Repository navigation
R5 nftables: the hooks, nf_tables, conntrack and NAT #542
Description
Part of #14.
rukernel has no netfilter. There are no hook points in the IPv4 and IPv6 paths, no NETLINK_NETFILTER, no conntrack and no NAT. LTP net nft, nft6, iptables and ip6tables do not apply now ("nf_tables driver not available"). spec/10-networking.md section 10.5 has the scope.
Scope
- The netfilter hook points in the IPv4 and IPv6 paths:
PREROUTING,INPUT,FORWARD,OUTPUTandPOSTROUTING, with a list of hooks in priority order for each network namespace, and the verdictsACCEPT,DROP,STOLENandQUEUE. A path with no hook does not take a lock. Test: theinet,inet6,netcfgandnetnsboot tests and LTP net. Exit: no change in the results, and thetcp_streamandudp_streambench rows stay in the noise. - The protocol
NETLINK_NETFILTERwith the nfnetlink subsystems, and the nf_tables objects: tables, chains, base chains on the hooks, rules and sets. Add the transaction batch (NFNL_MSG_BATCH_BEGINandNFNL_MSG_BATCH_END) with commit and abort, the generation ID and the dump of the rule set. Test: a newnftboot test that loads a rule set withnft -fand comparesnft list rulesetwith the input. Exit: the output is the same as on the reference. - A test harness for the nftables test suite: tools/nftables/build.sh builds
nftand tests/shell of the nftables project, and a report gives the result of each test on rukernel and on the reference. Exit: the report is in tools/nftables. - The expression VM:
immediate,payload,meta,cmp,bitwise,byteorder,range,lookup,counter,limit,log(to the kernel log),rejectand the verdicts. Test: LTP nft and nft6. Exit: both pass. - Sets and maps: hash and rbtree sets, intervals, concatenations, timeouts, dynamic sets and verdict maps. Test: the sets and maps parts of the nftables tests/shell. Exit: they reach the pass set of the reference.
- conntrack: connection tracking for TCP, UDP, ICMP and ICMPv6, the
ctexpression (state, mark, status), the/proc/sys/net/netfilter/nf_conntrack_*tunables, and ctnetlink forconntrack -L. Test: thectparts of the nftables tests/shell. Exit: they reach the pass set of the reference. - NAT: the
natchains,snat,dnat,masqueradeandredirect. Test: thenatparts of the nftables tests/shell, and a new part of thenetnsboot test that does masquerade between two network namespaces on veth. Exit: they reach the pass set of the reference. -
iptables-nft: thenft_compatexpressions for the xtables matches and targets thatiptables-nftuses, for examplestate,conntrackandREJECT. Test: LTP iptables and ip6tables. Exit: both pass. - Run the full nftables tests/shell on both architectures and update the report. Exit: the suite reaches the pass set of the reference, apart from the listed exceptions.
Done when
The nftables test suite reaches the pass set of the reference. This is the exit of the seventh item of #14.
Test each task on x86_64 and on arm64. Give the result of both in the PR body.
Linux reference: net/netfilter/core.c, net/netfilter/nfnetlink.c, net/netfilter/nf_tables_api.c, net/netfilter/nf_tables_core.c, net/netfilter/nf_conntrack_core.c, net/netfilter/nft_compat.c.
Activity
tamnd commentedon Nov 5, 2026
Progress on the nf_tables work, all merged into main:
ctexpression.snat,dnatandmasquerade.Next, in this order. Each one is boot tested before its PR:
byteorder,range,limitandlog.reject(ICMP, ICMPv6, icmpx, TCP RST).redir.Known limitations so far:
loghas no MAC=, IP options or UID, andlog groupgives ENOENT.Still open: sets and maps, ctnetlink, masquerade between netns on veth, nft_compat, and the tools/nftables harness.
tamnd commentedon Nov 5, 2026
Two more parts of the expression VM item are merged:
byteorder,range,limitandlog.reject. This covers ICMP, ICMPv6, icmpx and the TCP RST.The inet boot test passes on x86_64 and on arm64 on server2 (load average 24.43, 24.41, 24.73).
Limitations of
reject: the RST is not attached to the connection (Linux does this withnf_ct_attach), and the checksum of an incoming packet is not checked before the answer.Next, in this order: nft-10 (
redir), nft-11 (maps and verdict maps), nft-12 (set timeouts) and nft-13 (dynset).tamnd commentedon Nov 5, 2026
One more part of the NAT item is merged:
redirexpression of nf_tables. It sends the packet to the host on the port range of the rule, asredirectof thenatchains.The gate passed. The inet boot test passes on x86_64 and on arm64 on server2 (load average 24.43, 24.41, 24.73).
