Add nftables support

[telmich]

Currently jool does not work with nftables. However some networks switched away from ipXtables completely and thus jool cannot be used in those environments anymore.

I can be a beta tester, if there is a need for it.

[ydahhrk]

some networks switched away from ipXtables completely and thus jool cannot be used in those environments anymore.

Is Netfilter Jool useless as well?
https://jool.mx/en/intro-jool.html#design

[ydahhrk]

I keep needing to reference the original emails when talking about this bug, so here are some quick links to them:

(question) https://mail-lists.nic.mx/pipermail/jool-list/2019-May/000247.html
(response) https://mail-lists.nic.mx/pipermail/jool-list/2019-May/000248.html

[telmich]

If you need someone for testing -- just let me know!

[ydahhrk]

I have a functioning prototype, in case you want to hammer it.

Unfortunately, nft is not extensible, which means that I had to mess with its code instead of creating a plugin. For the moment, you need to compile a custom nft build to be able to use Jool's nftables wrapper. I will shortly interact with the Netfilter team and hopefully the situation will be improved.

Download, compile and install the custom nftables build (BTW: probably uninstall the old one beforehand):

(Edit 2020-04-28: Updated instructions to account for the new "jool" branches)

# I'm assuming you already have the autotools.
sudo apt install flex bison asciidoc libgmp-dev libreadline-dev libmnl-dev

git clone https://github.com/ydahhrk/libnftnl.git
cd libnftnl
git checkout jool
./autogen.sh
./configure
make
sudo make install
cd ..

git clone https://github.com/ydahhrk/nftables.git
cd nftables
git checkout jool
./autogen.sh
./configure
make
sudo make install
cd ..

sudo ldconfig

(I'm testing in Ubuntu 18.04.3, by the way.)

Download, compile and install the new Jool (BTW: probably uninstall the old one beforehand):

git clone https://github.com/NICMx/Jool.git
cd Jool
git checkout issue285
./autogen.sh
./configure
make
sudo make install
sudo dkms install .
# jool --version should print "4.0.7.2"

Basic SIIT recipe:

sudo modprobe jool_siit
sudo jool_siit instance add "nft-instance" --iptables -6 64:ff9b::/96

# the names of the table and chain are irrelevant, of course
sudo nft add table inet table1
sudo nft add chain inet table1 chain1 \{ type filter hook prerouting priority 0 \; \}
# first argument is the xlator type, second one is the instance name
sudo nft add rule  inet table1 chain1 jool siit "nft-instance"

Basic NAT64 recipe:

sudo modprobe jool
sudo jool instance add "nft-instance" --iptables -6 64:ff9b::/96

sudo nft add table inet table1
sudo nft add chain inet table1 chain1 \{ type filter hook prerouting priority 0 \; \}
sudo nft add rule  inet table1 chain1 jool nat64 "nft-instance"

That translates in my test environment.

Two notes:

1. About --iptables: From Jool's point of view, nftables instances are literally the same as iptables instances, hence the flag. I'm considering deprecating --iptables in favor of something like "--tables" instead. Suggestions welcomed.
2. I'm using the filter chain thingy, which is maybe wrong. I think the nat chain wouldn't work because it's defined to only accept the first packet of each stream, which is bad for Jool as currently implemented. But I haven't tested it.

How does it look?

[ydahhrk]

Here's the conversation in Netfilter Devel so far:

• Initial query
• Laura Garcia's response
• Laurent Fasnacht's response
• My response to the previous two mails
• My update, a month later

[stv0g]

Just for reference in case somebody else stumbles over this bug.

I am getting the following error message on CentOS 8 which is like caused because CentOS 8 switches to nftables:

Error: Error receiving the kernel module's response: Invalid input data or parameter

[stv0g]

@ydahhrk Your new nft support works like a charm 😁 👍

One idea to avoid patching nft: is it possible to incorporate the modification of the nft chains into the jool userspace binary?

[ydahhrk]

@ydahhrk Your new nft support works like a charm

@stv0g Thank you. With this bit of confirmation, and since it's pretty safe to say the mail thread was forgotten, I intend to upload a formal patch as another ping attempt tomorrow.

One idea to avoid patching nft: is it possible to incorporate the modification of the nft chains into the jool userspace binary?

Wouldn't it be problematic from a user's perspective? If nft doesn't understand Jool, this is the kind of stuff that happens:

$ # Prepare a table with a bunch of rules.
$ sudo nftables/src/nft add table inet graybox
$ sudo nftables/src/nft add chain inet graybox test \{ type filter hook prerouting priority 0 \; \}
$ sudo nftables/src/nft add rule inet graybox test ct state invalid drop
$ sudo nftables/src/nft add rule inet graybox test jool siit default
$ sudo nftables/src/nft add rule inet graybox test ct state invalid drop
$
$ # Print table, according to jool-aware nft
$ sudo nftables/src/nft list ruleset
table inet graybox {
	chain test {
		type filter hook prerouting priority filter; policy accept;
		ct state invalid drop
		jool "siit" "default"
		ct state invalid drop
	}
}
$
$ # Print table, according to jool-unaware nft
$ sudo nft list ruleset
table inet graybox {
	chain test {
		type filter hook prerouting priority filter; policy accept;
		ct state invalid drop

		ct state invalid drop
	}
}
netlink: Error: unknown expression type 'jool'.

[stv0g]

Oh yes. Thats a problem 👎

I had a brief look at the nftables-aware version of iptables. But I could't figure out if they support extensions.