Re: Bug in nonlocal-bind (transparent proxy)?

[Nadav Har'El]

On Fri, Jun 08, 2001, Andrey Savochkin wrote about "Re: Bug in nonlocal-bind (transparent proxy)?":
> On Thu, Jun 07, 2001 at 05:08:25PM +0300, Nadav Har'El wrote:
> Hi,
> > Bind()ing a non-local address worked fine in the 2.2 line of kernels if a
> > certain compile-time option was enabled (TRANSPARENT_PROXY, or something
> > like that). But it no longer seems to be working in the 2.4 kernels (I
> > tried this on 2.4.2 coming from the Redhat 7.1 distribution).
> 
> It's not a bug, it's willful.

I don't understand what is willful: why does the ip_nonlocal_bind sysctl
exist if it doesn't help? Getting bind() to work (which is what
ip_nonlocal_bind does) but later not being able to connect() this socket
isn't very useful...

> To make a custom kernel where you can use non-local addresses more freely,
> find source address checks in ip_route_output_slow() and get rid of all of
> them except considering
> 	MULTICAST(saddr) || BADCLASS(saddr) || ZERONET(saddr) ||
> 		saddr == htonl(INADDR_BROADCAST)
> as invalid.

Thanks for the idea - I'll try doing that, and see if it works.

Is there any special reason why, instead of that ip_nonlocal_bind that doesn't
work, we don't have instead a compile-time variable (obviously a run-time
sysctl or socket-specific option would be even better) which enables both
ip_nonlocal_bind and the hacks needed to get connect() to work?

-- 
Nadav Har'El                        |       Friday, Jun  8 2001, 17 Sivan 5761
[e-mail]             |-----------------------------------------
Phone: [phone], ICQ 13349191 |A conscience does not prevent sin. It
http://nadav.harel.org.il           |only prevents you from enjoying it.