7 releases
new 0.8.5 | Oct 10, 2024 |
---|---|
0.8.4 | Aug 21, 2024 |
0.8.2 | Oct 18, 2023 |
0.8.1 | Mar 18, 2023 |
0.8.0 | Jan 9, 2023 |
#248 in Unix APIs
371 downloads per month
155KB
4K
SLoC
rustables
Safe abstraction for userspace access to the in-kernel nf_tables subsystem. Can be used to create and remove tables, chains, sets and rules from the nftables firewall, the successor to iptables.
This library is a fork of the nftnl-rs
crate. Let us thank here the original project
team for their great work without which this library would probably not exist today.
This library currently has quite rough edges and does not make adding and removing netfilter entries super easy and elegant. That is partly because the library needs more work, but also partly because nftables is super low level and extremely customizable, making it hard, and probably wrong, to try and create a too simple/limited wrapper. See examples for inspiration.
Understanding how to use the netlink subsystem and implementing this crate has mostly been done by
reading the source code for the nftables
userspace program and its corresponding kernel code,
as well as attaching debuggers to the nft
binary.
Since the implementation is mostly based on trial and error, there might of course be
a number of places where the forged netlink messages are used in an invalid or not intended way.
Contributions are welcome!
Licensing
License: GNU GPLv3
Original work licensed by Amagicom AB under MIT/Apache-2.0.
Dependencies
~2–4.5MB
~91K SLoC