From: Florian Westphal <fw@strlen.de>
To: Tom Hacohen <tom@stosb.com>
Cc: Liping Zhang <zlpnobody@gmail.com>,
Pablo Neira Ayuso <pablo@netfilter.org>,
netfilter@vger.kernel.org,
Netfilter Developer Mailing List
<netfilter-devel@vger.kernel.org>
Subject: Re: nftables: masquerade sets wrong source address
Date: Thu, 22 Dec 2016 11:34:48 +0100 [thread overview]
Message-ID: <20161222103448.GA31504@breakpoint.cc> (raw)
In-Reply-To: <CAEvi_o96hh=ZfkofcjswUEDeH1Pi6wGD99qV+k87B=Z+QM-78w@mail.gmail.com>
Tom Hacohen <tom@stosb.com> wrote:
> I'm sorry for repeating myself, however I'd like to stress out again,
> that while your workaround fixes an inconsistency between iptables and
> nftables, the scenario itself is caused by the buggy behaviour of
> masquerade with "lo", and that needs to be fixed too. The workaround
> above, and any fixes to that issue will only fix the dropping of the
> packets, but the wrong rewrite will still be there.
The 'wrong rewrite' also occurs with iptables.
It doesn't cause connectivity issues because in iptables the nat table
always registers the output hook.
(I agree that nft masquerade should not cause these connectivity issues,
but I think proper ruleset fix is to use meta iif to restrict masq to
the correct interface(s)).
next prev parent reply other threads:[~2016-12-22 10:34 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-12-13 13:28 nftables: masquerade sets wrong source address Tom Hacohen
2016-12-13 14:32 ` /dev/rob0
2016-12-13 14:53 ` Tom Hacohen
2016-12-14 22:28 ` Pablo Neira Ayuso
2016-12-15 11:34 ` Tom Hacohen
2016-12-15 21:29 ` Pablo Neira Ayuso
2016-12-15 22:47 ` Tom Hacohen
2016-12-16 0:04 ` Tom Hacohen
2016-12-17 14:18 ` Liping Zhang
2016-12-19 2:25 ` Liping Zhang
2016-12-20 15:16 ` Tom Hacohen
2016-12-21 2:39 ` Liping Zhang
2016-12-22 10:26 ` Tom Hacohen
2016-12-22 10:34 ` Florian Westphal [this message]
[not found] ` <CAEvi_o8wV5GNk8JvSg96kP3WdDsVsf8PubRe=K1ZiD2+nBaYTg@mail.gmail.com>
2016-12-22 22:40 ` Tom Hacohen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161222103448.GA31504@breakpoint.cc \
--to=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
--cc=netfilter@vger.kernel.org \
--cc=pablo@netfilter.org \
--cc=tom@stosb.com \
--cc=zlpnobody@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox