It appears that masquerading is not available in expr/verdic

Posting references here: <a href="https://github.com/torvalds/

Found it in expr/expr.go . <div class="highlight h

verdict masquerade is not available about nftables HOT 3 CLOSED

google commented on May 4, 2024

verdict masquerade is not available

from nftables.

Comments (3)

greenpau commented on May 4, 2024

Posting references here:

https://github.com/torvalds/linux/blob/47ec5303d73ea344e84f46660fff693c57641386/net/netfilter/Kconfig#L518-L525

from nftables.

greenpau commented on May 4, 2024

It looks like masq is not a verdict, but rather an expression. see https://git.netfilter.org/libnftnl/tree/src/expr/masq.c#n23

struct nftnl_expr_masq {
    uint32_t        flags;
    enum nft_registers  sreg_proto_min;
    enum nft_registers  sreg_proto_max;
};

static int
nftnl_expr_masq_set(struct nftnl_expr *e, uint16_t type,
               const void *data, uint32_t data_len)
{
    struct nftnl_expr_masq *masq = nftnl_expr_data(e);

    switch (type) {
    case NFTNL_EXPR_MASQ_FLAGS:
        memcpy(&masq->flags, data, sizeof(masq->flags));
        break;
    case NFTNL_EXPR_MASQ_REG_PROTO_MIN:
        memcpy(&masq->sreg_proto_min, data, sizeof(masq->sreg_proto_min));
        break;
    case NFTNL_EXPR_MASQ_REG_PROTO_MAX:
        memcpy(&masq->sreg_proto_max, data, sizeof(masq->sreg_proto_max));
        break;
    default:
        return -1;
    }
    return 0;
}

from nftables.

greenpau commented on May 4, 2024

Found it in expr/expr.go.

// Masq (Masquerade) is a special case of SNAT, where the source address is
// automagically set to the address of the output interface. See also
// https://wiki.nftables.org/wiki-nftables/index.php/Performing_Network_Address_Translation_(NAT)#Masquerading
type Masq struct {
    Random      bool
    FullyRandom bool
    Persistent  bool
    ToPorts     bool
    RegProtoMin uint32
    RegProtoMax uint32
}