GNU bug report logs - #49540
[PATCH 0/2] services: nftables: Make it extandable

Previous Next

Full log

View this message in rfc822 format

From: Brice Waegeneire <brice <at> waegenei.re>
To: 49540 <at> debbugs.gnu.org
Cc: iyzsong <at> member.fsf.org, solene <at> perso.pw
Subject: [bug#49540] [PATCH 0/2] services: nftables: Make it extandable
Date: Mon, 12 Jul 2021 23:05:43 +0200

This patchset make "nftables-service-type" extendable, so other services could
open port.  I wrote this to be able to use libvirt with nftables (another
patch is comming about that) like this:

--8<---------------cut here---------------start------------->8---
(simple-service 'nftables-libvirt nftables-service-type
                   (list "# Libvirt?
add rule inet guix forward ct state established,related accept
add rule inet guix forward iifname \"virbr*\" accept

add chain inet guix libvirt
insert rule inet guix input iifname \"virbr*\" jump libvirt
insert rule inet guix libvirt udp dport 53 accept
insert rule inet guix libvirt tcp dport 53 accept
insert rule inet guix libvirt udp dport 67 accept
"))
--8<---------------cut here---------------end--------------->8---

So this should make it possible to implement Solene's
"simple-firewall-service"¹ by simply extending "nftables-service-type".

Also, now, stopping nftables only remove the "guix" table so other software
can use their own namespaces without being purged when that service is
stopped.

WDYT?

¹ <https://issues.guix.gnu.org/48975>

Brice Waegeneire (2): services: nftables: Only manage delete our
own table.  services: nftables: Make it extendable.

 gnu/services/networking.scm | 51 +++++++++++++++++++++++++++++--------
 1 file changed, 41 insertions(+), 10 deletions(-)

-- 
2.31.1

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.