Re: [nft PATCH 2/2] masquerade: Complain if no prerouting chain exists

[Phil Sutter <phil@nwl.cc>]

On Fri, Apr 28, 2017 at 09:01:44AM +0200, Arturo Borrero Gonzalez wrote:
> On 27 April 2017 at 15:24, Phil Sutter <phil@nwl.cc> wrote:
> > As reported in netfilter bz#1105, masquerading won't work if there isn't
> > at least an empty base chain hooked into prerouting. In order to raise
> > awareness of this problem at the user, complain if a masquerading
> > statement is added and the table does not contain an appropriate
> > prerouting chain already.
> >
> > To not break user scripts which add the required chain at a later point,
> > accept the command anyway.
> >
> > A better solution would be to create the required chain as a dependency
> > and drop it again on return path or if the user adds his own one later,
> > though I doubt the extra effort is feasible here.
> >
> > Signed-off-by: Phil Sutter <phil@nwl.cc>
> > ---
> >  src/evaluate.c | 20 +++++++++++++++++++-
> >  1 file changed, 19 insertions(+), 1 deletion(-)
> >
> 
> This warning will be printed even in rulesets loaded with '-f'
> which first creates the masq rule an then the other chain.

Hmm. I tested it with the following config and it works fine:

| table ip nat {
| 	chain post {
| 		type nat hook postrouting priority 0; policy accept;
| 		oifname "veth2" masquerade
| 	}
| 
| 	chain pre {
| 		type nat hook prerouting priority 0; policy accept;
| 	}
| }

OK, with a config consisting of several 'add' commands, it indeed warns.

> I think is just a matter of documenting *everywhere* that this is the
> expected behaviour, not a bug.

Yeah, I should indeed have done that first, also because masquerade
statement is not documented at all yet.

Thanks, Phil