Development discussion of WireGuard
 help / color / mirror / Atom feed
* [RFC PATCH] wg-quick: linux: raise priority for mangle nft chain
@ 2020-04-27 17:26 Dominique Martinet
  2020-04-28  0:04 ` Jason A. Donenfeld
  2020-05-04 11:27 ` [PATCH] " Dominique Martinet
  0 siblings, 2 replies; 5+ messages in thread
From: Dominique Martinet @ 2020-04-27 17:26 UTC (permalink / raw)
  To: wireguard; +Cc: Dominique Martinet

Setting mark must be done as early as possible in case there are
ipv6 rpfilter rules in the mangle table (a nft filter could be done
later but with ip6tables this is the latest it can be checked).
Mark must be set before the return path check for it to work correctly.

priority -160 gets rendered as "mangle - 10" in nft list table,
and will correctly set the mark before other mangle prerouting rules
if there are any and same as before if there aren't.
---

I've been discussing with firewalld folks about the ipv6_rpfilter rules
they add which block wireguard setup with wg-quick on ipv6 endpoints by
default ; see https://github.com/firewalld/firewalld/issues/603 for
recap issue.
Long story short: they'll move the rpfilter rule to take effect later
(after mark is set) and add mark matching so that it works always with
nft backend, and sometimes with iptables backend.

Sometimes, because the ip6tables rpfilter module can only be used up to
mangle's prerouting table, and that one's priority with nft `hook
prerouting priority mangle` is "random" (depends on module load order?)

Changing the priority to load a bit earlier is harmless in the default
case and should just work for most people once they get a fixed
firewalld; I believe that is easier to change than try to document
the issue (e.g. telling people to use nft backend or disable
ipv6_rpfilter if they have issues as that is hard to debug)

Thanks!


 src/wg-quick/linux.bash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 7c2c002..9001c6a 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -222,7 +222,7 @@ add_default() {
 	local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd 
 	printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
 	printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority -300; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
+	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -160; }\n' "$nftcmd" "$pf" "$nftable"
 	printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
 	while read -r line; do
 		[[ $line =~ .*inet6?\ ([0-9a-f:.]+)/[0-9]+.* ]] || continue
-- 
2.26.2


^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [RFC PATCH] wg-quick: linux: raise priority for mangle nft chain
  2020-04-27 17:26 [RFC PATCH] wg-quick: linux: raise priority for mangle nft chain Dominique Martinet
@ 2020-04-28  0:04 ` Jason A. Donenfeld
  2020-04-28  6:56   ` Dominique Martinet
  2020-05-04 11:27 ` [PATCH] " Dominique Martinet
  1 sibling, 1 reply; 5+ messages in thread
From: Jason A. Donenfeld @ 2020-04-28  0:04 UTC (permalink / raw)
  To: Dominique Martinet; +Cc: WireGuard mailing list

This patch is missing a Signed-off-by line.

On Mon, Apr 27, 2020 at 2:02 PM Dominique Martinet
<asmadeus@codewreck.org> wrote:
> -       printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
> +       printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -160; }\n' "$nftcmd" "$pf" "$nftable"
>         printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"

Should this one be -160 too?

^ permalink raw reply	[flat|nested] 5+ messages in thread

* Re: [RFC PATCH] wg-quick: linux: raise priority for mangle nft chain
  2020-04-28  0:04 ` Jason A. Donenfeld
@ 2020-04-28  6:56   ` Dominique Martinet
  0 siblings, 0 replies; 5+ messages in thread
From: Dominique Martinet @ 2020-04-28  6:56 UTC (permalink / raw)
  To: Jason A. Donenfeld; +Cc: WireGuard mailing list

Jason A. Donenfeld wrote on Mon, Apr 27, 2020:
> This patch is missing a Signed-off-by line.

Sorry, will add and resend without RFC after some feedback.

> On Mon, Apr 27, 2020 at 2:02 PM Dominique Martinet
> <asmadeus@codewreck.org> wrote:
> > -       printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
> > +       printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -160; }\n' "$nftcmd" "$pf" "$nftable"
> >         printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
> 
> Should this one be -160 too?

