Re: [PATCH nf] netfilter: nft_tproxy: make it terminal

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, Sep 13, 2024 at 12:41:01PM +0200, Florian Westphal wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > On Fri, Sep 13, 2024 at 12:23:47PM +0200, Florian Westphal wrote:
> > > Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > > > tproxy action must be terminal since the intent of the user to steal the
> > > > traffic and redirect to the port.
> > > > Align this behaviour to iptables to make it easier to migrate by issuing
> > > > NF_ACCEPT for packets that are redirect to userspace process socket.
> > > > Otherwise, NF_DROP packet if socket transparent flag is not set on.
> > > 
> > > The nonterminal behaviour is intentional. This change will likely
> > > break existing setups.
> > > 
> > > nft add rule filter divert tcp dport 80 tproxy to :50080 meta mark set 1 accept
> > > 
> > > This is a documented example.
> > 
> > Ouch. Example could have been:
> > 
> >   nft add rule filter divert tcp dport 80 socket transparent meta set 1 tproxy to :50080
> 
> Yes, but its not the same.
> 
> With the statements switched, all tcp dport 80 have the mark set.
> With original example, the mark is set only if tproxy found a
> transparent sk.

Indeed, thanks for correcting me.

I'm remembering now why this was done to provide to address the ugly
mark hack that xt_TPROXY provides.

While this is making harder to migrate, making it non-terminal is
allowing to make more handling such as ct/meta marking after it.

I think we just have to document this in man nft(8).