|
Hi,
On Mon, Feb 17, 2014 at 04:32:06PM +0100, Art -kwaak- van Breemen wrote:
> A wrong dump (any since 3.10.27):
> 14:32:11.822345 IP6 2001:7b8:2ff:6f:2a02:310:0:2950 > ::80:104:0:0:80:104:
> ICMP6, packet too big, mtu 1472, length 1240
> 0x0000: 6000 aa5f 04d8 3a3c 2001 07b8 02ff 006f `.._..:<.......o
> 0x0010: 2a02 0310 0000 2950 0000 0000 0080 0104 *.....)P........
> 0x0020: 0000 0000 0080 0104 0200 0617 0000 05c0 ................
> 0x0030: 6000 0000 05a8 063b 2a02 0310 0000 0100 `......;*.......
> 0x0040: 0200 f8ff fe80 0004 2001 07b8 032d 0000 .............-..
> 0x0050: YYYY YYYY YYYY YYYY 0050 c723 7e6a 835c .d....66.P.#~j.\
> 0x0060: ca00 19c5 8010 0078 f3b6 0000 0101 080a .......x........
> 0x0070: c8df df1e 0945 23c2 4854 5450 2f31 2e31 .....E#.HTTP/1.1
> <snip>
>
> What we can clearly see in the wrong picture is this:
> source higher 64 bits is correct (my home gw address)
> source lower 64 bits is the higher 64 bits of the destination machine.
> destination higher 64 bits is the lower 64 bits of the destination machine
> destination lower 64 bits is the lower 64 bits of the destination machine.
> That last part in question is this on the loadbalancer:
> TCP [2a02:310:0:100:200:f8ff:fe80:4]:http wrr
> -> [2a02:310:0:2950::80:104]:http Masq 4 0 0
> -> [2a02:310:0:2950::80:204]:http Masq 4 0 0
>
> The addresses within the icmp6 packet itself are also not translated.
What I think happened is that the ipv6 headers themselves are
correctly handled, but that the ipv6 address in the icmp part is
written to the wrong place.
(See: net/netfilter/ipvs/ip_vs_core.c: ip_vs_nat_icmp_v6() )
So what happens is this:
ip6:source address is written,
icmp6:destination address is written
ip6:destination address is rewritten to correct destination machine
icmp6:source address is actually written to the ip6 source
address+8 bytes, overwriting the last 64 bits of ip6:saddr and
the first 64 bits of ip6:daddr...
I think there might be an of by wrong structsize problem here.
--
To unsubscribe from this list: send the line "unsubscribe lvs-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
