netfilter: disable parallel use of xtables and nftables nat
Get series with b4
b4 am [email protected]Versions newest first
- v1 Latest3 patches 5 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | netfilter: xtables: add and use xt_request_find_table_lockinclude/ net/ net/ +2 more | +65 | 1 reply | |
| 2/3 | netfilter: core: only allow one nat hook per hook pointinclude/ net/ net/ +2 more | +17 | 2 replies | |
| 3/3 | nftables: reject nat hook registration if prio is before conntracknet/ | +5 | 2 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [PATCH nf-next 0/3] netfilter: disable parallel use of xtables and nftables nat
The netfilter NAT core cannot deal with both nftables and ip(6)tables nat at the same time.
When both are active, one of the two will not work, depending on the order in which the modules were loaded.
NAT hooks install a NAT null binding in case the iptables/nftables nat chain did not specify a nat mapping.
Null bindings are needed to detect port collsisions between NAT-ed and non-NAT-ed connections.
This causes nftables NAT rules to not work when iptable_nat module is loaded, and vice versa because nat binding has already been attached when the second nat hook is consulted.
The alternative is to allow both at the same time.
This requirs new internal nat hooks to do the null binding, but doesn't handle the more fundamental issue of precedence.
Example:
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE
nft add rule ip nat postrouting oifname ppp0 ip protocol udp dport 53 snat to 10.1.1.1
should nft override iptables?
What if one is restored before the other (this seems to be the worst part as it could cause random behaviour with parallel init schemes ...)
So, better explicitly disallow this for now.