netdev - Re: When routed to VRF, NF _output

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <7a4c2457-0eb5-43bc-9fb0-400a7ce045f2@average.org>
Date: Fri, 20 Jun 2025 18:04:08 +0200
From: Eugene Crosser <crosser@...rage.org>
To: nicolas.dichtel@...nd.com, netdev@...r.kernel.org
Cc: "netfilter-devel@...r.kernel.org" <netfilter-devel@...r.kernel.org>,
 David Ahern <dsahern@...nel.org>, Florian Westphal <fw@...len.de>,
 Pablo Neira Ayuso <pablo@...filter.org>
Subject: Re: When routed to VRF, NF _output_ hook is run unexpectedly

Thanks Nicolas,

On 20/06/2025 16:56, Nicolas Dichtel wrote:

>> It is possible, and very useful, to implement "two-stage routing" by
>> installing a route that points to a VRF device:
>>
>>     ip link add vrfNNN type vrf table NNN
>>     ...
>>     ip route add xxxxx/yy dev vrfNNN
>>
>> however this causes surprising behaviour with relation to netfilter
>> hooks. Namely, packets taking such path traverse _output_ nftables
>> chain, with conntracking information reset. So, for example, even
>> when "notrack" has been set in the prerouting chain, conntrack entries
>> will still be created. Script attached below demonstrates this behaviour.
> You can have a look to this commit to better understand this:
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8c9c296adfae9

I've seen this commit.
My point is that the packets are _not locally generated_ in this case,
so it seems wrong to pass them to the _output_ hook, doesn't it?

Regards,

Eugene


Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (489 bytes)