Date: Tue, 10 Jun 2003 11:53:48 +0200 (CEST) From: Vaclav Petricek <petricek@sec.ms.mff.cuni.cz> To: Ruslan Ermilov <ru@freebsd.org> Cc: security@freebsd.org Subject: Re: redirect unauthorized users to a login page (natd as atransparent proxy) Message-ID: <Pine.BSF.4.50.0306101148160.89471-200000@sec.ms.mff.cuni.cz> In-Reply-To: <20030608230204.GB88799@sunbay.com> References: <Pine.BSF.4.50.0306082233300.86521-100000@sec.ms.mff.cuni.cz> <20030608220507.GA84706@sunbay.com> <20030608230204.GB88799@sunbay.com>
next in thread | previous in thread | raw e-mail | index | archive | help
This message is in MIME format. The first part should be readable text, while the remaining parts are likely unreadable without MIME-aware tools. Send mail to mime@docserver.cac.washington.edu for more info. --0-1938582547-1055238828=:89471 Content-Type: TEXT/PLAIN; charset=US-ASCII > > > I was hoping proxy_only will do the trick but it does not seem to have > > > any impact and the source address is changed anyway. > > > > > > A quick glance at the source did not help much to my understanding of the > > > proxy_only option. > > > > > Confirmed as a bug. The attached patch worked for me, > > please test it. You'll have to recompile and reinstall > > libalias(3), then recompile and reinstall natd(8) with > > new library. > > > I was too fast. This patch doesn't work well. It works > in a sense that it doesn't modify source IP address of > the proxied packets, but it doesn't work in a sense that > reply packets do not undergo de-aliasing. The attached > patch is verified to work. Please test it instead. The patch works. Thank you very much. I attach my attempt on a patch that should make it possible to ommit the alias_address and interface options in case proxy_only is specified. IMHO in that situation these options are not used and should not be required by natd.. Thank you for any comments on the diff (especially style). Should I fire a PR? Best regards, Vaclav --0-1938582547-1055238828=:89471 Content-Type: TEXT/PLAIN; charset=US-ASCII; name="libalias-proxy_only-noalias.diff" Content-Transfer-Encoding: BASE64 Content-ID: <Pine.BSF.4.50.0306101153480.89471@sec.ms.mff.cuni.cz> Content-Description: Content-Disposition: attachment; filename="libalias-proxy_only-noalias.diff" LS0tIG5hdGQuYy5vcmlnCVR1ZSBKdW4gMTAgMTE6MTE6MjggMjAwMw0KKysr IG5hdGQuYwlUdWUgSnVuIDEwIDExOjM1OjU5IDIwMDMNCkBAIC0xMzEsNiAr MTMxLDcgQEANCiAJc3RydWN0IHNvY2thZGRyX2luCWFkZHI7DQogCWZkX3Nl dAkJCXJlYWRNYXNrOw0KIAlpbnQJCQlmZE1heDsNCisJaW50CQkJcHJveHlf b25seTsNCiAvKiANCiAgKiBJbml0aWFsaXplIHBhY2tldCBhbGlhc2luZyBz b2Z0d2FyZS4NCiAgKiBEb25lIGFscmVhZHkgaGVyZSB0byBiZSBhYmxlIHRv IGFsdGVyIG9wdGlvbiBiaXRzDQpAQCAtMTcwLDcgKzE3MSw5IEBADQogLyoN CiAgKiBDaGVjayB0aGF0IHZhbGlkIGFsaWFzaW5nIGFkZHJlc3MgaGFzIGJl ZW4gZ2l2ZW4uDQogICovDQotCWlmIChhbGlhc0FkZHIuc19hZGRyID09IElO QUREUl9OT05FICYmIGlmTmFtZSA9PSBOVUxMKQ0KKw0KKwlwcm94eV9vbmx5 ID0gKFBhY2tldEFsaWFzU2V0TW9kZSgwLDApICYgUEtUX0FMSUFTX1BST1hZ X09OTFkpOw0KKwlpZiAoYWxpYXNBZGRyLnNfYWRkciA9PSBJTkFERFJfTk9O RSAmJiBpZk5hbWUgPT0gTlVMTCAmJiAhcHJveHlfb25seSkNCiAJCWVycngg KDEsICJhbGlhc2luZyBhZGRyZXNzIG5vdCBnaXZlbiIpOw0KIA0KIAlpZiAo YWxpYXNBZGRyLnNfYWRkciAhPSBJTkFERFJfTk9ORSAmJiBpZk5hbWUgIT0g TlVMTCkNCg== --0-1938582547-1055238828=:89471--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.50.0306101148160.89471-200000>