Initial draft of nftables support

This implementation lacks isolation support at present (that'll be a followon PR) and has only very minimal testing at the moment (including absolutely 0 testing for IPv6), but does handle all core tasks including forwarding and all types of port forwarding. Fixes #816 Signed-off-by: Matthew Heon <[email protected]>
containers · Jan 4, 2024 · 102cdb5 · 102cdb5
1 parent dbe870c
commit 102cdb5
Show file tree

Hide file tree

Showing 5 changed files with 879 additions and 3 deletions.
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -49,6 +49,7 @@ sha2 = "0.10.8"
 netlink-packet-utils = "0.5.2"
 netlink-packet-route = "0.17.1"
 netlink-packet-core = "0.7.0"
+nftables = "0.2.4"
 fs2 = "0.4.3"
 netlink-sys = "0.8.5"
 tokio = { version = "1.34", features = ["rt", "rt-multi-thread", "signal", "fs"] }

diff --git a/src/error/mod.rs b/src/error/mod.rs
@@ -81,6 +81,11 @@ pub enum NetavarkError {
     DHCPProxy(tonic::Status),
 
     List(NetavarkErrorList),
+
+    Nftables(nftables::helper::NftablesError),
+
+    SubnetParse(ipnet::AddrParseError),
+    AddrParse(std::net::AddrParseError),
 }
 
 /// Internal struct for JSON output
@@ -160,6 +165,9 @@ impl fmt::Display for NetavarkError {
                     Ok(())
                 }
             }
+            NetavarkError::Nftables(e) => write!(f, "nftables error: {e}"),
+	    NetavarkError::SubnetParse(e) => write!(f, "parsing IP subnet error: {e}"),
+	    NetavarkError::AddrParse(e) => write!(f, "parsing IP address error: {e}"),
         }
     }
 }
@@ -213,3 +221,21 @@ impl From<tonic::Status> for NetavarkError {
         NetavarkError::DHCPProxy(err)
     }
 }
+
+impl From<nftables::helper::NftablesError> for NetavarkError {
+    fn from(err: nftables::helper::NftablesError) -> Self {
+	NetavarkError::Nftables(err)
+    }
+}
+
+impl From<ipnet::AddrParseError> for NetavarkError {
+    fn from(err: ipnet::AddrParseError) -> Self {
+	NetavarkError::SubnetParse(err)
+    }
+}
+
+impl From<std::net::AddrParseError> for NetavarkError {
+    fn from(err: std::net::AddrParseError) -> Self {
+	NetavarkError::AddrParse(err)
+    }
+}
diff --git a/src/firewall/mod.rs b/src/firewall/mod.rs
@@ -9,6 +9,7 @@ use zbus::blocking::Connection;
 pub mod firewalld;
 pub mod fwnone;
 pub mod iptables;
+pub mod nft;
 pub mod state;
 mod varktables;
 
@@ -113,9 +114,7 @@ pub fn get_supported_firewall_driver(
             }
             FirewallImpl::Nftables => {
                 info!("Using nftables firewall driver");
-                Err(NetavarkError::msg(
-                    "nftables support presently not available",
-                ))
+		nft::new()
             }
             FirewallImpl::Fwnone => {
                 info!("Not using firewall");