* [Question] Is there some documentation for nftables development @ 2017-02-15 13:59 Fabian Franz [not found] ` <d73038eb-3609-d4a8-85af-30c81174eb3d@mindchasers.com> 0 siblings, 1 reply; 4+ messages in thread From: Fabian Franz @ 2017-02-15 13:59 UTC (permalink / raw) To: netfilter-devel Hi there, is there some documentation available how to create a custom match for a firewall rule (nftables). What I want to create is a custom match which will query a user space application, if the packet is allowed (returning a bool value)? Kind regards Fabian Franz ^ permalink raw reply [flat|nested] 4+ messages in thread
[parent not found: <d73038eb-3609-d4a8-85af-30c81174eb3d@mindchasers.com>]
* Re: [Question] Is there some documentation for nftables development [not found] ` <d73038eb-3609-d4a8-85af-30c81174eb3d@mindchasers.com> @ 2017-02-15 17:21 ` Fabian Franz 2017-02-15 18:37 ` Anatole Denis 0 siblings, 1 reply; 4+ messages in thread From: Fabian Franz @ 2017-02-15 17:21 UTC (permalink / raw) To: netfilter-devel Dear Mr. Cochran, even if your document looks good, I am looking for some documentation related to nftables - iptables is NO option because I want to implement a kernel module for nftables doing that. The problem is, that there is a wiki how to use it, but there is no information how to extend it: https://wiki.nftables.org/wiki-nftables/index.php/Main_Page Kind regards Fabian Franz Am 2017-02-15 um 17:44 schrieb Bob Cochran: > If you don't mind using iptables/Xtables instead: > http://inai.de/documents/Netfilter_Modules.pdf > > > > On 02/15/2017 08:59 AM, Fabian Franz wrote: >> Hi there, >> >> is there some documentation available how to create a custom match for a >> firewall rule (nftables). >> >> What I want to create is a custom match which will query a user space >> application, if the packet is allowed (returning a bool value)? >> >> Kind regards >> >> Fabian Franz >> >> -- >> To unsubscribe from this list: send the line "unsubscribe >> netfilter-devel" in >> the body of a message to majordomo@vger.kernel.org >> More majordomo info at http://vger.kernel.org/majordomo-info.html >> > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Question] Is there some documentation for nftables development 2017-02-15 17:21 ` Fabian Franz @ 2017-02-15 18:37 ` Anatole Denis 2017-02-15 19:33 ` Fabian Franz 0 siblings, 1 reply; 4+ messages in thread From: Anatole Denis @ 2017-02-15 18:37 UTC (permalink / raw) To: Fabian Franz; +Cc: netfilter-devel On mer., févr. 15, 2017 at 6:21 , Fabian Franz <s1410239008@students.fh-hagenberg.at> wrote: > Dear Mr. Cochran, > > > even if your document looks good, I am looking for some documentation > related to nftables - iptables is NO option because I want to > implement > a kernel module for nftables doing that. > > The problem is, that there is a wiki how to use it, but there is no > information how to extend it: > > https://wiki.nftables.org/wiki-nftables/index.php/Main_Page From your description, "query a user space application, if the packet is allowed", seems to be exactly nfqueue, which is already developed and in mainline kernel, and supported by nftables. The wiki you link to has a page on it: https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace. As you can also see in the link, there is a userspace library for it, libnetfilter_queue, as well. The question is maybe, do you want to solve a problem (in which case I believe nfqueue could be a solution), or write a kernel module (in which case, sorry to be useless, I don't know about any documentation on the kernel side of netfilter) ? -- Anatole ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Question] Is there some documentation for nftables development 2017-02-15 18:37 ` Anatole Denis @ 2017-02-15 19:33 ` Fabian Franz 0 siblings, 0 replies; 4+ messages in thread From: Fabian Franz @ 2017-02-15 19:33 UTC (permalink / raw) To: Anatole Denis; +Cc: netfilter-devel Hi Anatole, I am aware of this option, but this is still not what I want. For example, I want to have a firewall rule "tcp ssh user fabian accept" to have a rule with my user in the match. For the authentication, a captive portal or a radius server for 802.1X may be an option. The user is part of the match and therefore it must be part of the rule (don't want to evaluate everything twice). There is also no reason to queue the full packet to the user space if only the source is required. Kind regards Fabian Franz Am 2017-02-15 um 19:37 schrieb Anatole Denis: > On mer., févr. 15, 2017 at 6:21 , Fabian Franz > <s1410239008@students.fh-hagenberg.at> wrote: >> Dear Mr. Cochran, >> >> >> even if your document looks good, I am looking for some documentation >> related to nftables - iptables is NO option because I want to implement >> a kernel module for nftables doing that. >> >> The problem is, that there is a wiki how to use it, but there is no >> information how to extend it: >> >> https://wiki.nftables.org/wiki-nftables/index.php/Main_Page > > From your description, "query a user space application, if the packet > is allowed", seems to be exactly nfqueue, which is already developed > and in mainline kernel, and supported by nftables. The wiki you link > to has a page on it: > https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace. > > As you can also see in the link, there is a userspace library for it, > libnetfilter_queue, as well. > > The question is maybe, do you want to solve a problem (in which case I > believe nfqueue could be a solution), or write a kernel module (in > which case, sorry to be useless, I don't know about any documentation > on the kernel side of netfilter) ? > > -- > Anatole > ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-02-15 19:33 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2017-02-15 13:59 [Question] Is there some documentation for nftables development Fabian Franz [not found] ` <d73038eb-3609-d4a8-85af-30c81174eb3d@mindchasers.com> 2017-02-15 17:21 ` Fabian Franz 2017-02-15 18:37 ` Anatole Denis 2017-02-15 19:33 ` Fabian Franz
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.