| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192 |
- <html>
- <head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
- <title>Re: GSoC Port Forwarding</title>
- <link rel="important stylesheet" href="">
- <style>div.headerdisplayname {font-weight:bold;}
- </style></head>
- <body>
- <table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part1"><tr><td><div class="headerdisplayname" style="display:inline;">Oggetto: </div>Re: GSoC Port Forwarding</td></tr><tr><td><div class="headerdisplayname" style="display:inline;">Mittente: </div>Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com></td></tr><tr><td><div class="headerdisplayname" style="display:inline;">Data: </div>14/08/2021, 23:43</td></tr></table><table border=0 cellspacing=0 cellpadding=0 width="100%" class="header-part2"><tr><td><div class="headerdisplayname" style="display:inline;">A: </div>Giulio <giulio@gmx.com></td></tr><tr><td><div class="headerdisplayname" style="display:inline;">CC: </div>Frédéric Pierret <frederic.pierret@qubes-os.org></td></tr></table><br>
- <div class="moz-text-plain" wrap=true graphical-quote=true style="font-family: -moz-fixed; font-size: 14px;" lang="x-unicode"><pre wrap class="moz-quote-pre">
- On Sat, Aug 14, 2021 at 06:33:18PM +0200, Giulio wrote:
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>Hello,
- <span class="moz-txt-citetags">> </span>Sorry for the late reply.
- <span class="moz-txt-citetags">> </span>While everything cli related is almost ready, I am having some issues on
- <span class="moz-txt-citetags">> </span>the actual implementation of the iptables/nft rules. I see that in the
- <span class="moz-txt-citetags">> </span>current state, it seems like Qubes is using both as also stated in [1].
- </pre></blockquote><pre wrap class="moz-quote-pre">
- Yes, there are two backends, depending on nft availability. This is
- mostly because older distros (Debian 8...) did not have nft at all.
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>However, in the core-agent-linux source code, if the 'nft' binary is
- <span class="moz-txt-citetags">> </span>available that is the only one that gets invoked. Furthermore, there
- <span class="moz-txt-citetags">> </span>are differences on the iptables backend depending on templates as
- <span class="moz-txt-citetags">> </span>reported in [2].
- </pre></blockquote><pre wrap class="moz-quote-pre">
- Yes, and since basically all the distributions have nft now, iptables
- backend may be soon removed. I don't think we have any case where
- iptables backend is used in practice in Qubes 4.1. RPM package has
- strict dependency on nft, and Debian package has it as Suggests only,
- but it is in practice installed.
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>I am a bit stuck in understanding which rule to put where in order to
- <span class="moz-txt-citetags">> </span>have consistency across templates and between iptables/nft, also because
- <span class="moz-txt-citetags">> </span>if I blindly implement the rules suggested in [1] they will not actually
- <span class="moz-txt-citetags">> </span>work since most of the time iptables is not invoked at all.
- </pre></blockquote><pre wrap class="moz-quote-pre">
- Indeed adding rules to the IptablesWorker class will make no effect if
- nft is in use.
- Theoretically, iptables rules and nft rules can coexist, but we should
- really focus on nft with new features.
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>I also checked [3], however it is very similar to the instructions in
- <span class="moz-txt-citetags">> </span>[1] which leads to the same problems.
- <span class="moz-txt-citetags">> </span>Are we able to write working nft forwarding rules without invoking
- <span class="moz-txt-citetags">> </span>iptables at all? If yes, could you heml me determine which ones?
- </pre></blockquote><pre wrap class="moz-quote-pre">
- As for the nft syntax, I think iptables-translate tool can help you
- (part of the iptables-nft package).
- See <a class="moz-txt-link-freetext" href="https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables">https://wiki.nftables.org/wiki-nftables/index.php/Moving_from_iptables_to_nftables</a>
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>You can see in [4] how I organized the forwarding mechanism. All the
- <span class="moz-txt-citetags">> </span>necessary information, as well as ipv4/ipv6 support should already be in
- <span class="moz-txt-citetags">> </span>the 'prepare_forward_rules' function meaning that only the actual
- <span class="moz-txt-citetags">> </span>building syntax is left.
- </pre></blockquote><pre wrap class="moz-quote-pre">
- Yes, this layout looks ok.
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>For simplicity you can look at the other changes at [5] and at [6].
- </pre></blockquote><pre wrap class="moz-quote-pre">
- This too looks fine (although I haven't don't detailed review).
- In both cases, the code will need some tests of course.
- </pre><blockquote type=cite style="color: #007cff;"><pre wrap class="moz-quote-pre">
- <span class="moz-txt-citetags">> </span>[1] - <a class="moz-txt-link-freetext" href="https://www.qubes-os.org/doc/firewall/">https://www.qubes-os.org/doc/firewall/</a>
- <span class="moz-txt-citetags">> </span>[2] - <a class="moz-txt-link-freetext" href="https://github.com/QubesOS/qubes-issues/issues/5031">https://github.com/QubesOS/qubes-issues/issues/5031</a>
- <span class="moz-txt-citetags">> </span>[3] - <a class="moz-txt-link-freetext" href="https://gist.github.com/fepitre/941d7161ae1150d90e15f778027e3248">https://gist.github.com/fepitre/941d7161ae1150d90e15f778027e3248</a>
- <span class="moz-txt-citetags">> </span>[4] -
- <span class="moz-txt-citetags">> </span><a class="moz-txt-link-freetext" href="https://github.com/lsd-cat/qubes-core-agent-linux/compare/f24ca2c..3e944af">https://github.com/lsd-cat/qubes-core-agent-linux/compare/f24ca2c..3e944af</a>
- <span class="moz-txt-citetags">> </span>[5] - <a class="moz-txt-link-freetext" href="https://github.com/lsd-cat/qubes-core-admin/compare/6a1570b..6e3e250">https://github.com/lsd-cat/qubes-core-admin/compare/6a1570b..6e3e250</a>
- <span class="moz-txt-citetags">> </span>[6] -
- <span class="moz-txt-citetags">> </span><a class="moz-txt-link-freetext" href="https://github.com/lsd-cat/qubes-core-admin-client/compare/1a2ce72..a17853b">https://github.com/lsd-cat/qubes-core-admin-client/compare/1a2ce72..a17853b</a>
- </pre></blockquote><pre wrap class="moz-quote-pre">
- <div class="moz-txt-sig">--
- Best Regards,
- Marek Marczykowski-Górecki
- Invisible Things Lab
- </div></pre></div></body>
- </html>
- </table></div>
|
