Want to test a patch: H323-masquerading in Linux 2.4 (SuSE 8.0)

Hallo,

Unter

http://m1b.de/content/know/linux/nat_h323_suse80.html

habe ich einen Patch, den ich auf der Seite von
David Hildenhagen (http://www.hildenhagen.de/netmeeting.htm) gefunden habe auf den Kernel 2.4.18 von SuSE80 portiert.
(Ich habe dazu einfach alle Rejects des Original-Patches manuell aufgelöst.)

Es funktioniert für mich. Vielleicht hat jemand Interesse daran, die Sache bei sich zu testen. Ich bin für Hinweise sehr dankbar.
Schöne Grüße,

Reinhard

Hi,

tr << MESSAGE

Hello,

I've put a patch by David Hildeshagen (url...) at <URL:http://m1b.de/content/know/linux/nat_h323_suse80.html> which was ported to Linux Kernel 2.4.18, as from SuSE 8.0. (I've manually resolved all the rejects.)

Works for me. Maybe somebody is interested in testing the whole thing. I'm looking forward to comments.

Kind regards, Reinhard.

That's the translation, for the interested...

Thunder

--./../...-/. -.--/---/..-/.-./..././.-../..-. .---/..-/.../- .-
--/../-./..-/-/./--..-- ../.----./.-../.-.. --./../...-/. -.--/---/..-
.- -/---/--/---/.-./.-./---/.--/.-.-.-
--./.-/-.../.-./.././.-../.-.-.-

thanks for the translation. 8)

I'd like to point out that there are some problems with the H.323 NAT modules:

+ for (i = 0; data < (data_limit - 5); data++, i++) {
+ data_ip = *((u_int32_t *)data);
+ if (data_ip == iph->saddr) {
+ data_port = *((u_int16_t *)(data + 4));

These modules scan byte by byte the packets for source IPs in order to perform NAT, and will modify the contained data based on what they find.

Consider the chances of your IP address coming up in some essentially random data. For example, if I had the ip address (iirc) 3.0.0.163 then the effect if the nat modules would be to rewrite the RFC1006 header which is part of these packets, thereby destroying the packet completely. (iirc the 4 byte RFC1006 header on packets leaving me contained the values 0x03 0x00 0x00 0xa3; since they'll always start with 0x03 0x00 <16-bit len>, anyone using a 3.0.x.x IP address with these modules are likely to rewrite the RFC1006 header.)

My main point here is that given the right IP address and this method of "NAT"ing the contained data, any data contained within the packet will be altered in some manner causing unexpected failures.

Unfortunately H.323 is a rather opaque protocol which appears to require lots of knowledge about the data contained within the packet to decode it properly.

(Oh, and guess who renumbered their network to eliminate the NAT rather than run the H.323 netfilter modules. Umm, and the IETF appear to have lost RFC1006 from their web site; either that or Mozilla is getting stressed again. However, RFC1006 has been updated by RFC2126 and the TPKT header can be found within that document.)

Russell King ([email protected])                The developer of ARM Linux
             http://www.arm.linux.org.uk/personal/aboutme.html

Hello,

the description on this page is now also available in english:
http://www.m1b.de/content/know/linux/nat_h323_suse80.html
I also added some comments for common problems.

regards,

Reinhard