<html>
<head>
<base href="https://bugzilla.netfilter.org/">
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - nft_fib checks only the main route table when iif is a slave of a master vrf interface"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1761">1761</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>nft_fib checks only the main route table when iif is a slave of a master vrf interface
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>1.0.x
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>kernel
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>tsv1991@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Root case:
I want to do the NOTRACK in the PREROUTING chain for traffic that has a "daddr"
route pointing to a specific oif.
What I do:
"nft add rule inet notracks PREROUTING fib daddr oif br999 counter notrack"
The issue:
nftables always checks only main routing table, though the iif for traffic is
slave for master vrf interface also oif always will be slave for master vrf
interface.
Details:
We have VRF vrf1 and interfaces br100 and br999 as slaves of interface vrf1.
Interface br100 receives traffic. We want to make a notrack in the PREROUTING
hook for this traffic on condition that it will be forwarded to interface
br999. When we add rule "nft add rule inet notracks PREROUTING fib daddr oif
br999 counter notrack" we see that nftables checks only main fib table. I think
nftables should be able to discover the VRF master interface for the incoming
interface (br100) and check the fib vrf1 routing table.
I tried to research this issue and found that:
<a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv4/netfilter/nft_fib_ipv4.c#n87">https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/ipv4/netfilter/nft_fib_ipv4.c#n87</a>
I think the check should be extended and always consider is iif a slave for
master vrf interface for checking in right routing table.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>