OpenBSD Journal

OpenBSD Gains Source Routing

Contributed by sean on from the yet another feature dept.

Robert Mooney writes:

Cedric Berger has checked in changes to the routing subsystem that allows packets to be routed based on their source address.
Cool stuff.

Here's the commit message:



CVSROOT:	/cvs
Module name:	src 
Changes by:	cedric@cvs.openbsd.org	2004/06/06 10:49:09 

Modified files:	 

sys/conf       : files 	
sys/net        : pf.c route.c route.h rtsock.c
sys/netinet    : in.h in_pcb.c ip_icmp.c ip_input.c ip_output.c ip_var.h
Added files:
sys/net        : route_src.c 
Log message:
extend routing table to be able to match and route packets based ontheir *source* 
IP address in addition to their destination address.routing table "destination" now 
contains a "struct sockaddr_rtin"for IPv4 instead of a "struct sockaddr_in".the
routing socket has been extended in a backward-compatible way.todo: PMTU enhancements,
ok deraadt@ mcbride@

(Comments are closed)

Comments

  1. By Anonymous Coward (67.153.107.130) on

    great, more ways to screw up routing. :P

    Comments

    1. By Lennie (82.74.129.164) on

      Ooh, I actually didn't know they did _not_ have it, it's actually something I need in some obscure situation.

      Well, they do now (in current only so, it's still months away from normal use), no worries, then. :-)

      I wonder what other policy routing I might be missing out on when I'd go with OpenBSD, instead of my current Linux router.

      I'm almost afraid Linux has better routing support, but OpenBSD is the better firewall.

      Maybe that's how I'll handle it, then. Using the tool for the job.

      BTW Does any1 know of an 'opensource' transparant HTTP-application-proxy ?

      So, you'd have a bridge and then pass packets for port 80 to the webserver through the HTTP-application-proxy, but the packets would still seem to come from the original IP, not the proxy.

      I'm really interrested in this as a solution to filter (with for example apache2/mod_securty) scary things from hitting webservers.

      Comments

      1. By Brad (216.209.80.7) brad at comstyle dot com on

        You could do this with PF before anyway.

      2. By nullogic (24.98.72.110) on

        transparent proxy: http://squid.visolve.com/squid/sqguide.htm google is your friend

    2. By Gernot (213.47.70.127) on

      Doesn't policy routing intrinsically screw up routing? It's up to your judgement whether the pros outweigh the cons. There are very good reasons why people want policy routing.

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]