netdev - Re: [**EXTERNAL**] Re: DNAT with VRF support in Linux Kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3F90429C-AA9A-4205-ADBA-1A5D28F7B6B5@ciena.com>
Date:   Fri, 20 Jul 2018 22:02:21 +0000
From:   "D'Souza, Nelson" <ndsouza@...na.com>
To:     David Ahern <dsa@...ulusnetworks.com>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: [**EXTERNAL**] Re: DNAT with VRF support in Linux Kernel

Hi David,

Assuming your setup is as follows:

eth (ingress interface) --> br0 (bridge) --> mgmt (vrf)

is it possible that the DNAT rule matches on the eth ingress interface and not the mgmt. vrf device?

If the LOG rule does not match with dev == mgmt, it seems like the DNAT rule with dev ==mgmt wouldn't match as well?

Nelson

On 7/19/18, 8:42 PM, "David Ahern" <dsa@...ulusnetworks.com> wrote:

    On 7/19/18 7:52 PM, D'Souza, Nelson wrote:
    > Hi,
    > 
    >  
    > 
    > I'm seeing a VRF/Netfilter related issue on a system running a 4.14.52
    > Linux kernel.
    > 
    >  
    > 
    > I have an eth interface enslaved to l3mdev mgmtvrf device.
    > 
    >  
    > 
    > After reviewing
    > https://netdevconf.org/1.2/papers/ahern-what-is-l3mdev-paper.pdf, I was
    > expecting that the Netfilter NF_INET_PRE_ROUTING rules would be applied
    > to packets at the ingress eth interface and VRF device level. I
    > confirmed that this works for pre-routing rules added to the raw and
    > mangle tables at the ingress interface and VRF device level. I'm having
    > issues though with pre-routing rules that are applied to the NAT table.
    > NAT pre-routing rules only match on the ingress eth interface, not on
    > the mgmtVRF device. As a result, I'm not able to apply DNAT at the
    > mgmtvrf device level for IPv4 packets sourced from an external host and
    > destined to the eth interface ip address.
    > 
    >  
    > 
    > Also observed that a tcpdump on the mgmtvrf device captures packets
    > ingressing on the mgmtvrf.
    > 
    >  
    > 
    > Please let me know if my understanding is correct, and if so, if this is
    > a resolved/outstanding issue.
    > 
    
    I am puzzled by this one. My main dev server uses mgmt vrf with DNAT
    rules to access VMs running on it, so I know it works to some degree. e.g.,
    
    $ sudo iptables -nvL -t nat
    Chain PREROUTING (policy ACCEPT 409 packets, 68587 bytes)
     pkts bytes target     prot opt in     out     source
    destination
     8761  583K ACCEPT     all  --  br0    *       0.0.0.0/0
    0.0.0.0/0
        5   320 DNAT       tcp  --  *      *       0.0.0.0/0
    0.0.0.0/0            tcp dpt:2201 to:10.1.1.1:22
    ...
    
    But, adding LOG rule does not show a hit with dev == mgmt.