Creating a new network object

Oct 13, 2025 by pinkandtrash.com 103 views

Introduction

The bridge driver in nftables currently manages its iptables rules inline with the rest of its logic. However, this approach can be limiting and inflexible. To address this issue, we propose extracting the iptables rule management code and putting it behind an interface. This will allow nftables and firewalld code to be swapped in at runtime, providing greater flexibility and customization options.

Current Proposal

Our current proposal involves creating an abstract interface called "add network" that can be used to manage iptables rules. This interface will be designed to fit in with the bridge driver's current structure, where possible. The interface will provide methods for adding and deleting network-level rules, as well as managing published ports and legacy links.

Interface Design

The interface will consist of two main components: Firewaller and Network. The Firewaller interface will provide methods for creating a new network object and setting the default policy of the FORWARD chain in the filter table to DROP. The Network interface will provide methods for deleting network-level rules, adding and deleting published ports, and adding and deleting legacy links.

Firewaller Interface

type Firewaller interface {
    // NewNetwork returns an object that can be used to add published ports and legacy
    // links for a bridge network.
    NewNetwork(nc NetworkConfig) (Network, error)
    // FilterForwardDrop sets the default policy of the FORWARD chain in the filter
    // table to DROP.
    FilterForwardDrop(ipv IPVersion) error
}

Network Interface

type Network interface {
    // DelNetworkLevelRules deletes any configuration set up by [Firewaller.NewNetwork].
    // It does not delete per-port or per-link rules. The caller is responsible for tracking
    // those and deleting them when the network is removed.
    DelNetworkLevelRules() error

    // AddPorts adds the configuration needed for published ports.
    AddPorts(pbs []types.PortBinding) error
    // DelPorts deletes the configuration needed for published ports.
    DelPorts(pbs []types.PortBinding) error

    // AddLink adds the configuration needed for a legacy link.
    AddLink(ctx context.Context, parentIP, childIP net.IP, ports []types.TransportPort) error
    // DelLink deletes the configuration needed for a legacy link.
    DelLink(ctx context.Context, parentIP, childIP net.IP, ports []types.TransportPort)
}

Benefits

By putting iptables rules behind an interface, we can provide several benefits, including:

Flexibility: The ability to swap in different firewalld and nftables code at runtime, allowing for greater customization and flexibility.
Modularity: The interface design allows for modular code, making it easier to maintain and update individual components without affecting the rest of the system.
Reusability: The interface can be reused across different components and systems, reducing code duplication and improving maintainability.

Implementation

To implement the interface, we will need to create a new package that contains the Firewaller and Network interfaces. We will also need to create a new package that contains the implementation of the Firewaller and Network interfaces.

Firewaller Implementation

package firewaller

import (
    "context"
    "net"
    "netip"
    "types"
)

type firewaller struct{}

func (f *firewaller) NewNetwork(nc NetworkConfig) (Network, error) {
    // Create a new network object
    return &network{nc: nc}, nil
}

func (f *firewaller) FilterForwardDrop(ipv IPVersion) error {
    // Set the default policy of the FORWARD chain in the filter table to DROP
    return nil
}

Network Implementation

package network

import (
    "context"
    "net"
    "netip"
    "types"
)

type network struct {
    nc NetworkConfig
}

func (n *network) DelNetworkLevelRules() error {
    // Delete any configuration set up by [Firewaller.NewNetwork]
    return nil
}

func (n *network) AddPorts(pbs []types.PortBinding) error {
    // Add the configuration needed for published ports
    return nil
}

func (n *network) DelPorts(pbs []types.PortBinding) error {
    // Delete the configuration needed for published ports
    return nil
}

func (n *network) AddLink(ctx context.Context, parentIP, childIP net.IP, ports []types.TransportPort) error {
    // Add the configuration needed for a legacy link
    return nil
}

func (n *network) DelLink(ctx context.Context, parentIP, childIP net.IP, ports []types.TransportPort) error {
    // Delete the configuration needed for a legacy link
    return nil
}

Conclusion

Introduction

In our previous article, we discussed the benefits of putting iptables rules behind an interface in the nftables bridge driver. In this article, we will answer some frequently asked questions (FAQs) about this approach.

Q: What are the benefits of putting iptables rules behind an interface?

A: The benefits of putting iptables rules behind an interface include:

Flexibility: The ability to swap in different firewalld and nftables code at runtime, allowing for greater customization and flexibility.
Modularity: The interface design allows for modular code, making it easier to maintain and update individual components without affecting the rest of the system.
Reusability: The interface can be reused across different components and systems, reducing code duplication and improving maintainability.

Q: How does the interface design work?

A: The interface design consists of two main components: Firewaller and Network. The Firewaller interface provides methods for creating a new network object and setting the default policy of the FORWARD chain in the filter table to DROP. The Network interface provides methods for deleting network-level rules, adding and deleting published ports, and adding and deleting legacy links.

Q: What is the difference between the `Firewaller` and `Network` interfaces?

A: The Firewaller interface is responsible for creating a new network object and setting the default policy of the FORWARD chain in the filter table to DROP. The Network interface is responsible for managing the network-level rules, published ports, and legacy links.

Q: How do I implement the `Firewaller` and `Network` interfaces?

A: To implement the Firewaller and Network interfaces, you will need to create a new package that contains the interface definitions. You will also need to create a new package that contains the implementation of the interfaces.

Q: What are the advantages of using the `Firewaller` and `Network` interfaces?

A: The advantages of using the Firewaller and Network interfaces include:

Improved modularity: The interface design allows for modular code, making it easier to maintain and update individual components without affecting the rest of the system.
Increased reusability: The interface can be reused across different components and systems, reducing code duplication and improving maintainability.
Greater flexibility: The ability to swap in different firewalld and nftables code at runtime, allowing for greater customization and flexibility.

Q: How do I test the `Firewaller` and `Network` interfaces?

A: To test the Firewaller and Network interfaces, you will need to create a test package that contains test cases for the interfaces. You can use a testing framework such as Go's built-in testing package to write and run the test cases.

Q: What are some common use cases for the `Firewaller` and `Network` interfaces?

A: Some common use cases for the Firewaller and Network interfaces include:

Creating a new network object: The Firewaller interface provides a method for creating a new network object.
Setting the default policy of the FORWARD chain: The Firewaller interface provides a method for setting the default policy of the FORWARD chain in the filter table to DROP.
Managing network-level rules: The Network interface provides methods for deleting network-level rules, adding and deleting published ports, and adding and deleting legacy links.

Conclusion

In conclusion, putting iptables rules behind an interface provides several benefits, including flexibility, modularity, and reusability. By implementing the Firewaller and Network interfaces, you can create a more modular and maintainable system that can be easily customized and extended.