Good question, the only two chains I'm aware of conflicting are
wg-quick's premangle and ip6tables's mangle/PREROUTING rpfilter
(e.g. a rule like:
ip6tables -t mangle -A PREROUTING -m rpfilter --validmark --invert -j DROP
)

As I understand rpfilter only makes sense on prerouting or broadly
speaking input (firewalld's nft backend will move the rpfilter rule all
the way down to filter input table, but that's not possible with
ip6tables) - it checks the incoming packet came through the same
interface we would send back to.
For postrouting the kernel already picked an interface for us so there
would be little point in checking the kernel would pick the same
interface again? So no rpfilter and marks aren't used in these rules.

If someone ever comes in with an ip6tables rule that relies on mark
checking in mangle POSTROUTING then it would help to move postmangle to
-160 as well, I'm just not aware of any.
Letting you decide on this one, I'd tend not to bother until a usecase
shows up, but I guess there's no harm in moving it anyway....

-- 
Dominique | Asmadeus

^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH] wg-quick: linux: raise priority for mangle nft chain
  2020-04-27 17:26 [RFC PATCH] wg-quick: linux: raise priority for mangle nft chain Dominique Martinet
  2020-04-28  0:04 ` Jason A. Donenfeld
@ 2020-05-04 11:27 ` Dominique Martinet
  2020-06-21 21:50   ` [PATCH RESEND] " Dominique Martinet
  1 sibling, 1 reply; 5+ messages in thread
From: Dominique Martinet @ 2020-05-04 11:27 UTC (permalink / raw)
  To: wireguard; +Cc: Dominique Martinet

Setting mark must be done as early as possible in case there are
ipv6 rpfilter rules in the mangle table (a nft filter could be done
later but with ip6tables this is the latest it can be checked).
Mark must be set before the return path check for it to work correctly.

priority -160 gets rendered as "mangle - 10" in nft list table,
and will correctly set the mark before other mangle prerouting rules
if there are any and same as before if there aren't.

Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
---
Well no more answer to RFC thread so resending as proper patch with sob.

Regarding the postrouting hook I'll stick to the same -150 as described
in my answer in other thread: I do not see any use case for it so safer
to leave it untouched for me.

Thanks,

 src/wg-quick/linux.bash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 7c2c002..9001c6a 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -222,7 +222,7 @@ add_default() {
 	local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd 
 	printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
 	printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority -300; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
+	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -160; }\n' "$nftcmd" "$pf" "$nftable"
 	printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
 	while read -r line; do
 		[[ $line =~ .*inet6?\ ([0-9a-f:.]+)/[0-9]+.* ]] || continue
-- 
2.26.2


^ permalink raw reply	[flat|nested] 5+ messages in thread

* [PATCH RESEND] wg-quick: linux: raise priority for mangle nft chain
  2020-05-04 11:27 ` [PATCH] " Dominique Martinet
@ 2020-06-21 21:50   ` Dominique Martinet
  0 siblings, 0 replies; 5+ messages in thread
From: Dominique Martinet @ 2020-06-21 21:50 UTC (permalink / raw)
  To: wireguard; +Cc: Dominique Martinet

Setting mark must be done as early as possible in case there are
ipv6 rpfilter rules in the mangle table (a nft filter could be done
later but with ip6tables this is the latest it can be checked).
Mark must be set before the return path check for it to work correctly.

priority -160 gets rendered as "mangle - 10" in nft list table,
and will correctly set the mark before other mangle prerouting rules
if there are any and same as before if there aren't.

Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
---
bump ?
I don't mind being plain refused, but no answer is annoying :)

Cheers,

 src/wg-quick/linux.bash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 7c2c002..9001c6a 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -222,7 +222,7 @@ add_default() {
 	local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd 
 	printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
 	printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority -300; }\n' "$nftcmd" "$pf" "$nftable"
-	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
+	printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -160; }\n' "$nftcmd" "$pf" "$nftable"
 	printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
 	while read -r line; do
 		[[ $line =~ .*inet6?\ ([0-9a-f:.]+)/[0-9]+.* ]] || continue
-- 
2.26.2


^ permalink raw reply	[flat|nested] 5+ messages in thread

end of thread, other threads:[~2020-06-21 21:50 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-27 17:26 [RFC PATCH] wg-quick: linux: raise priority for mangle nft chain Dominique Martinet
2020-04-28  0:04 ` Jason A. Donenfeld
2020-04-28  6:56   ` Dominique Martinet
2020-05-04 11:27 ` [PATCH] " Dominique Martinet
2020-06-21 21:50   ` [PATCH RESEND] " Dominique Martinet

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).