unkin/tomswall
4
0
Fork 0
Code Issues 5 Pull Requests 3 Actions Packages Projects Releases 4 Wiki Activity

Create the nftables table in the configured address family #32

Merged
benvin merged 2 commits from benvin/v4-only-family into main 2026-10-04 15:43:07 +11:00
Conversation 1 Commits 2 Files Changed 6
+239 -35
unkin-agent commented 2026-10-04 15:36:09 +11:00
Member
Copy Link
Copy Source

A migrated shorewall (v4) config sets address_family: ip, but the engine always creates an inet table, so its drop/reject policies also hit IPv6 (NDP, ICMPv6, OSPFv3) that shorewall never filtered.

  • create, read, snapshot and flush the table in the configured address family
  • delete an overlapping table of another family (inet vs ip/ip6) on apply and flush
  • snapshot the replaced table when switching family so try/revert restores it
  • reject with icmp/icmpv6 port-unreachable in ip/ip6 tables (icmpx is inet-only)
A migrated shorewall (v4) config sets `address_family: ip`, but the engine always creates an `inet` table, so its drop/reject policies also hit IPv6 (NDP, ICMPv6, OSPFv3) that shorewall never filtered. - create, read, snapshot and flush the table in the configured address family - delete an overlapping table of another family (inet vs ip/ip6) on apply and flush - snapshot the replaced table when switching family so try/revert restores it - reject with icmp/icmpv6 port-unreachable in ip/ip6 tables (icmpx is inet-only)
unkin-agent added 1 commit 2026-10-04 15:36:09 +11:00
Create the nftables table in the configured address family
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
d949fc4772
unkin-agent commented 2026-10-04 15:37:36 +11:00
Author
Member
Copy Link
Copy Source
  • internal/nftables/engine.go:338-352 — Snapshot returns only the configured-family table when it exists and ignores a coexisting overlapping table that apply() will then delete (ip table + leftover inet: revert loses the inet table) → snapshot the overlapping table whenever staleTables() is non-empty, or document/guard the case.
  • nit: internal/nftables/compiler.go:230 — helper L3Proto is hardcoded NFPROTO_INET but is now created in ip/ip6 tables → derive it from the configured family (NFPROTO_IPV4/IPV6) and add a test for an ip-table helper; confirm the kernel accepts an inet l3proto helper object in an ip table.
- internal/nftables/engine.go:338-352 — Snapshot returns only the configured-family table when it exists and ignores a coexisting overlapping table that apply() will then delete (ip table + leftover inet: revert loses the inet table) → snapshot the overlapping table whenever staleTables() is non-empty, or document/guard the case. - nit: internal/nftables/compiler.go:230 — helper L3Proto is hardcoded NFPROTO_INET but is now created in ip/ip6 tables → derive it from the configured family (NFPROTO_IPV4/IPV6) and add a test for an ip-table helper; confirm the kernel accepts an inet l3proto helper object in an ip table.
unkin-agent added 1 commit 2026-10-04 15:41:10 +11:00
Merge remote-tracking branch 'origin/main' into benvin/v4-only-family
ci/woodpecker/pr/build Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
d6dfeb62b6 
# Conflicts:
#	internal/nftables/engine.go
benvin merged commit b8410488d2 into main 2026-10-04 15:43:07 +11:00
benvin deleted branch benvin/v4-only-family 2026-10-04 15:43:07 +11:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 wontfix
This won't be fixed
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
benvin (BenVincent) unkin-agent (Unkin Agent) unkinben (Ben Vincent)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: unkin/tomswall#32
Delete Branch "benvin/v4-only-family"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?