The NAT item is not done yet. Its tests need the nftables tests/shell harness and the masquerade part of the
netnsboot test.Next: nft-11 (maps and verdict maps).
tamnd commentedon Nov 5, 2026
One more part of the sets and maps item is merged:
lookupwithNFTA_LOOKUP_DREGloads the data of an element into a register. A verdict map gives accept, drop, jump or goto, and its jumps count for the loop check of the chains.The gate passed. The inet boot test passes on x86_64 and on arm64 on server2 (load average 24.43, 24.41, 24.73).
The sets and maps item is not done yet. Its exit needs the nftables tests/shell harness.
Next: nft-12 (set timeouts).
tamnd commentedon Nov 6, 2026
One more part of the sets and maps item is merged:
NFT_SET_TIMEOUTtakes a timeout for the set and for each element. An element ends after its timeout. A lookup does not find it, and a dump does not show it. The dump gives the timeout and the time that is left (NFTA_SET_ELEM_TIMEOUT,NFTA_SET_ELEM_EXPIRATION).The item is not done. Next: nft-13, the
dynsetexpression (dynamic sets).tamnd commentedon Nov 6, 2026
One more part of the sets and maps item is merged:
dynsetexpression of nf_tables. A rule can add the key of a packet to a set, start the timeout of its element again (update), or remove the element (delete). The changes of the packet path go in a list that a lookup, a dump and the next commit see.The item is not done: the sets and maps parts of the nftables tests/shell do not run yet. Next: nft-14, masquerade between two network namespaces in the
netnsboot test.xtask: masquerade between two network namespaces in the netns boot te…
tamnd commentedon Nov 6, 2026
One part of the NAT item is merged:
netnsboot test does masquerade between two network namespaces on veth. The router loads the ruleoif rb masqueradein anatchain onPOSTROUTING. After the rule, the ping from A to B passes, and the TCP server in B sees the client address 10.10.2.254 of the router.The NAT item stays open. The
natparts of the nftables tests/shell do not run yet, because the test harness item is not done.net: ctnetlink, the dump, get and delete of the connections (#633)
tamnd commentedon Nov 7, 2026
One part of the conntrack item is merged:
NETLINK_NETFILTERfor the connections. It gives the dump of the connections (with the mark and status filters), get, delete, flush and the stats, soconntrack -Lcan read the table.The gate passed. The inet boot test has a new check for ctnetlink, and it passes on x86_64 and on arm64 on server2.
The conntrack item stays open. Its exit needs the
ctparts of the nftables tests/shell. Next: nft-16 (nft_compat).tamnd commentedon Nov 7, 2026
One part of the iptables-nft item is merged:
state,conntrack,comment,icmpandicmp6and the targetREJECT, so thatiptables-nftcan load these rules.The gate passed. The inet boot test passes on x86_64 and on arm64 on server2.
The iptables-nft item stays open. Its exit needs LTP iptables and ip6tables. Next: nft-17 (the matches
tcp,udp,multiportandconnmark, and the targetLOG).tamnd commentedon Nov 7, 2026
An other part of the iptables-nft item is merged:
tcp,udp,udplite,multiportandconnmark, and the targetLOG, in nft_compat.The gate passed. The inet boot test passes on x86_64 and on arm64 on server2.
The iptables-nft item stays open. Its exit needs LTP iptables and ip6tables. Next: nft-18 (
iptables-nftandnftin the tools of the LTP run), then nft-19 (the tests/shell harness), nft-20, nft-21 and nft-22.tamnd commentedon Nov 7, 2026
The test part of the expression VM item and of the iptables-nft item is merged:
iptables,ip6tablesandnftof Alpine in the tools of the LTP run, and nf_tables, ip_tables and ip6_tables in modules.builtin, so that the tests find the drivers.The gate passed. With the stack of #542 up to #639, LTP iptables, nft, ip6tables and nft6 pass on x86_64 on server2.
The two items stay open. The tools of the LTP run are x86_64 programs, so LTP nft, nft6, iptables and ip6tables did not run on arm64. Next: nft-19 (the tests/shell harness and the report), then nft-20, nft-21 and nft-22.
