From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50B11C432C0 for ; Tue, 26 Nov 2019 15:51:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 301352073F for ; Tue, 26 Nov 2019 15:51:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728091AbfKZPvb (ORCPT ); Tue, 26 Nov 2019 10:51:31 -0500 Received: from orbyte.nwl.cc ([151.80.46.58]:36544 "EHLO orbyte.nwl.cc" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728049AbfKZPvb (ORCPT ); Tue, 26 Nov 2019 10:51:31 -0500 Received: from n0-1 by orbyte.nwl.cc with local (Exim 4.91) (envelope-from ) id 1iZd7d-0003Tn-KN; Tue, 26 Nov 2019 16:51:25 +0100 Date: Tue, 26 Nov 2019 16:51:25 +0100 From: Phil Sutter To: "Serguei Bezverkhi (sbezverk)" Cc: Pablo Neira Ayuso , Florian Westphal , "netfilter-devel@vger.kernel.org" Subject: Re: Operation not supported when adding jump command Message-ID: <20191126155125.GD8016@orbyte.nwl.cc> Mail-Followup-To: Phil Sutter , "Serguei Bezverkhi (sbezverk)" , Pablo Neira Ayuso , Florian Westphal , "netfilter-devel@vger.kernel.org" References: <5248B312-60A9-48A7-B4CF-E00D1BDF1CD2@cisco.com> <20191126122110.GD795@breakpoint.cc> <3DBD9E39-A0DF-4A69-93CC-4344617BDB2F@cisco.com> <20191126153850.pblaoj4xklfz5jgv@salvia> <427E92A6-2FFA-47CF-BF3B-C08961C978C9@cisco.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <427E92A6-2FFA-47CF-BF3B-C08961C978C9@cisco.com> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: netfilter-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org Hi Serguei, On Tue, Nov 26, 2019 at 03:47:49PM +0000, Serguei Bezverkhi (sbezverk) wrote: > I totally get it that it is not possible in theory, but the matter of fact is in kubernetes somehow it works, maybe in some cases this check is not enforced, I do not know. If you are interested to investigate it further, please let me know as I said I have a cluster with these 2 rules configured. In another case I noticed that user-defined chains are a way to circumvent these types of functional restrictions. If that's good or bad is up to you to decide. ;) Regarding the desired functionality, I guess you're wandering the sinkhole-filled plains of undefined behaviour. Cheers, Phil