google / google/nftables

Implement expression for matching on source IP?

Open
#5 7 comments 1 reaction 0 assignees View on GitHub
Dominant language
Go
Stars
1.4k
Forks
184
PR merge metrics
No merged PRs in 30d

Description

Heya,

TL;DR: I'm trying to implement the equivalent of running:

```shell

sudo strace nft add rule nat postrouting ip saddr 192.168.69.2 masquerade
```

It doesnt look like this library supports source address rules out of the box. I found [this](https://github.com/rtr7/router7/blob/master/internal/netconfig/netconfig.go) which doesnt seem to be terribly different, but I also dont understand (we are throwing bytecode down the netlink socket?)

I tried stracing nft, I tried poking around the nfnl source ... everything seems really hard to follow. Could you give me some direction on how to implement this? happy to write the code, I'm just very lost rn.

Tail end of the strace:

```

socket(AF_NETLINK, SOCK_RAW, NETLINK_NETFILTER) = 3
fcntl(3, F_SETFL, O_RDONLY|O_NONBLOCK) = 0
mmap(NULL, 204800, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7feba6a75000
setsockopt(3, SOL_SOCKET, SO_SNDBUFFORCE, [131072], 4) = 0
sendmsg(3, {msg_name={sa_family=AF_NETLINK, nl_pid=0, nl_groups=00000000}, msg_namelen=12, msg_iov=[{iov_base=[{{len=20, type=0x10 /* NLMSG_??? */, flags=NLM_F_REQUEST, seq=0, pid=0}, "\x00\x00\x0a\x00"}, {{len=184, type=0xa06 /* NLMSG_??? */, flags=NLM_F_REQUEST|0xe00, seq=1, pid=0}, "\x02\x00\x00\x00\x08\x00\x01\x00\x6e\x61\x74\x00\x10\x00\x02\x00\x70\x6f\x73\x74\x72\x6f\x75\x74\x69\x6e\x67\x00\x8c\x00\x04\x80"...}, {{len=20, type=0x11 /* NLMSG_??? */, flags=NLM_F_REQUEST, seq=2, pid=0}, "\x00\x00\x0a\x00"}], iov_len=224}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 224
select(4, [3], NULL, NULL, {tv_sec=0, tv_usec=0}) = 0 (Timeout)
munmap(0x7feba6a75000, 204800) = 0
close(3) = 0
exit_group(0) = ?
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.