Question about security table priority in iptables-nft

Question about security table priority in iptables-nft

[js yu]

Hi,

I have a question about the priority used for the security table
by the iptables-nft backend.

In iptables/nft.c (v1.8.13), the built-in security chains use:

.prio = 150, /* NF_IP_PRI_SECURITY */

However, NF_IP_PRI_SECURITY is defined as 50 in the kernel,
and iptables-legacy uses that value for its security table.

As far as I understand, this results in the following relative
ordering within the INPUT hook:

iptables-legacy:
    filter (0)
    security (50)
    nat INPUT (100)

iptables-nft:
    filter (0)
    nat INPUT (100)
    security (150)

Is my understanding correct?

If so, could someone explain why iptables-nft uses priority 150
for the security table instead of 50? Is there a historical or
implementation reason for this difference, or am I missing
something about how these priorities are applied?

Source:
https://git.netfilter.org/iptables/tree/iptables/nft.c?h=v1.8.13

Thanks.

Re: Question about security table priority in iptables-nft

[Florian Westphal]

js yu <junsang.yu3@gmail.com> wrote:
> 
> In iptables/nft.c (v1.8.13), the built-in security chains use:
> 
> .prio = 150, /* NF_IP_PRI_SECURITY */
> 
> However, NF_IP_PRI_SECURITY is defined as 50 in the kernel,
> and iptables-legacy uses that value for its security table.

Yes, looks like a bug.  I pushed a change to correct this, thanks
for reporting.