Upgrading libnetfilter_queue to use nftables

Upgrading libnetfilter_queue to use nftables

[Alessandro Vesely]

Hi all,

I'm using Debian 9 (stretch) and saw that the current version (Debian 10, buster) transparently installs nftables instead of iptables, offering to switch back by setting alternatives.

I'm worried how smoothly an upgrade would go.  I have calls similar to these:


iptables -A INPUT -j NFQUEUE

or

iptables -t raw -A OUTPUT -p tcp ! --syn -j NFQUEUE --queue-num 2
iptables -A OUTPUT -p tcp ! --syn -m mark --mark 4 -j REJECT --reject-with tcp-reset


There is a user space filter reading queued packets and issuing verdicts.  It is linked to libnetfilter_queue, libnfnetlink and libmnl.

Does automatic translation work fine in this case?

Do I have (better) to relink, recompile, and/or rewrite the user space packet filter in order to use nftable?  How simple is that?


TIA
Ale
-- 

Re: Upgrading libnetfilter_queue to use nftables

[Florian Westphal]

Alessandro Vesely <vesely@tana.it> wrote:
> I'm using Debian 9 (stretch) and saw that the current version (Debian 10, buster) transparently installs nftables instead of iptables, offering to switch back by setting alternatives.
> I'm worried how smoothly an upgrade would go.  I have calls similar to these:
> 
> iptables -A INPUT -j NFQUEUE
>
> or
> 
> iptables -t raw -A OUTPUT -p tcp ! --syn -j NFQUEUE --queue-num 2
> iptables -A OUTPUT -p tcp ! --syn -m mark --mark 4 -j REJECT --reject-with tcp-reset
> 
> There is a user space filter reading queued packets and issuing verdicts.  It is linked to libnetfilter_queue, libnfnetlink and libmnl.
> Does automatic translation work fine in this case?

It has nothing to do with translation, userspace doesn't care, its the
same interface.

> Do I have (better) to relink, recompile, and/or rewrite the user space packet filter in order to use nftable?  How simple is that?

No relink/rewrite needed, userspace can't tell if queueing came via
-j NFQUEUE or nftables' queue, its the same kernel facility (nfnetlink_queue).

Re: Upgrading libnetfilter_queue to use nftables

[Alessandro Vesely]

On Thu 14/Nov/2019 04:12:46 +0100 Florian Westphal wrote:
> Alessandro Vesely <vesely@tana.it> wrote:
>> [...]
>> There is a user space filter reading queued packets and issuing verdicts.  It is linked to libnetfilter_queue, libnfnetlink and libmnl.
>> Does automatic translation work fine in this case?
> 
> It has nothing to do with translation, userspace doesn't care, its the
> same interface.


So it shouldn't even be needed to maintain alternatives like Debian does, e.g.:

# update-alternatives --set iptables /usr/sbin/iptables-nft
vs
# update-alternatives --set iptables /usr/sbin/iptables-legacy


>> Do I have (better) to relink, recompile, and/or rewrite the user space packet filter in order to use nftable?  How simple is that?
> 
> No relink/rewrite needed, userspace can't tell if queueing came via
> -j NFQUEUE or nftables' queue, its the same kernel facility (nfnetlink_queue).
> 


Thank you for the reassurance


Best
Ale

Re: Upgrading libnetfilter_queue to use nftables

[Trent W. Buck]

Alessandro Vesely <vesely@tana.it> writes:

> On Thu 14/Nov/2019 04:12:46 +0100 Florian Westphal wrote:
>> Alessandro Vesely <vesely@tana.it> wrote:
>>> [...]
>>> There is a user space filter reading queued packets and issuing verdicts.
>>> It is linked to libnetfilter_queue, libnfnetlink and libmnl.
>>> Does automatic translation work fine in this case?
>>
>> It has nothing to do with translation, userspace doesn't care, its the
>> same interface.
>
> So it shouldn't even be needed to maintain alternatives like Debian does, e.g.:
>
> # update-alternatives --set iptables /usr/sbin/iptables-nft
> vs
> # update-alternatives --set iptables /usr/sbin/iptables-legacy

nft doesn't support some things (e.g. -j TARPIT from xtables-addons-dkms).
iptables-legacy lets you continue using those things.

You also need the -legacy tools to inspect firewall rules created by
e.g. systemd-nspawn for systemd containers.

Here is an example system with a single nft rule AND a single legacy
rule created by systemd:

    root@not-omega:~# iptables-save
    # Warning: iptables-legacy tables present, use iptables-legacy-save to see them

    root@not-omega:~# iptables-legacy-save
    # Generated by iptables-save v1.8.3 on Mon Nov 18 11:48:26 2019
    *nat
    :PREROUTING ACCEPT [111429:8069436]
    :INPUT ACCEPT [111423:8067363]
    :OUTPUT ACCEPT [38839:3454394]
    :POSTROUTING ACCEPT [38837:3454330]
    -A POSTROUTING -s 10.194.71.0/24 -j MASQUERADE
    COMMIT
    # Completed on Mon Nov 18 11:48:26 2019

    root@not-omega:~# nft list ruleset
    table inet filter {
            chain input {
                    type filter hook input priority filter; policy accept;
                    counter packets 9 bytes 632 continue comment "example rule that does nothing"
            }

            chain forward {
                    type filter hook forward priority filter; policy accept;
            }

            chain output {
                    type filter hook output priority filter; policy accept;
            }
    }


PS: I'm 95% sure I've seen iptables-restore silently fail to load SOME
rules leaving me with a wrong ruleset instead of a right ruleset or the
existing ruleset.  And then iptables-legacy-restore worked fine.
(I'd give the actual code, but it was a few weeks ago and I don't have
it handy.)