LKML Archive on
help / color / mirror / Atom feed
From: "Yair Itzhaki" <>
To: <>
Subject: Re-routing packets via netfilter (ip_rt_bug)
Date: Mon, 25 Apr 2005 11:49:38 +0200	[thread overview]
Message-ID: <> (raw)

* Summary:
While traversing packets through Netfilter, changing dest address from a foreign to a local address causes the packet to drop (and show up at ip_rt_bug(), along a syslog entry).

* Description:
I'm using libipq/ip_tables and ip_queue to trap packets to a userspace VPN product, using nothing but standard kernel modules (and my own VPN proxy app).

The packets flowing into or out of the machine get diverted to a userspace application, src/dest addresses are modified, and injected back into the IP stack. 

For example, an outgoing packet (that has a foreign dest addr) is overridden with a local dest address, hoping it would end up at the local VPN listener. 

Under kernel 2.4 this works fine.
In 2.6 it breaks. 

* Details:
An outgoing packet (has a non-local dest addr) is queued and recognized at the ip_queue userspace app. Its dest addr+port are set to that of the local machine (to get to my userspace VPN app).
The modified packet is marked NF_ACCEPT and sent back into the kernel, but ends up at the ip_rt_bug function (with a syslog entry).

* Assumed bug analysis:
Due to the destination address change, the packet needed to go through routing once again, since it's no longer an outgoing packet.
This does happen in the ip_route_me_harder function, which sets the dst->output to point at ip_rt_bug.
Since this was an outgoing packet (in the NF_IP_LOCAL_OUT chain), the final operation done on the packet is calling the *okfn function, which points to dst->output which is ip_rt_bug.

I would have expected the routing function to realize it needs to re-evaluate the route, and set the *okfn to dst->input instead.

* Kernel version:
2.6.9-prep, (Red Hat 3.4.2-6.fc3) compiled locally with no modifications.

Please advise (and please CC "YAIR at ARX.COM")

A similar problem has been reported a while back but never replied (


             reply	other threads:[~2005-04-25  8:47 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2005-04-25  9:49 Yair Itzhaki [this message]
2005-04-25  9:07 ` Patrick McHardy
2005-04-25 10:52   ` Herbert Xu
2005-04-25 15:28     ` Patrick McHardy
2005-04-25 21:34       ` Herbert Xu
2005-04-26  0:08         ` Patrick McHardy
2005-04-26  0:39           ` Herbert Xu
2005-04-26 13:17             ` Patrick McHardy
2005-04-26 23:28               ` Herbert Xu
2005-04-27  0:56                 ` Patrick McHardy
2005-04-27  1:07                   ` Herbert Xu
2005-04-27 10:26                     ` Patrick McHardy
2005-04-27 10:30                       ` Herbert Xu
2005-04-27 10:41                         ` Jozsef Kadlecsik
2005-04-27 11:35                           ` Herbert Xu
2005-04-27 11:54                             ` Herbert Xu
2005-04-27 12:05                               ` Patrick McHardy
2017-07-10  9:20 ` Helbing63
2020-07-23  7:25 ` technical support jollyzula
2020-07-23  7:25 ` jollyzula
2005-04-25 16:51 Re-routing packets via netfilter (ip_rt_bug) Yair Itzhaki
2005-04-26 15:39 Yair Itzhaki
2005-05-02 17:17 Yair Itzhaki
2005-07-14 12:27 ` Ric Wheeler

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \
    --subject='Re: Re-routing packets via netfilter (ip_rt_bug)' \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).