netdev - Re: DNAT with VRF support in Linux Kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 19 Jul 2018 21:42:03 -0600
From:   David Ahern <dsa@...ulusnetworks.com>
To:     "D'Souza, Nelson" <ndsouza@...na.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: DNAT with VRF support in Linux Kernel

On 7/19/18 7:52 PM, D'Souza, Nelson wrote:
> Hi,
> 
>  
> 
> I'm seeing a VRF/Netfilter related issue on a system running a 4.14.52
> Linux kernel.
> 
>  
> 
> I have an eth interface enslaved to l3mdev mgmtvrf device.
> 
>  
> 
> After reviewing
> https://netdevconf.org/1.2/papers/ahern-what-is-l3mdev-paper.pdf, I was
> expecting that the Netfilter NF_INET_PRE_ROUTING rules would be applied
> to packets at the ingress eth interface and VRF device level. I
> confirmed that this works for pre-routing rules added to the raw and
> mangle tables at the ingress interface and VRF device level. I'm having
> issues though with pre-routing rules that are applied to the NAT table.
> NAT pre-routing rules only match on the ingress eth interface, not on
> the mgmtVRF device. As a result, I'm not able to apply DNAT at the
> mgmtvrf device level for IPv4 packets sourced from an external host and
> destined to the eth interface ip address.
> 
>  
> 
> Also observed that a tcpdump on the mgmtvrf device captures packets
> ingressing on the mgmtvrf.
> 
>  
> 
> Please let me know if my understanding is correct, and if so, if this is
> a resolved/outstanding issue.
> 

I am puzzled by this one. My main dev server uses mgmt vrf with DNAT
rules to access VMs running on it, so I know it works to some degree. e.g.,

$ sudo iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 409 packets, 68587 bytes)
 pkts bytes target     prot opt in     out     source
destination
 8761  583K ACCEPT     all  --  br0    *       0.0.0.0/0
0.0.0.0/0
    5   320 DNAT       tcp  --  *      *       0.0.0.0/0
0.0.0.0/0            tcp dpt:2201 to:10.1.1.1:22
...

But, adding LOG rule does not show a hit with dev == mgmt.