Crate rustables

source ·
Expand description

Safe abstraction for userspace access to the in-kernel nf_tables subsystem. Can be used to create and remove tables, chains, sets and rules from the nftables firewall, the successor to iptables.

This library currently has quite rough edges and does not make adding and removing netfilter entries super easy and elegant. That is partly because the library needs more work, but also partly because nftables is super low level and extremely customizable, making it hard, and probably wrong, to try and create a too simple/limited wrapper. See examples for inspiration.

Understanding how to use the netlink subsystem and implementing this crate has mostly been done by reading the source code for the nftables userspace program and its corresponding kernel code, as well as attaching debuggers to the nft binary. Since the implementation is mostly based on trial and error, there might of course be a number of places where the forged netlink messages are used in an invalid or not intended way. Contributions are welcome!

Re-exports

  • pub use set::Set;

Modules

Structs

  • Batch
    A batch of netfilter messages to be performed in one atomic operation.
  • Chain
    Abstraction over an nftable chain. Chains reside inside Tables and they hold Rules.
  • Hook
  • Rule
    A nftables firewall rule.
  • Table
    Abstraction of a nftnl_table, the top level container in netfilter. A table has a protocol family and contains Chains that in turn hold the rules.

Enums

  • ChainPolicy
    A chain policy. Decides what to do with a packet that was processed by the chain but did not match any rules.
  • ChainType
    Base chain type.
  • HookClass
    The netfilter event hooks a chain can register for.
  • MsgType
    The type of the message as it’s sent to netfilter. A message consists of an object, such as a Table, Chain or Rule for example, and a MsgType to describe what to do with that object. If a Table object is sent with MsgType::Add then that table will be added to netfilter, if sent with MsgType::Del it will be removed.
  • Protocol
    Simple protocol description. Note that it does not implement other layer 4 protocols as IGMP et al. See Rule::igmp for a workaround.
  • ProtocolFamily
    Denotes a protocol. Used to specify which protocol a table or set belongs to.

Functions

Type Aliases