tamnd commentedon Nov 7, 2026
The test harness item is done, and I ticked it:
nft1.0.9 and tests/shell of nftables 1.0.9 in an Alpine root file system for x86_64 and arm64, run.py runs the 380 tests under QEMU on rukernel or on a Linux reference kernel, and report.py makes tools/nftables/report.md. The first report: Linux 371 of 380, rukernel x86_64 215 of 380, rukernel arm64 31 of the 44 tests of testcases/chains.The gate passed. Next: nft-20 (the names of the sets in the dump), nft-21 (the
metakeys and thebitwiseshifts), nft-22 (the check of the chains at commit) and nft-23 (the report after them: 277 of 380 on x86_64).tamnd commentedon Nov 7, 2026
#645 (nft-20) is merged: the dump of a rule gives the name of the set of each
lookupanddynsetexpression, as thedumpof nft_lookup.c and nft_dynset.c of Linux. Before, it gave the name with%dor the ID of the set that the batch gave, andnft listdid not find the anonymous sets.The gate passed. No item is complete with this change. Next: nft-21 (the
metakeys and thebitwiseshifts), nft-22 (the check of the chains at commit), nft-23 (the report after them) and nft-24 (the stateful objectscounter,quotaandlimit, andobjref).tamnd commentedon Nov 7, 2026
#647 (nft-21) is merged: the
metakeysmark,iifname,oifname,iiftypeandoiftype,meta mark set, and thebitwiseshiftslshiftandrshift. The 10 bitwise tests of tests/shell pass on rukernel x86_64 and arm64.The gate passed. The expression VM item stays open, because it also needs the arm64 LTP run. Next: nft-22 (the check of the chains at commit), nft-23 (the report after nft-20 to nft-22) and nft-24 (the stateful objects).
tamnd commentedon Nov 7, 2026
#649 (nft-22) is merged: the commit of an nf_tables batch checks the chains that each base chain reaches with its jumps, gotos and verdict maps, as
nft_table_validateandnft_chain_validateof Linux. Amasquerade,snat,dnat,redirectorrejectin a chain that a base chain of an other type or hook reaches givesEOPNOTSUPP, and a chain at the depth 16 givesEMLINK. chains/0002jumps_1, the 5 masquerade_jump tests, chains/0020depth_1 and transactions/bad_expression of tests/shell now pass on rukernel x86_64 and arm64.The gate passed. The NAT item stays open (snat to a range of addresses and ports). Next: nft-23 (the report after nft-20 to nft-22) and nft-24 (the stateful objects).
tamnd commentedon Nov 7, 2026
#650 (nft-23) is merged: tools/nftables/report.md after nft-20, nft-21 and nft-22. 277 of 380 tests of tests/shell pass on rukernel x86_64, and 215 in the first report.
The gate passed. The last item stays open for the full arm64 run. Next: nft-24 (the stateful objects
counter,quotaandlimit, thequotaandobjrefexpressions and the maps of objects).tamnd commentedon Nov 7, 2026
#651 (nft-24) is merged: the stateful objects of nf_tables (
counter,quotaandlimit), withNFT_MSG_NEWOBJ,GETOBJ,GETOBJ_RESET,DELOBJandDESTROYOBJ, thequotaexpression, theobjrefexpression with a name or a map of objects, and the elements withNFTA_SET_ELEM_OBJREF.ct helper,ct expectation,ct timeout,synproxyandsecmarkand the expressions of a set (NFTA_SET_EXPR) are not done, so listing/0013 and 0014objects_0, optionals/comments_objects_0, sets/0024named_objects_0, sets/0048set_counters_0 and sets/0051set_interval_counter_0 still fail.The gate passed. No item is complete with this change. The sets and maps item and the last item stay open.
tamnd commentedon Nov 12, 2026
#697 is merged. It adds the flowtables of nf_tables, as nf_tables_api.c and nft_flow_offload.c of Linux.
Result on x86_64 in the dirs flowtable, listing, owner and cache: 45 of 50 tests pass. Before #697, 29 passed. The arm64 boot test inet passes. The x86_64 boot test inet passes.
No item is ticked. The items of nf_tables objects and the expression VM have more work: the sets, the maps and the other dirs of the report.
tamnd commentedon Nov 12, 2026
#702 (nft-26) is merged. It adds the stateful expressions of sets and elements (NFTA_SET_EXPR and NFTA_SET_ELEM_EXPRESSIONS), and the connlimit expression and object.
Results of tests/shell (the kernel had this PR and the next one, nft-27):
No item is ticked. The sets and maps item is still open: payload set, numgen, meta keys, the ct objects and snat netmap are not done yet.
tamnd commentedon Nov 12, 2026
#707 (nft-27) is merged. The sets of nf_tables with ranges now work as nft_set_rbtree.c and nft_set_pipapo.c of Linux: get of a range, overlaps, concatenated ranges, adjacent ranges and the dump order of nft_pipapo_walk.
Result on x86_64 (server1): sets 81 of 93 pass (78 before) and maps 25 of 31. sets/0034get_element_0, 0044interval_overlap_0, 0047nat_0, 0067nat_concat_interval_0, maps/typeof_integer_0 and optimizations/merge_vmap_raw now pass. The inet boot tests pass on x86_64 and arm64.
The item "Sets and maps" stays open: sets/0046netmap_0, typeof_sets_0, sets_with_ifnames, 0028autoselect_0, 0055tcpflags_0, dynset_missing, 0024named_objects_0, maps/anon_objmap_concat, typeof_maps_0 and typeof_maps_add_delete still fail. sets/0043concatenated_ranges_0 fails on Linux too.