Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for nftables #2605

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

Add support for nftables #2605

wants to merge 4 commits into from

Conversation

ghost
Copy link

@ghost ghost commented Dec 23, 2020

With the release of EL8, nftables has become the default firewall
implementation on minimal installs of CentOS/OEL/RHEL8. While an
iptables driver is available (both in libnetwork and a mapper in
nftables itself), this is not guaranteed to be present. firewalld
pulls in iptables, but firewalld itself does not yet support raw
commands to nftables.

iptables calls were heavily enmeshed in libnetwork. It was
necessary to create a relatively large interface in order to
break the coupling to native iptables implementations, but this
offers the flexibility to support or add other drivers in the
future

Remaining changes are needed to:

drivers/bridge/link.go
drivers/bridge/setup_tables.go
drivers/overlay/encryption.go
drivers/overlay/filter.go
resolver_unix.go
service_linux.go

But all are sall in scope compared to this, and are translating
remaining raw iptables rules to nftables and adding additional
interface methods/methods for re-used logic

@ghost ghost marked this pull request as draft December 23, 2020 01:30
@arkodg
Copy link
Contributor

arkodg commented Dec 24, 2020

thanks for your contribution @evol262, adding the interfaces for the iptble layer will make it simpler to extend the codebase and the nftable implementation will improve the speed of programming the network rules.
looking forward to the final draft !

Ryan Barry added 4 commits January 21, 2021 19:13
With the release of EL8, nftables has become the default firewall
implementation on minimal installs of CentOS/OEL/RHEL8. While an
iptables driver is available (both in libnetwork and a mapper in
nftables itself), this is not guaranteed to be present. firewalld
pulls in iptables, but firewalld itself does not yet support raw
commands to nftables.

iptables calls were heavily enmeshed in libnetwork. It was
necessary to create a relatively large interface in order to
break the coupling to native iptables implementations, but this
offers the flexibility to support or add other drivers in the
future

Remaining changes are needed to:

    drivers/bridge/link.go
    drivers/bridge/setup_tables.go
    drivers/overlay/encryption.go
    drivers/overlay/filter.go
    resolver_unix.go
    service_linux.go

But all are sall in scope compared to this, and are translating
remaining raw iptables rules to nftables and adding additional
interface methods/methods for re-used logic

Signed-off-by: Ryan Barry <[email protected]>
nftables does not yet seem to support marking mangled packets
using the same mechanism as iptables for encrypted vxlan, but this
is a relatively isolated use case outside of explicit enablement
in swarm

Add a few more methods to the firewall interface to support
per-interface forwarding and rules. Add convenience rules for
drop/accept (nftables does not have a "-j DROP|ACCEPT" mechanism,
so the mechanics need to be slightly different) to keep purging
implementation-specific code from the drivers

Signed-off-by: Ryan Barry <[email protected]>
Only remanining are resolver and setup_tables

Signed-off-by: Ryan Barry <[email protected]>
Signed-off-by: Ryan Barry <[email protected]>
@ghost ghost marked this pull request as ready for review January 22, 2021 00:14
@passcod
Copy link

passcod commented Mar 11, 2021

Hi! Very interesting in nftables support... any updates on reviewing this PR?

@cpuguy83
Copy link
Member

Note we have migrated this codebase over to github.com/moby/moby/libnetwork.
We are not accepting PR's on this repo anymore except for backports to be included in moby 20.10

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants