<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><span class="vcard"><a class="email" href="mailto:fw@strlen.de" title="Florian Westphal <fw@strlen.de>"> <span class="fn">Florian Westphal</span></a>
</span> changed
<a class="bz_bug_link
bz_status_NEW "
title="NEW - ptables: nftables layer breaks ipsec/policy keyword"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1290">bug 1290</a>
<br>
<table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>What</th>
<th>Removed</th>
<th>Added</th>
</tr>
<tr>
<td style="text-align:right;">CC</td>
<td>
</td>
<td>fw@strlen.de
</td>
</tr></table>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - ptables: nftables layer breaks ipsec/policy keyword"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1290#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - ptables: nftables layer breaks ipsec/policy keyword"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1290">bug 1290</a>
from <span class="vcard"><a class="email" href="mailto:fw@strlen.de" title="Florian Westphal <fw@strlen.de>"> <span class="fn">Florian Westphal</span></a>
</span></b>
<pre>(In reply to Arturo Borrero Gonzalez from <a href="show_bug.cgi?id=1290#c0">comment #0</a>)
<span class="quote">> Forwarded from Debian <a href="https://bugs.debian.org/912977">https://bugs.debian.org/912977</a>
>
> [...]
> Some keywords are not supported (like the 'policy' keyword for
> IPsec transforms). The bad part is, these rules are inserted
> *without* the matches, which makes in some cases your firewall useless.
>
> For ex:
> # iptables -F
> # iptables -A OUTPUT -m policy --dir out --pol ipsec --strict --mode tunnel
> -o eth0 -j ACCEPT
> # echo $?
> 0
> # nft list ruleset
> <cut>
> chain OUTPUT {
> type filter hook output priority 0; policy accept;
> oifname "eth0" counter packets 90 bytes 26085 accept
> }
> }</span >
This nft binary isn't linked against libxtables and thus won't show
the policy match. The rule *does* contain/use -m policy via nft_compat
expression.
<span class="quote">> As you can see, the inserted rule allows everything, while the expected
> behavior would be 'only if going through an IPsec tunnel'.
> Even worse: inserting the rule did not fail.</span >
iptables -A doesn't fail because this works.
<span class="quote">> Until the 'ipsec' (or 'secpath') keyword works properly (and supports
> all options), an acceptable behavior would be to reject the rule if one
> or more keywords are not supported by nftables.</span >
That would break a lot of things.
I'm not sure what best course of action is.
We could alter nft so it produces minimum info when libxtables isn't available,
e.g.:
chain OUTPUT {
oifname "eth0" # xt_policy counter packets 0 bytes 0 accept
This is easy to do, however, this doesn't allow restore via nftables either.
We could make nftables intentionall break ruleset:
chain OUTPUT {
oifname "eth0" nft_compat: xt_policy could not be translated # ERROR bytes 0
or add a drop
chain OUTPUT {
oifname "eth0" drop # ERROR xt_policy cannot be used from nft
or something like that.
Not sure. xt_policy.c in libxtables lacks translation for most of its options
so just linking nft with libxtables won't work either.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>