fix(nft): terminate deception-TCP tproxy rule with accept (+ tproxy routing) #157

Merged

vxfemboy merged 1 commit from sp-fix-tproxy-accept into main

2026-07-09 02:09:37 +00:00

vxfemboy commented

2026-07-09 02:06:47 +00:00

(Migrated from github.com)

The prerouting deception-TCP → tproxy rule set the tproxy verdict but no terminal verdict, so the packet kept evaluating the chain and the tproxy socket assignment could be lost. Canonical nftables tproxy is meta mark set <m>; tproxy to :<port>; accept.

render.rs: reorder to mark set → tproxy → accept and add the terminating Statement::Accept. This sits after the C2c stateless-tcp queue rule (rule 7, a terminal verdict), so stateless-tcp ports are queued and never reach this rule — no interaction with C2c. Snapshot regenerated (ruleset_json_snapshot passes).
apply.rs: set net.ipv{4,6}.conf.all.src_valid_mark=0 in ensure_tproxy_route — the kernel's documented value that allows the mark-based asymmetric return path through reverse-path filtering ("transparent proxying").
smoke-deception.sh: disable veth RX/TX checksum offload in the routed-prefix smoke so userspace-built replies carry correct checksums.

Interactive-tier tproxy correctness fix (the likely cause of the deception-nft gate trouble). No product-behavior change to the stateless/XDP tiers.

Gate: blackwall-nft 21 tests pass (incl. snapshot), fmt + clippy --deny warnings clean.

The prerouting deception-TCP → tproxy rule set the tproxy verdict but **no terminal verdict**, so the packet kept evaluating the chain and the tproxy socket assignment could be lost. Canonical nftables tproxy is `meta mark set <m>; tproxy to :<port>; accept`. - **`render.rs`:** reorder to `mark set → tproxy → accept` and add the terminating `Statement::Accept`. This sits *after* the C2c stateless-tcp `queue` rule (rule 7, a terminal verdict), so stateless-tcp ports are queued and never reach this rule — no interaction with C2c. Snapshot regenerated (`ruleset_json_snapshot` passes). - **`apply.rs`:** set `net.ipv{4,6}.conf.all.src_valid_mark=0` in `ensure_tproxy_route` — the kernel's documented value that allows the mark-based asymmetric return path through reverse-path filtering ("transparent proxying"). - **`smoke-deception.sh`:** disable veth RX/TX checksum offload in the routed-prefix smoke so userspace-built replies carry correct checksums. Interactive-tier tproxy correctness fix (the likely cause of the `deception-nft` gate trouble). No product-behavior change to the stateless/XDP tiers. Gate: `blackwall-nft` 21 tests pass (incl. snapshot), fmt + clippy `--deny warnings` clean.