[Question] Is there some documentation for nftables development

[Question] Is there some documentation for nftables development

[Fabian Franz]

Hi there,

is there some documentation available how to create a custom match for a
firewall rule (nftables).

What I want to create is a custom match which will query a user space
application, if the packet is allowed (returning a bool value)?

Kind regards

Fabian Franz

Re: [Question] Is there some documentation for nftables development

[Fabian Franz]

Dear Mr. Cochran,


even if your document looks good, I am looking for some documentation
related to nftables - iptables is NO option because I want to implement
a kernel module for nftables doing that.

The problem is, that there is a wiki how to use it, but there is no
information how to extend it:

https://wiki.nftables.org/wiki-nftables/index.php/Main_Page


Kind regards


Fabian Franz




Am 2017-02-15 um 17:44 schrieb Bob Cochran:
> If you don't mind using iptables/Xtables instead:
> http://inai.de/documents/Netfilter_Modules.pdf
>
>
>
> On 02/15/2017 08:59 AM, Fabian Franz wrote:
>> Hi there,
>>
>> is there some documentation available how to create a custom match for a
>> firewall rule (nftables).
>>
>> What I want to create is a custom match which will query a user space
>> application, if the packet is allowed (returning a bool value)?
>>
>> Kind regards
>>
>> Fabian Franz
>>
>> -- 
>> To unsubscribe from this list: send the line "unsubscribe
>> netfilter-devel" in
>> the body of a message to majordomo@vger.kernel.org
>> More majordomo info at  http://vger.kernel.org/majordomo-info.html
>>
>

Re: [Question] Is there some documentation for nftables development

[Anatole Denis]

On mer., févr. 15, 2017 at 6:21 , Fabian Franz 
<s1410239008@students.fh-hagenberg.at> wrote:
> Dear Mr. Cochran,
> 
> 
> even if your document looks good, I am looking for some documentation
> related to nftables - iptables is NO option because I want to 
> implement
> a kernel module for nftables doing that.
> 
> The problem is, that there is a wiki how to use it, but there is no
> information how to extend it:
> 
> https://wiki.nftables.org/wiki-nftables/index.php/Main_Page

 From your description, "query a user space application, if the packet 
is allowed", seems to be exactly nfqueue, which is already developed 
and in mainline kernel, and supported by nftables. The wiki you link to 
has a page on it: 
https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace.

As you can also see in the link, there is a userspace library for it, 
libnetfilter_queue, as well.

The question is maybe, do you want to solve a problem (in which case I 
believe nfqueue could be a solution), or write a kernel module (in 
which case, sorry to be useless, I don't know about any documentation 
on the kernel side of netfilter) ?

--
Anatole

Re: [Question] Is there some documentation for nftables development

[Fabian Franz]

Hi Anatole,


I am aware of this option, but this is still not what I want. For
example, I want to have a firewall rule

"tcp ssh user fabian accept"

to have a rule with my user in the match. For the authentication, a
captive portal or a radius server for 802.1X may be an option. The user
is part of the match and therefore it must be part of the rule (don't
want to evaluate everything twice).

There is also no reason to queue the full packet to the user space if
only the source is required.


Kind regards


Fabian Franz


Am 2017-02-15 um 19:37 schrieb Anatole Denis:
> On mer., févr. 15, 2017 at 6:21 , Fabian Franz
> <s1410239008@students.fh-hagenberg.at> wrote:
>> Dear Mr. Cochran,
>>
>>
>> even if your document looks good, I am looking for some documentation
>> related to nftables - iptables is NO option because I want to implement
>> a kernel module for nftables doing that.
>>
>> The problem is, that there is a wiki how to use it, but there is no
>> information how to extend it:
>>
>> https://wiki.nftables.org/wiki-nftables/index.php/Main_Page
>
> From your description, "query a user space application, if the packet
> is allowed", seems to be exactly nfqueue, which is already developed
> and in mainline kernel, and supported by nftables. The wiki you link
> to has a page on it:
> https://wiki.nftables.org/wiki-nftables/index.php/Queueing_to_userspace.
>
> As you can also see in the link, there is a userspace library for it,
> libnetfilter_queue, as well.
>
> The question is maybe, do you want to solve a problem (in which case I
> believe nfqueue could be a solution), or write a kernel module (in
> which case, sorry to be useless, I don't know about any documentation
> on the kernel side of netfilter) ?
>
> -- 
> Anatole
>