Portal:DeveloperDocs/nftables internals - Revision history

Phil: kernel/user expression relation exported into a dedicated article, link to it from here

2023-06-23T12:52:05Z

kernel/user expression relation exported into a dedicated article, link to it from here

@@ Line 49: / Line 49: @@
 * nft_lookup: search for data from a given register (key) into a dataset. If the set is a map/vmap, returns the value for that key.
-=== Relation to User Space ===
+See [[Ruleset_debug/VM_code_analysis]] for a description of how kernel's expressions relate to expressions and statements in user space and how to visualise this relation.
 = The userspace components =

Phil: /* expressions */ Documented relation between expressions in kernel and user space

2023-06-22T16:56:33Z

expressions: Documented relation between expressions in kernel and user space

@@ Line 36: / Line 36: @@
 == expressions ==
-There are many low expressions that allows us to operate over network packets in different ways. You can think on these low level expressions as assembly-like instructions.
+There are many low expressions that allows us to operate over network packets
 * nft_immediate: loads an immediate value into a register.
@@ Line 47: / Line 49: @@
 * nft_lookup: search for data from a given register (key) into a dataset. If the set is a map/vmap, returns the value for that key.
-'''TODO:''' add info.
+=== Relation to User Space ===
 = The userspace components =

Phil: /* nft: from the kernel to the usespace */

2022-09-13T15:30:13Z

nft: from the kernel to the usespace

@@ Line 318: / Line 318: @@
 populating the field '''attr''' in '''struct cmd'''.
-= nft: from the kernel to the usespace =
+= nft: from the kernel to user space =
-'''TODO:''' add info.
+Communication between '''nft''' in user space and '''nftables''' in  kernel

Phil: /* nft: from userspace to the kernel */

2022-09-13T12:24:08Z

nft: from userspace to the kernel

Show changes

Phil: Added section about libnftables

2022-05-19T16:47:17Z

Added section about libnftables

@@ Line 139: / Line 139: @@
 == libnftables ==
-'''TODO:''' add info.
+One goal in nftables development was to provide users with a library for easier
 = nft: from userspace to the kernel =

Phil: Add a description of libnftnl

2022-05-06T16:15:16Z

Add a description of libnftnl

@@ Line 62: / Line 62: @@
 == libnftnl ==
-'''TODO:''' add info.
+This library provides data structures for entities existing in nf_tables
 == libnftables ==

Fmyhr: /* expressions */ dictionary -> vmap

2021-02-12T10:43:29Z

expressions: dictionary -> vmap

← Older revision		Revision as of 10:43, 12 February 2021
Line 45:		Line 45:
	* nft_counter: a basic counter for packet/bytes that gets incremented everything is evaluated for a packet.		* nft_counter: a basic counter for packet/bytes that gets incremented everything is evaluated for a packet.
	* nft_meta: set/get packet meta information, such as related interfaces, timestamps, etc.		* nft_meta: set/get packet meta information, such as related interfaces, timestamps, etc.
	* nft_lookup: search for data from a given register (key) into a dataset. If the set is a map/~~dictionary~~, returns the value for that key.		* nft_lookup: search for data from a given register (key) into a dataset. If the set is a map/vmap, returns the value for that key.

	'''TODO:''' add info.		'''TODO:''' add info.

Arturo: /* The kernel subsystem */ mentions briefly expressions

2019-08-02T12:25:29Z

The kernel subsystem: mentions briefly expressions

@@ Line 31: / Line 31: @@
 *** evaluate the packet against the expression
 ** evaluate expression return code (break, continue, drop, accept, jump, goto, etc)
 '''TODO:''' add info.

Arturo: create page with basic content

2019-08-02T12:15:28Z

create page with basic content

New page

This page contains information for Netfilter developers on how '''nftables internals''' work.

= The kernel subsystem =

The '''nf_tables''' kernel subsystem contains 2 key components:

* the netlink API (i.e, control plane API)
* the nf_tables core (i.e, the data plane engine)

Other components, such as external modules, are also in place and are intermixed with both the API and the core.

Generally speaking, the nf_tables subsystem is implementing a virtual machine of low-level expressions that operates on network packets.

'''TODO:''' add info.

== nf_tables netlink API ==

The source code is mostly in '''net/netfilter/nf_tables_api.c''' [https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_api.c [elixir src]] [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/netfilter/nf_tables_api.c [git src]]

'''TODO:''' add info.

== nf_tables core ==

The source code is mostly in '''net/netfilter/nf_tables_core.c''' [https://elixir.bootlin.com/linux/latest/source/net/netfilter/nf_tables_core.c [elixir src]] [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/netfilter/nf_tables_core.c [git src]]

You can see there one of the most important functions in the core: '''nft_do_chain()'''. In a nut shell, this is the function that evaluates network packets against the ruleset.

The logic in this function is rather simple:
* for each rule in the chain
** for each low level expression in the rule
*** evaluate the packet against the expression
** evaluate expression return code (break, continue, drop, accept, jump, goto, etc)

'''TODO:''' add info.

= The userspace components =

There are several important components in the userpsace part of nftables:
* '''libmnl''': generic low level library used to communicate with the kernel using netlink sockets.
* '''libnftnl''': low level library that is capable of interacting with the nf_tables subsystem netlink API in the kernel. Is responsible for creating/parsing the nf_tables netlink messages. Uses libmnl under the hood.
* '''libnftables''': high level library that implements the logic to translate from high level statements to netlink objects and the other way around. Uses libnftnl under the hood.
* '''nft''': the command line interface binary. This is what most end users actually use in their systems. It reads user input and calls libnftables under the hood.

Generally speaking, the userspace compiles high level statements (rules, etc) into the netlink bytecode that the kernel API understands
When inspecting the ruleset (i.e, listing it) what it does is the opposite, reconstruct the low level netlink bytecode into high level statements.

== libnftnl ==

'''TODO:''' add info.

== libnftables ==

'''TODO:''' add info.

= nft: from userspace to the kernel =

'''TODO:''' add info.

= nft: from the kernel to the usespace =

'''TODO:''' add info.