mbox series

[nf-next,0/3] netfilter: disable parallel use of xtables and nftables nat

Message ID 20171208160155.968-1-fw@strlen.de
Headers show
Series netfilter: disable parallel use of xtables and nftables nat | expand

Message

Florian Westphal Dec. 8, 2017, 4:01 p.m. UTC 
The netfilter NAT core cannot deal with both nftables and ip(6)tables nat
at the same time.
When both are active, one of the two will not work, depending on the
order in which the modules were loaded.

NAT hooks install a NAT null binding in case the iptables/nftables
nat chain did not specify a nat mapping.

Null bindings are needed to detect port collsisions between NAT-ed and
non-NAT-ed connections.

This causes nftables NAT rules to not work when iptable_nat module is
loaded, and vice versa because nat binding has already been attached
when the second nat hook is consulted.

The alternative is to allow both at the same time.
This requirs new internal nat hooks to do the null binding, but doesn't
handle the more fundamental issue of precedence.

Example:

iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
nft add rule ip nat postrouting oifname ppp0 ip protocol udp dport 53 snat to 10.1.1.1

should nft override iptables?
What if one is restored before the other (this seems to be the worst part as it could
cause random behaviour with parallel init schemes ...)

So, better explicitly disallow this for now.

--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html