<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
Hi Tomer,<br>
<div class="moz-cite-prefix"><br>
</div>
<blockquote
cite="mid:CA+eXE3zJy5Ye8cbrA9gM-K4PdLOAjBf+Vh0dc8GEfrnbjnxgog@mail.gmail.com"
type="cite"><br>
<p dir="ltr">Regarding the firewall package - its probably a dumb
question, but isn't this the reason for nftables' compatibility
layer? (<a moz-do-not-send="true"
href="http://git.netfilter.org/iptables-nftables/">http://git.netfilter.org/iptables-nftables/</a>)</p>
</blockquote>
afaik - and please correct me if I'm wrong - that works only for the
iptables CLI command, however our firewall tool currently uses
libiptables directly so I don't think it would work easily.<br>
<br>
<br>
Cheers,<br>
<br>
Steven<br>
<br>
<blockquote
cite="mid:CA+eXE3zJy5Ye8cbrA9gM-K4PdLOAjBf+Vh0dc8GEfrnbjnxgog@mail.gmail.com"
type="cite">
<p dir="ltr">Best Regards,</p>
<p dir="ltr">Tomer</p>
<div class="gmail_quote">On Dec 14, 2014 7:08 PM, "Steven Barth"
<<a moz-do-not-send="true" href="mailto:cyrus@openwrt.org">cyrus@openwrt.org</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
Hi Tomer,<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
I am currently working on a kernel module which offloads
traffic from the Networking stack.<br>
This is part of a project which optimizes IP forwarding for
low end routers that have weak CPU and low on memory.<br>
</blockquote>
Sounds interesting. Other approaches of speeding up forwarding
are btw. also investigated right now, see <a
moz-do-not-send="true"
href="https://dev.openwrt.org/changeset/43587"
target="_blank">https://dev.openwrt.org/changeset/43587</a><br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
<br>
I saw that nftables and libnftables are not yet supported in
my openwrt codebase (I am working with attitude adjustment
14.07)<br>
</blockquote>
there is no attitude adjustment 14.07. attitude adjustment is
12.09, barrier breaker is 14.07.<br>
<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
- but saw that recently some nftables related patches were
added to the master branch by you.<br>
Could you please share the current status of nftables
support in openwrt?<br>
</blockquote>
nftables is packaged, I added some patches so that it is a bit
more embedded friendly (some of those are upstream, some of
them aren't). I also packaged and reorganised the netfilter
kernel packages.<br>
<br>
So you can select nftables in menuconfig and can play around
with it. You can also get rid of iptables and use nftables
only by deselecting the related packages.<br>
<br>
<br>
Known Issues<br>
* In general its not well tested. It might blow up here or
there. Help and bugreports are appreciated.<br>
<br>
* We are aiming for kernel 3.14 for the next release which has
somewhat reasonable nftables support but lacks some useful
things e.g. devgroups, extended reject support among maybe
other things iirc. So it will be there to play around / get a
first look at it but thats it. I don't know how the following
release will look but I wouldn't keep my hopes up all too high
there for it to change that much.<br>
<br>
* Which brings us to the main issue, our firewall abstraction
(the firewall package, all the /etc/config/firewall magic) is
tied to iptables at the moment, so if you want to use nftables
right now you get bare metal and have to write your own
rulesets completely from scratch, cannot use
/etc/config/firewall or a gui.<br>
Hopefully someone will put some effort into this next year and
refactor our firewall daemon to use nftables but thats a major
effort. Also at the moment its not very clear when the
netfilter team will create a high-level library to interact
with nftables which would probably be sort of a prerequisite
for it depending on how this rewritten daemon will work.<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Regardless, I will be happy to participate with the
development and testing of nftables if needed, just let me
know if I can help,<br>
</blockquote>
Feel free to play around with it and send me bugreports etc.<br>
<br>
If it looks like an nftables bug you should probably contact
the netfilter guys directly. If it looks like I messed up a
patch or a package definition then tell me.<br>
<br>
<br>
<br>
Cheers,<br>
<br>
Steven<br>
</blockquote>
</div>
</blockquote>
<br>
</body>
</html>