Merging iptables-nftables into iptables

Merging iptables-nftables into iptables

[Pablo Neira Ayuso]

Hi,

The iptables-nftables tree [1] currently stores the iptables over
nftables compatibility support. This allows you to run iptables
commands using the nftables kernel infrastructure.

JFYI, my plan is to merge the iptables-nftables into iptables at some
point of this week given that it contains stuff that is scheduled for
3.13.  After that merge, the iptables-nftables will be disabled.

[1] http://git.netfilter.org/iptables-nftables/

Re: Merging iptables-nftables into iptables

[Arturo Borrero Gonzalez]

On 4 December 2013 12:48, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> Hi,
>
> The iptables-nftables tree [1] currently stores the iptables over
> nftables compatibility support. This allows you to run iptables
> commands using the nftables kernel infrastructure.
>
> JFYI, my plan is to merge the iptables-nftables into iptables at some
> point of this week given that it contains stuff that is scheduled for
> 3.13.  After that merge, the iptables-nftables will be disabled.
>
> [1] http://git.netfilter.org/iptables-nftables/

Could you give some hints about releases of userspace stuff?
(libnftables, nft, new iptables...)

Is 3.13 a deadline for releases?

I'm new to these situations :-)

-- 
Arturo Borrero González
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: Merging iptables-nftables into iptables

[Pablo Neira Ayuso]

On Wed, Dec 04, 2013 at 04:11:18PM +0100, Arturo Borrero Gonzalez wrote:
> On 4 December 2013 12:48, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> > Hi,
> >
> > The iptables-nftables tree [1] currently stores the iptables over
> > nftables compatibility support. This allows you to run iptables
> > commands using the nftables kernel infrastructure.
> >
> > JFYI, my plan is to merge the iptables-nftables into iptables at some
> > point of this week given that it contains stuff that is scheduled for
> > 3.13.  After that merge, the iptables-nftables will be disabled.
> >
> > [1] http://git.netfilter.org/iptables-nftables/
> 
> Could you give some hints about releases of userspace stuff?
> (libnftables, nft, new iptables...)
> 
> Is 3.13 a deadline for releases?

The initial release of the userspace libraries and tools will happen
by when the Linux kernel 3.13 is released, that should happen by the
beginning of 2014.

The nftables compatibility layer (the so-called iptables-nftables)
will be included in regular iptables releases, since it will be part
of that package.

Re: Merging iptables-nftables into iptables

[Bart De Schuymer]

Pablo Neira Ayuso schreef op 5/12/2013 9:24:
> On Wed, Dec 04, 2013 at 04:11:18PM +0100, Arturo Borrero Gonzalez wrote:
>> On 4 December 2013 12:48, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
>>> Hi,
>>>
>>> The iptables-nftables tree [1] currently stores the iptables over
>>> nftables compatibility support. This allows you to run iptables
>>> commands using the nftables kernel infrastructure.
>>>
>>> JFYI, my plan is to merge the iptables-nftables into iptables at some
>>> point of this week given that it contains stuff that is scheduled for
>>> 3.13.  After that merge, the iptables-nftables will be disabled.
>>>
>>> [1] http://git.netfilter.org/iptables-nftables/
>> Could you give some hints about releases of userspace stuff?
>> (libnftables, nft, new iptables...)
>>
>> Is 3.13 a deadline for releases?
> The initial release of the userspace libraries and tools will happen
> by when the Linux kernel 3.13 is released, that should happen by the
> beginning of 2014.
>
> The nftables compatibility layer (the so-called iptables-nftables)
> will be included in regular iptables releases, since it will be part
> of that package.

Nice to see this progress. What are the plans/obstacles (if any?) for 
migrating ebtables/arptables to nftables?

cheers,
Bart

Re: Merging iptables-nftables into iptables

[Pablo Neira Ayuso]

