Re: [RFC net-next v2 00/18] net: introduce ipxlat stateless IPv4/IPv6 translation

[Ralf Lici <ralf@mandelbit.com>]

On Fri, 06 Nov 2026 22:17:57 +0800, Xavier HSINYUAN <XavierHsinyuan@outlook.com> wrote:
> Hi Ralf,
>

Hi Xavier,

> Thanks for your v2 series!
>

Thanks for the review.

> Here is a question about netfilter hooks in ipxlat-lwt. In RFC v1,
> netdev-based ipxlat allows POST_ROUTING rules to be applied for
> original-family before translation. Currently LWT path translates first
> and does not check nf_hooks_lwtunnel to optionally run original-family
> POST_ROUTING before translation.
>
> Is this difference intentional since it keeps LWT path simple and leave
> such cases to netdev path, or would an optional pre-translation pass in
> LWT path also be worth considering?
>

Actually v2 has no netdevice attachment any more, the LWT is the only
harness in this series.

Aside from that, yes, the difference you describe follows from the v2
contract. The selecting route terminates original-family processing, so
that family only sees PRE_ROUTING (received) or LOCAL_OUT (local), and
FORWARD/POST_ROUTING/LOCAL_IN run in the translated family only. That is
indeed the first open question in the cover letter.

Looking into it again, there seems to be two concrete problems with that
contract:

- original-family conntrack entries are created at the entry hook and
  never confirmed, so stateful rules in that family see replies as new
  or invalid and a conventional ct state established firewall drops
  them;
- SNAT in the original family before translation is not possible, which
  rules out NAT44 in front of a CLAT and the NAPT66-based NAT64 recipe
  from the v1 documentation.

So I do not consider the current behaviour settled.

nf_hooks_lwtunnel is one way to add an original-family exit hook, and
seg6 is a good precedent for the hook placement. I am less sure about
the gate itself because it is global, cannot be switched off again, and
is off by default, so the default configuration would keep the problem.

Two alternatives I am evaluating are calling the exit hook
unconditionally, and moving the translation point to the LWT xmit stage
so the original family completes its normal path. I will come back with
a concrete proposal and a per-hook table.

Which setup do you have in mind: SNAT before translation, filtering, or
accounting?

-- 
Ralf Lici
Mandelbit Srl