From 4deb74b760d43d28e9ce6c32fc54aa83cfffa684 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 19 Aug 2019 20:20:27 +0300 Subject: [PATCH 1/4] iptables-compat: init iptables with nftables compatibility --- pkgs/os-specific/linux/iptables/default.nix | 34 +++++++++++++++------ pkgs/top-level/all-packages.nix | 4 ++- 2 files changed, 28 insertions(+), 10 deletions(-) diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix index cf06ff35325..6b25342ed4c 100644 --- a/pkgs/os-specific/linux/iptables/default.nix +++ b/pkgs/os-specific/linux/iptables/default.nix @@ -1,32 +1,48 @@ -{ stdenv, fetchurl, bison, flex, pkgconfig, pruneLibtoolFiles -, libnetfilter_conntrack, libnftnl, libmnl, libpcap }: +{ stdenv, fetchurl, pkgconfig, pruneLibtoolFiles, flex, bison +, libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap +, modeCompat ? false +}: + +with stdenv.lib; stdenv.mkDerivation rec { - pname = "iptables"; version = "1.8.3"; + pname = "iptables"; src = fetchurl { url = "https://www.netfilter.org/projects/${pname}/files/${pname}-${version}.tar.bz2"; sha256 = "106xkkg5crsscjlinxvqvprva23fwwqfgrzl8m2nn841841sqg52"; }; - nativeBuildInputs = [ bison flex pkgconfig pruneLibtoolFiles ]; + nativeBuildInputs = [ pkgconfig pruneLibtoolFiles flex bison ]; - buildInputs = [ libnetfilter_conntrack libnftnl libmnl libpcap ]; + buildInputs = [ libmnl libnetfilter_conntrack libnfnetlink libnftnl libpcap ]; preConfigure = '' export NIX_LDFLAGS="$NIX_LDFLAGS -lmnl -lnftnl" ''; configureFlags = [ - "--enable-devel" - "--enable-shared" "--enable-bpf-compiler" - ]; + "--enable-devel" + "--enable-libipq" + "--enable-nfsynproxy" + "--enable-shared" + ] ++ optional (!modeCompat) "--disable-nftables"; outputs = [ "out" "dev" ]; - meta = with stdenv.lib; { + postInstall = optional modeCompat '' + rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save} + ln -sv xtables-nft-multi $out/bin/iptables + ln -sv xtables-nft-multi $out/bin/iptables-restore + ln -sv xtables-nft-multi $out/bin/iptables-save + ln -sv xtables-nft-multi $out/bin/ip6tables + ln -sv xtables-nft-multi $out/bin/ip6tables-restore + ln -sv xtables-nft-multi $out/bin/ip6tables-save + ''; + + meta = { description = "A program to configure the Linux IP packet filtering ruleset"; homepage = https://www.netfilter.org/projects/iptables/index.html; platforms = platforms.linux; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index a0205c331b8..f946f432ae4 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -15629,7 +15629,9 @@ in iputils = callPackage ../os-specific/linux/iputils { }; - iptables = callPackage ../os-specific/linux/iptables { }; + iptables = iptables-legacy; + iptables-legacy = callPackage ../os-specific/linux/iptables { }; + iptables-compat = callPackage ../os-specific/linux/iptables { modeCompat = true; }; iptstate = callPackage ../os-specific/linux/iptstate { } ; From 32f6ce33eda127e643e9232863749b28a8429e17 Mon Sep 17 00:00:00 2001 From: Izorkin Date: Mon, 19 Aug 2019 20:21:24 +0300 Subject: [PATCH 2/4] nixos/firewall: add package option --- nixos/modules/services/networking/firewall.nix | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index 5b3aa19af3b..a1755fd84d4 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -331,6 +331,16 @@ in ''; }; + package = mkOption { + type = types.package; + default = pkgs.iptables; + example = pkgs.iptables-compat; + description = + '' + The iptables package to use for running the firewall service." + ''; + }; + logRefusedConnections = mkOption { type = types.bool; default = true; @@ -536,7 +546,7 @@ in networking.firewall.trustedInterfaces = [ "lo" ]; - environment.systemPackages = [ pkgs.iptables ] ++ cfg.extraPackages; + environment.systemPackages = [ cfg.package ] ++ cfg.extraPackages; boot.kernelModules = (optional cfg.autoLoadConntrackHelpers "nf_conntrack") ++ map (x: "nf_conntrack_${x}") cfg.connectionTrackingModules; @@ -555,7 +565,7 @@ in before = [ "network-pre.target" ]; after = [ "systemd-modules-load.service" ]; - path = [ pkgs.iptables ] ++ cfg.extraPackages; + path = [ cfg.package ] ++ cfg.extraPackages; # FIXME: this module may also try to load kernel modules, but # containers don't have CAP_SYS_MODULE. So the host system had From 88c5b206066d48c2038d230f219d69716f119162 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Sun, 22 Sep 2019 09:00:41 +0100 Subject: [PATCH 3/4] iptables-compat: rename to iptables-nftables-compat Same as debian, more clarity what the package is about. --- pkgs/os-specific/linux/iptables/default.nix | 6 +++--- pkgs/top-level/all-packages.nix | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix index 6b25342ed4c..882c24057bb 100644 --- a/pkgs/os-specific/linux/iptables/default.nix +++ b/pkgs/os-specific/linux/iptables/default.nix @@ -1,6 +1,6 @@ { stdenv, fetchurl, pkgconfig, pruneLibtoolFiles, flex, bison , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap -, modeCompat ? false +, nftablesCompat ? false }: with stdenv.lib; @@ -28,11 +28,11 @@ stdenv.mkDerivation rec { "--enable-libipq" "--enable-nfsynproxy" "--enable-shared" - ] ++ optional (!modeCompat) "--disable-nftables"; + ] ++ optional (!nftablesCompat) "--disable-nftables"; outputs = [ "out" "dev" ]; - postInstall = optional modeCompat '' + postInstall = optional nftablesCompat '' rm $out/sbin/{iptables,iptables-restore,iptables-save,ip6tables,ip6tables-restore,ip6tables-save} ln -sv xtables-nft-multi $out/bin/iptables ln -sv xtables-nft-multi $out/bin/iptables-restore diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index f946f432ae4..51ae18a9c9e 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -15631,7 +15631,7 @@ in iptables = iptables-legacy; iptables-legacy = callPackage ../os-specific/linux/iptables { }; - iptables-compat = callPackage ../os-specific/linux/iptables { modeCompat = true; }; + iptables-nftables-compat = callPackage ../os-specific/linux/iptables { nftablesCompat = true; }; iptstate = callPackage ../os-specific/linux/iptstate { } ; From ffa80e75b7a95d78173e2c787011eb85d7f9e2c8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Sun, 22 Sep 2019 09:09:43 +0100 Subject: [PATCH 4/4] nixos/firewall: rename iptables-compat to iptables-nftables-compat --- nixos/modules/services/networking/firewall.nix | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/firewall.nix b/nixos/modules/services/networking/firewall.nix index a1755fd84d4..5919962837a 100644 --- a/nixos/modules/services/networking/firewall.nix +++ b/nixos/modules/services/networking/firewall.nix @@ -334,7 +334,8 @@ in package = mkOption { type = types.package; default = pkgs.iptables; - example = pkgs.iptables-compat; + defaultText = "pkgs.iptables"; + example = literalExample "pkgs.iptables-nftables-compat"; description = '' The iptables package to use for running the firewall service."