Hi Bart,

On Thu, Dec 05, 2013 at 10:15:46PM +0100, Bart De Schuymer wrote:
> Pablo Neira Ayuso schreef op 5/12/2013 9:24:
> >On Wed, Dec 04, 2013 at 04:11:18PM +0100, Arturo Borrero Gonzalez wrote:
> >>On 4 December 2013 12:48, Pablo Neira Ayuso <pablo@netfilter.org> wrote:
> >>>Hi,
> >>>
> >>>The iptables-nftables tree [1] currently stores the iptables over
> >>>nftables compatibility support. This allows you to run iptables
> >>>commands using the nftables kernel infrastructure.
> >>>
> >>>JFYI, my plan is to merge the iptables-nftables into iptables at some
> >>>point of this week given that it contains stuff that is scheduled for
> >>>3.13.  After that merge, the iptables-nftables will be disabled.
> >>>
> >>>[1] http://git.netfilter.org/iptables-nftables/
> >>Could you give some hints about releases of userspace stuff?
> >>(libnftables, nft, new iptables...)
> >>
> >>Is 3.13 a deadline for releases?
> >The initial release of the userspace libraries and tools will happen
> >by when the Linux kernel 3.13 is released, that should happen by the
> >beginning of 2014.
> >
> >The nftables compatibility layer (the so-called iptables-nftables)
> >will be included in regular iptables releases, since it will be part
> >of that package.
> 
> Nice to see this progress. What are the plans/obstacles (if any?)
> for migrating ebtables/arptables to nftables?

We already have a working compatibility layer for iptables, ip6tables
and arptables.

Regarding arptables, there's still one limitation that we have to
resolve as it only allows EUI-64 addresses (which should be the most
common case), the arptables kernel code seems to support variable
length hardware addresses up to 128 bytes long IIRC. Tomasz has been
working on that for a while.

Regarding ebtables, Giuseppe Longo have several patches to bootstrap
the ebtables compatibility, so it's work in progress.

In any case, we will still need the native {arp,eb,ip,ip6}tables tools
for a while, those will co-exist with the compatibility tools. At some
point in the future, distributors may decide to switch to the
compatibility tools transparently, the idea is that users won't notice
any change from the syntax point of view and they won't be forced to
drop their scripts.

Re: Merging iptables-nftables into iptables

[Tomasz Bursztyka]

Hi Pablo and Bart,

> Regarding arptables, there's still one limitation that we have to
> resolve as it only allows EUI-64 addresses (which should be the most
> common case), the arptables kernel code seems to support variable
> length hardware addresses up to 128 bytes long IIRC. Tomasz has been
> working on that for a while.

Actually I have a question about that.
On INPUT or OUTPUT I guess we need to handle input device and output 
device, respectively.

What about FORWARD? Still input device? Afaik the output device is not 
know yet at that point, is it?

Thanks,

Tomasz

Re: Merging iptables-nftables into iptables

[Pablo Neira Ayuso]

On Wed, Dec 04, 2013 at 12:48:34PM +0100, Pablo Neira Ayuso wrote:
> Hi,
> 
> The iptables-nftables tree [1] currently stores the iptables over
> nftables compatibility support. This allows you to run iptables
> commands using the nftables kernel infrastructure.
> 
> JFYI, my plan is to merge the iptables-nftables into iptables at some
> point of this week given that it contains stuff that is scheduled for
> 3.13.  After that merge, the iptables-nftables will be disabled.

With some delay, I found some time to rebase iptables-nftables upon
the current head and to push into the iptables.git's nft-compat branch [1].
I plan to give it another review tomorrow to see if I left something
behind in the rebase, if no troubles I'll merge it into master.

[1] http://git.netfilter.org/iptables/log/?h=nft-compat

Re: Merging iptables-nftables into iptables

[Jan Engelhardt]

On Tuesday 2013-12-31 00:07, Pablo Neira Ayuso wrote:
>I plan to give it another review tomorrow to see if I left something
>behind in the rebase, if no troubles I'll merge it into master.
>
>[1] http://git.netfilter.org/iptables/log/?h=nft-compat

You left:

+PKG_CHECK_MODULES([libnfables], [libnftables >= 1.0],

and this seems to have mixed nft and xt:

+AC_ARG_ENABLE([nftables],
+       AS_HELP_STRING([--disable-xtables], [Do not build xtables]),


+AM_PROG_LEX

=> AC_PROG_LEX

+if test "$flex_major" -eq "2" && test "$flex_minor" -eq "5" && test
"$flex_rev" -ge "33"; then
+       AC_MSG_RESULT([$flex_version. OK])
+else
+       AC_MSG_WARN([flex version $flex_version found.
+       Version 2.5.33 or greater is required. You may experience problems
+       while compilating the conntrack-tools. Please, consider to upgrade
+       flex.])
+fi

conntrack-tools?!