netdev - Re: Inability to IPVS DR with nft dnat since 9971a514ed26

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190327093027.gmflo27icuhr326p@breakpoint.cc>
Date:   Wed, 27 Mar 2019 10:30:27 +0100
From:   Florian Westphal <fw@...len.de>
To:     Simon Kirby <sim@...tway.ca>
Cc:     Florian Westphal <fw@...len.de>, netdev@...r.kernel.org,
        netfilter-devel@...r.kernel.org, lvs-devel@...r.kernel.org
Subject: Re: Inability to IPVS DR with nft dnat since 9971a514ed26

Simon Kirby <sim@...tway.ca> wrote:
> We have been successfully using nft dnat and IPVS in DR mode on 4.9, 4.14
> kernels, but since upgrading to 4.19, such rules now appear to miss the
> IPVS input hook and instead appear to hit localhost (and "tcpdump -ni lo"
> shows the packets) instead of being forwarded to a real server.
> 
> I bisected this to 9971a514ed2697e542f3984a6162eac54bb1da98 ("netfilter:
> nf_nat: add nat type hooks to nat core").
> 
> It should be pretty easy to see this with a minimal setup:
> 
> /etc/nftables.conf:
> 
> table ip nat {
>         chain prerouting {
>                 type nat hook prerouting priority 0;
> 
> 		ip daddr $ext_ip dnat to $vip
> 	}
> 	chain postrouting {
> 		type nat hook postrouting priority 100;
> 
> 		# In theory this hook no longer needed since this commit,
> 		# but we also need to do some unrelated snatting.
> 	}
> }
> 
> /etc/sysctl.conf:
> 	
> net.ipv4.conf.all.accept_local = 1
> net.ipv4.vs.conntrack = 1
> 
> IPVS DR setup:
> 
> ipvsadm -A -t $vip:80 -s wrr
> ipvsadm -a -t $vip:80 -r $real_ip:80 -g -w 100

I have a hard time figuring out how to expand $ext_ip, $vip and $real_ip,
and where to place those addresses on the nft machine.