Re: [PATCH nf-next] netfilter: nft_compat: restrict raw table targets/matches

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> xt targets and matches declaring .table = "raw" (CT, NOTRACK) rely on
> only ever running in the legacy raw table's prerouting/output chains,
> ahead of conntrack. nft_compat_chain_validate_dependency() already
> enforces this kind of correspondence for "nat" by requiring the chain
> type to actually be NAT, but did nothing for "raw": a rule wrapping
> the CT target could be loaded into any hook and any priority via
> nft_compat, including after the real conntrack hook has already run.
> 
> The CT target attaches a conntrack template to the skb when none is
> set yet.
>
> Require that a "raw" table dependency actually matches what xtables
> enforces via the implict/builtin table dependency.

https://sashiko.dev/#/patchset/20261006231549.5901-1-fw%40strlen.de

| Does this strict equality check reject legitimate pre-defragmentation
| priorities?

I don't think so.  While its technically allowed, iptables-nft doesn't
support NF_IP_PRI_RAW_BEFORE_DEFRAG / NF_IP6_PRI_RAW_BEFORE_DEFRAG.

| If users recreate this state in nftables by creating a base chain at priority
| -450 and attach the xt_CT target via nft_compat, it seems this check would
| unintentionally reject NF_IP_PRI_RAW_BEFORE_DEFRAG and return -EINVAL.

I don't think that makes sense.  Native nft users would not use
nft_compat.

But if you prefer, I can relax this check to use ">" instead.