Match ORIGDEST in DNAT and filter rules #21

Merged

benvin merged 2 commits from benvin/origdest into main 2026-10-03 22:44:38 +10:00

Conversation 2 Commits 2 Files Changed 2

+130 -22

unkin-agent commented 2026-10-03 22:16:41 +10:00

Member

Copy Link

Copy Source

Shorewall ORIGDEST is ignored today, so rules meant for one public address match every address.

• DNAT/REDIRECT rules match ORIGDEST as daddr in prerouting (lists split, negated lists AND-ed)
• Input/output filter rules match ORIGDEST as daddr, guarded by nfproto for the inet table
• Forwarded rules with ORIGDEST fail to compile: post-DNAT daddr would make them dead (needs ct original daddr, google/nftables v0.3.0)
• ORIGDEST lists mixing IPv4 and IPv6 fail to compile

Shorewall ORIGDEST is ignored today, so rules meant for one public address match every address. - DNAT/REDIRECT rules match ORIGDEST as daddr in prerouting (lists split, negated lists AND-ed) - Input/output filter rules match ORIGDEST as daddr, guarded by nfproto for the inet table - Forwarded rules with ORIGDEST fail to compile: post-DNAT daddr would make them dead (needs ct original daddr, google/nftables v0.3.0) - ORIGDEST lists mixing IPv4 and IPv6 fail to compile

unkin-agent added 1 commit 2026-10-03 22:16:41 +10:00

Match ORIGDEST in DNAT and filter rules 34cf6dc9ab

unkin-agent commented 2026-10-03 22:17:38 +10:00

Author

Member

Copy Link

Copy Source

• internal/nftables/compiler.go:433 — filter rule with ORIGDEST in the forward chain emits daddr after prerouting DNAT, so it can never match and the rule is silently dead (traffic hits default drop) → return an error ("origdest on forward rules needs google/nftables >= v0.3.0 ct direction") for chain == "forward" instead of emitting an unmatchable rule; add a test for it.
• internal/nftables/compiler_test.go:1862 — no test for a forward-chain ORIGDEST rule or an IPv6 ORIGDEST DNAT/accept rule → add both.
• nit: internal/nftables/compiler.go:1412 — nfproto is derived from the first address only; a negated list mixing v4 and v6 gets one wrong-family guard → reject mixed-family negated lists with an error.

- internal/nftables/compiler.go:433 — filter rule with ORIGDEST in the forward chain emits `daddr` after prerouting DNAT, so it can never match and the rule is silently dead (traffic hits default drop) → return an error ("origdest on forward rules needs google/nftables >= v0.3.0 ct direction") for chain == "forward" instead of emitting an unmatchable rule; add a test for it. - internal/nftables/compiler_test.go:1862 — no test for a forward-chain ORIGDEST rule or an IPv6 ORIGDEST DNAT/accept rule → add both. - nit: internal/nftables/compiler.go:1412 — nfproto is derived from the first address only; a negated list mixing v4 and v6 gets one wrong-family guard → reject mixed-family negated lists with an error.

unkin-agent added 1 commit 2026-10-03 22:18:51 +10:00

Reject ORIGDEST on forwarded rules and mixed-family lists ff5a52b9e2

unkin-agent commented 2026-10-03 22:19:34 +10:00

Author

Member

Copy Link

Copy Source

No findings.

No findings.

benvin merged commit 532bd80a8a into main 2026-10-03 22:44:38 +10:00

benvin deleted branch benvin/origdest 2026-10-03 22:44:38 +10:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

wontfix

This won't be fixed

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/tomswall#21