwards ICMPv6 packet with (src 9🅰️b:c::1 dst 5:6:7:8::ffef::1) including original packet (src 5:6:7:8::ffef::1 dst 9🅰️b:c::1) and applies DNPT changing dst to 1:2:3:4::1 5. 1:2:3:4::1 receives ICMPv6 packet with (src 9🅰️b:c::1 dst 1:2:3:4::1) including original packet (src 5:6:7:8::ffef::1 dst 9🅰️b:c::1). It doesn't recognise the original packet as the src doesn't match anything it originally sent With this change, at step 4, DNPT will also rewrite the original packet src to 1:2:3:4::1, so at step 5, 1:2:3:4::1 will recognise the ICMPv6 error and provide feedback to the application properly. Conversely, SNPT will help when ICMPv6 errors are sent from the translated network. 1. 9🅰️b:c::1 sends UDP packet to 5:6:7:8::ffef::1 2. Router applies DNPT changing dst to 1:2:3:4::1 3. 1:2:3:4::1 receives packet with (src 9🅰️b:c::1 dst 1:2:3:4::1) and replies with ICMPv6 port unreachable to 9🅰️b:c::1 including original packet (src 9🅰️b:c::1 dst 1:2:3:4::1) 4. Router forwards ICMPv6 packet with (src 1:2:3:4::1 dst 9🅰️b:c::1) including original packet (src 9🅰️b:c::1 dst 1:2:3:4::1) and applies SNPT changing src to 5:6:7:8::ffef::1 5. 9🅰️b:c::1 receives ICMPv6 packet with (src 5:6:7:8::ffef::1 dst 9🅰️b:c::1) including original packet (src 9🅰️b:c::1 dst 1:2:3:4::1). It doesn't recognise the original packet as the dst doesn't match anything it already sent The change to SNPT means the ICMPv6 original packet dst will be rewritten to 5:6:7:8::ffef::1 in step 4, allowing the error to be properly recognised in step 5. Signed-off-by: Michael Zhou <mzhou@cse.unsw.edu.au> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> |
||
|---|---|---|
| .. | ||
| ip6_tables.c | ||
| ip6t_ah.c | ||
| ip6t_eui64.c | ||
| ip6t_frag.c | ||
| ip6t_hbh.c | ||
| ip6t_ipv6header.c | ||
| ip6t_mh.c | ||
| ip6t_NPT.c | ||
| ip6t_REJECT.c | ||
| ip6t_rpfilter.c | ||
| ip6t_rt.c | ||
| ip6t_srh.c | ||
| ip6t_SYNPROXY.c | ||
| ip6table_filter.c | ||
| ip6table_mangle.c | ||
| ip6table_nat.c | ||
| ip6table_raw.c | ||
| ip6table_security.c | ||
| Kconfig | ||
| Makefile | ||
| nf_conntrack_reasm.c | ||
| nf_defrag_ipv6_hooks.c | ||
| nf_dup_ipv6.c | ||
| nf_flow_table_ipv6.c | ||
| nf_log_ipv6.c | ||
| nf_reject_ipv6.c | ||
| nf_socket_ipv6.c | ||
| nf_tproxy_ipv6.c | ||
| nft_dup_ipv6.c | ||
| nft_fib_ipv6.c | ||
| nft_reject_ipv6.c | ||