Nftables HOWTO documentation updates

Nftables HOWTO documentation updates

[Pablo Neira Ayuso]

Hi,

I have registered a subdomain for nftables that hosts the nftables
user HOWTO, you can reach it via:

        http://wiki.nftables.org

This documentation is based on the original work from Eric Leblond's
nftables quick HOWTO [1], so you may find that I have reused some
examples and comments from that document in this new place.

The aim of this documentation is to provide a user-oriented
introduction to the new concepts by examples. The website doesn't look
fancy and you probably will find typos or things that need to be
improved and expanded, but with some extra work and time it will
progressively get improved.

The website is using a wiki, however, public edition has been
disabled to avoid the overhead that resulting from typical wiki
vandalism. So the plan is to provide edit access by invitation to a
group of selected people.

If you have comments, requests and suggestions to improve it, please,
let us know. Thanks!

[1] https://home.regit.org/netfilter-en/nftables-quick-howto/

P.S:  I would like to thank the NLNet foundation for sponsoring this
initial HOWTO documentation (http://www.nlnet.nl).

Re: Nftables HOWTO documentation updates

[Dennis Jacobfeuerborn]

On 18.02.2014 12:25, Pablo Neira Ayuso wrote:
> Hi,
>
> I have registered a subdomain for nftables that hosts the nftables
> user HOWTO, you can reach it via:
>
>          http://wiki.nftables.org

I checked out the HOWTO and it gives a really nice concise introduction 
to how nftables work. Good work!

After browsing through the pages I have two questions:

Is it possible to comment rules like in iptables? Comments in iptables 
made it really easy to manage rules on a logical level i.e. I could 
define rule "types" by adding a special comment like "TYPE:X" and then 
use that to grep for these rules to batch-remove them or retrieve the 
counter values. It would be nice to be able to tag rules like this.

How do I insert multiple rules? The insertion example show the addition 
of a single rule after a known handle but what if I want to add a second 
rule after that? As far as I can tell from the example the add rule 
command does not return the handle of the inserted rule so I have no 
idea where to insert the second rule. Even if the command returned the 
handle it would still require scripting to add multiple consecutive 
rules so there should be a way to specify to add a list of rules 
(atomically?) after a given handle.

Not sure if these features are not available or just not documented yet 
but I'm approaching this by thinking about the use-cases I encounter and 
looking at how I would implement these using nftables instead of iptables.

Regards,
   Dennis

Re: Nftables HOWTO documentation updates

[Arturo Borrero Gonzalez]

On 19 February 2014 16:13, Dennis Jacobfeuerborn <dennisml@conversis.de> wrote:
> Is it possible to comment rules like in iptables? Comments in iptables made
> it really easy to manage rules on a logical level i.e. I could define rule
> "types" by adding a special comment like "TYPE:X" and then use that to grep
> for these rules to batch-remove them or retrieve the counter values. It
> would be nice to be able to tag rules like this.
>

Not possible yet.
There are some details about the implementation that have to be
discussed. For example: how/where to store the comment.

As user, I'm also interested in this feature. Maybe we can add to the TODO list.

regards
-- 
Arturo Borrero González

Re: Nftables HOWTO documentation updates

[Pablo Neira Ayuso]

Hi,

On Wed, Feb 19, 2014 at 04:13:37PM +0100, Dennis Jacobfeuerborn wrote:
> On 18.02.2014 12:25, Pablo Neira Ayuso wrote:
> >Hi,
> >
> >I have registered a subdomain for nftables that hosts the nftables
> >user HOWTO, you can reach it via:
> >
> >         http://wiki.nftables.org
> 
> I checked out the HOWTO and it gives a really nice concise
> introduction to how nftables work. Good work!
> 
> After browsing through the pages I have two questions:
> 
> Is it possible to comment rules like in iptables? Comments in
> iptables made it really easy to manage rules on a logical level i.e.
> I could define rule "types" by adding a special comment like
> "TYPE:X" and then use that to grep for these rules to batch-remove
> them or retrieve the counter values. It would be nice to be able to
> tag rules like this.

As Arturo said, that's not yet implemented. I've been trying to find a
way which doesn't involve to store that comment string in the kernel,
given that this information is not used by the kernel in any way, but
all what I come out with was overly complicated and not nice.

So, assuming we store this comment string in kernel-space, I see
several possibilities at this moment:

* Add an expression for comments, which is sort of abuse since we'll
  iterate in nft_do_chain() over one expression which does nothing,
  so it adds some runtime overhead to the packet handling. This is
  what the iptables comment match current does, btw.

* Adding a comment field to nft_rule structure, which means that we
  have to consume a 4/8 extra bytes in the nft_rule structure for a
  feature that may not be used by everyone.

* Attach this this at the end of the expression data area (but *not*
  abusing the expression infrastructure). I think this has no runtime
  overhead and no extra memory consumption for those that don't need
  this comment feature, so it's the way to go IMO.

> How do I insert multiple rules? The insertion example show the
> addition of a single rule after a known handle but what if I want to
> add a second rule after that? As far as I can tell from the example
> the add rule command does not return the handle of the inserted rule
> so I have no idea where to insert the second rule. Even if the
> command returned the handle it would still require scripting to add
> multiple consecutive rules so there should be a way to specify to
> add a list of rules (atomically?) after a given handle.

That's not yet support either. I think we'll need to keep some context
information in the batch handling so you can add several list after a
given handle.

Re: Nftables HOWTO documentation updates

[Patrick McHardy]

On Wed, Feb 19, 2014 at 04:55:02PM +0100, Pablo Neira Ayuso wrote:
> > 
> > Is it possible to comment rules like in iptables? Comments in
> > iptables made it really easy to manage rules on a logical level i.e.
> > I could define rule "types" by adding a special comment like
> > "TYPE:X" and then use that to grep for these rules to batch-remove
> > them or retrieve the counter values. It would be nice to be able to
> > tag rules like this.
> 
> As Arturo said, that's not yet implemented. I've been trying to find a
> way which doesn't involve to store that comment string in the kernel,
> given that this information is not used by the kernel in any way, but
> all what I come out with was overly complicated and not nice.
> 
> So, assuming we store this comment string in kernel-space, I see
> several possibilities at this moment:
> 
> * Add an expression for comments, which is sort of abuse since we'll
>   iterate in nft_do_chain() over one expression which does nothing,
>   so it adds some runtime overhead to the packet handling. This is
>   what the iptables comment match current does, btw.
> 
> * Adding a comment field to nft_rule structure, which means that we
>   have to consume a 4/8 extra bytes in the nft_rule structure for a
>   feature that may not be used by everyone.
> 
> * Attach this this at the end of the expression data area (but *not*
>   abusing the expression infrastructure). I think this has no runtime
>   overhead and no extra memory consumption for those that don't need
>   this comment feature, so it's the way to go IMO.

Sounds very reasonable. I'd suggest to not make this specific to comments,
but simply call it "userdata" or something so we we can put whatever we
like in there. Interpretation would be up to userspace.