[Bug 1220] New: Reverse path filtering using "fib" needs better documentation

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1220

            Bug ID: 1220
           Summary: Reverse path filtering using "fib" needs better
                    documentation
           Product: nftables
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: minor
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: f30 at f30.me

Reverse path filtering means dropping a packet if connections to its source IP
wouldn't use the same interface the packet arrived on. The nftables wiki states
[1] that this can be implemented like:

  nft add rule x prerouting fib saddr . iif oif eq 0 drop

Slides by Florian Westphal [2] suggest to use:

  nft add rule ... fib saddr . oif oif = 0 drop

But this fails with "Invalid argument" even when replacing "=" by "==" or "eq".

`fib saddr . iif oif eq 0` achieves the desired goal (except for bugs like the
one I'm going to report next), but I'm having a hard time figuring out why:
As far as I understand, `fib saddr . iif` looks up routing information based on
source address and input interface. `oif` then selects the output interface
from the looked up information.
Most other examples compare that result with an interface name, which is pretty
straight-forward. But I can't tell why and when `oif` would return 0 and why
this can be used for reverse path filtering.

I therefore suggest to add better documentation covering that aspect.

[1] https://wiki.nftables.org/wiki-nftables/index.php/Routing_information#fib
[2] http://www.strlen.de/talks/netdev12_nft_fib.pdf

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180130/cfbe1cbf/attachment.html>