Nft backend - #13
Open
dodys wants to merge 8 commits into
Open
Conversation
Move iptables-specific attributes (iptables, ip6tables, iptables_restore, ip6tables_restore, iptables_version, caps, initcaps) out of UFWBackend and into UFWBackendIptables where they belong. This allows the base class to be subclassed by non-iptables backends without carrying iptables baggage. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add #NFTABLES_DIR# placeholder alongside the existing #IPTABLES_DIR#, to be substituted with the actual nft binary directory at install time. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add nftables equivalents of before.rules, after.rules and user.rules. Uses the inet family to handle IPv4 and IPv6 in a single table named 'ufw', replacing the separate v4/v6 iptables rule file pairs. before.nft covers: loopback, conntrack, ICMPv4/v6, DHCPv4/v6, NDP, MLD, mDNS, UPnP, and non-local packet filtering. after.nft covers: suppression of noisy NetBIOS/DHCP/broadcast traffic from default-policy logging. user.nft: empty template populated by ufw at runtime. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Implement a new backend class UFWBackendNftables that drives the nft(8) utility directly, without any iptables dependency. Key design points: - Uses a single 'table inet ufw' (IPv4+IPv6 unified), replacing the parallel v4/v6 iptables rule-file model. - Rule storage reuses the existing ### tuple ### comment format so that ufw's rule-comparison logic is backend-agnostic. - Atomic rule loading via 'nft -f' (flush+reload in one transaction). - Rate limiting via nft meter instead of xt_recent kernel module. - format_rule_nft() translates UFWRule objects to nft add rule syntax. - _write_rules(v6=True) is a no-op; all rules go into the single user.nft on the v6=False pass. - initcaps() is a no-op; nftables supports all required features natively. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
- conf/ufw.defaults: add FIREWALL_BACKEND="iptables" (default keeps existing behaviour; set to "nftables" to activate the new backend). - src/util.py: add get_firewall_backend(config_dir) helper that reads the setting and falls back to "iptables" for backwards compatibility. - src/frontend.py: UFWFrontend.__init__() now accepts backend_type=None, reads FIREWALL_BACKEND via get_firewall_backend(), and instantiates either UFWBackendNftables or UFWBackendIptables accordingly. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Refactor ufw-init-functions to support both iptables and nftables backends via the FIREWALL_BACKEND setting in ufw.defaults. - Rename existing start/stop/status/reload logic to ipt_ufw_* functions. - Add nft_ufw_start, nft_ufw_stop, nft_ufw_status that drive nft(8) directly using the inet family rule files (before.nft, user.nft, after.nft). - Public ufw_start / ufw_stop / ufw_reload / ufw_status now dispatch to the appropriate ipt_* or nft_* implementation based on $FIREWALL_BACKEND. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
28 unit tests covering: - FormatRuleNftTestCase (16 tests): verifies format_rule_nft() produces correct nft add rule syntax for allow/deny/limit/reject rules with TCP/UDP, port ranges, address prefixes, interfaces, app rules, and both IPv4 and IPv6. - BackendNftablesTestCase (12 tests): backend initialisation, default policy handling, start/stop/reset lifecycle, and _write_rules no-op behaviour for the v6 pass. Run via: ./run_tests.sh -i python3 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Detect the nft binary at build time and substitute #NFTABLES_DIR# in common.py alongside the existing #IPTABLES_DIR# substitution. Install the .nft template files to /etc/ufw/ (mode 640, user-editable) and pristine copies to $(DATADIR)/ufw/nftables/ (mode 644, distribution defaults), mirroring the existing .rules / iptables/ handling. Co-Authored-By: opencode <noreply@opencode.ai>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is a port of the PR: https://code.launchpad.net/~ebarretto/ufw/+git/ufw/+merge/507425 but for this new repo.