From cf9ac2b544aca2b5af5cf1650aafefc88605c95f Mon Sep 17 00:00:00 2001 From: misuzu Date: Thu, 27 Feb 2020 12:47:33 +0200 Subject: [PATCH 01/10] iptables: switch from iptables-legacy to iptables-nftables-compat This should ease the migration to nftables. --- pkgs/os-specific/linux/iptables/default.nix | 2 +- pkgs/os-specific/linux/nftables/default.nix | 2 +- pkgs/top-level/all-packages.nix | 6 +++--- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix index fe0e82c4a8e6..50730597d9e6 100644 --- a/pkgs/os-specific/linux/iptables/default.nix +++ b/pkgs/os-specific/linux/iptables/default.nix @@ -1,6 +1,6 @@ { lib, stdenv, fetchurl, pkg-config, pruneLibtoolFiles, flex, bison , libmnl, libnetfilter_conntrack, libnfnetlink, libnftnl, libpcap -, nftablesCompat ? false +, nftablesCompat ? true }: with lib; diff --git a/pkgs/os-specific/linux/nftables/default.nix b/pkgs/os-specific/linux/nftables/default.nix index e0e69adb4b6b..73adcd786057 100644 --- a/pkgs/os-specific/linux/nftables/default.nix +++ b/pkgs/os-specific/linux/nftables/default.nix @@ -4,7 +4,7 @@ , gmp, jansson, readline , withDebugSymbols ? false , withPython ? false , python3 -, withXtables ? false , iptables +, withXtables ? true , iptables }: with lib; diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index c53485f5dea4..207aae294fc0 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -21396,9 +21396,9 @@ with pkgs; iputils = hiPrio (callPackage ../os-specific/linux/iputils { }); # hiPrio for collisions with inetutils (ping and tftpd.8.gz) - iptables = iptables-legacy; - iptables-legacy = callPackage ../os-specific/linux/iptables { }; - iptables-nftables-compat = callPackage ../os-specific/linux/iptables { nftablesCompat = true; }; + iptables = callPackage ../os-specific/linux/iptables { }; + iptables-legacy = callPackage ../os-specific/linux/iptables { nftablesCompat = false; }; + iptables-nftables-compat = iptables; iptstate = callPackage ../os-specific/linux/iptstate { } ; From 12a9f1e625ed04de4742902adea9dd8b26dbb250 Mon Sep 17 00:00:00 2001 From: misuzu Date: Sun, 15 Mar 2020 16:55:58 +0200 Subject: [PATCH 02/10] libvirt: use ebtables from iptables package --- .../development/libraries/libvirt/default.nix | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) diff --git a/pkgs/development/libraries/libvirt/default.nix b/pkgs/development/libraries/libvirt/default.nix index dca856dbb571..27b69ef1bb0b 100644 --- a/pkgs/development/libraries/libvirt/default.nix +++ b/pkgs/development/libraries/libvirt/default.nix @@ -22,7 +22,6 @@ , gettext , libtasn1 , iptables -, ebtables , libgcrypt , yajl , pmutils @@ -68,19 +67,6 @@ with lib; # if you update, also bump and SysVirt in let buildFromTarball = stdenv.isDarwin; - # libvirt hardcodes the binary name 'ebtables', but in nixpkgs the ebtables - # binary we want to use is named 'ebtables-legacy'. - # Create a derivation to alias the binary name so that libvirt can find the right one, and use that below. - ebtables-compat = stdenv.mkDerivation { - pname = "ebtables-compat"; - version = ebtables.version; - src = null; - buildInputs = [ ebtables ]; - buildCommand = '' - mkdir -p $out/bin - ln -sf ${ebtables}/bin/ebtables-legacy $out/bin/ebtables - ''; - }; in stdenv.mkDerivation rec { pname = "libvirt"; @@ -178,7 +164,7 @@ stdenv.mkDerivation rec { ''; in '' - PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables ebtables-compat lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH + PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH # the path to qemu-kvm will be stored in VM's .xml and .save files # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations substituteInPlace src/lxc/lxc_conf.c \ @@ -226,8 +212,7 @@ stdenv.mkDerivation rec { postInstall = let - # Keep the legacy iptables binary for now for backwards compatibility (comment on #109332) - binPath = [ iptables ebtables-compat iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ]; + binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ]; in '' substituteInPlace $out/libexec/libvirt-guests.sh \ From a15070a52e46a950524eee60bb9fc44e8463b22d Mon Sep 17 00:00:00 2001 From: misuzu Date: Wed, 15 Sep 2021 08:57:19 +0300 Subject: [PATCH 03/10] nixos/libvirtd: use /etc/ethertypes from iptables package --- nixos/modules/virtualisation/libvirtd.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/libvirtd.nix b/nixos/modules/virtualisation/libvirtd.nix index 3c291397a998..45fb363043b7 100644 --- a/nixos/modules/virtualisation/libvirtd.nix +++ b/nixos/modules/virtualisation/libvirtd.nix @@ -167,7 +167,7 @@ in { etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e: "allow ${e}") cfg.allowedBridges; systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ]; - etc.ethertypes.source = "${pkgs.ebtables}/etc/ethertypes"; + etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes"; }; boot.kernelModules = [ "tun" ]; From 80d76320cad648d3ffa93ebcc7a5b02c01733bb8 Mon Sep 17 00:00:00 2001 From: misuzu Date: Tue, 28 Apr 2020 13:40:00 +0300 Subject: [PATCH 04/10] libvirt_5_9_0: use ebtables from iptables package --- pkgs/development/libraries/libvirt/5.9.0.nix | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/pkgs/development/libraries/libvirt/5.9.0.nix b/pkgs/development/libraries/libvirt/5.9.0.nix index c8ad0e7e6030..f7a393e8fda9 100644 --- a/pkgs/development/libraries/libvirt/5.9.0.nix +++ b/pkgs/development/libraries/libvirt/5.9.0.nix @@ -2,7 +2,7 @@ , pkg-config, makeWrapper, libtool, autoconf, automake, fetchpatch , coreutils, libxml2, gnutls, perl, python2, attr , iproute2, iptables, readline, lvm2, util-linux, systemd, libpciaccess, gettext -, libtasn1, ebtables, libgcrypt, yajl, pmutils, libcap_ng, libapparmor +, libtasn1, libgcrypt, yajl, pmutils, libcap_ng, libapparmor , dnsmasq, libnl, libpcap, libxslt, xhtml1, numad, numactl, perlPackages , curl, libiconv, gmp, zfs, parted, bridge-utils, dmidecode, glib, rpcsvc-proto, libtirpc , enableXen ? false, xen ? null @@ -54,7 +54,7 @@ in stdenv.mkDerivation rec { preConfigure = '' ${ optionalString (!buildFromTarball) "./bootstrap --no-git --gnulib-srcdir=$(pwd)/.gnulib" } - PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables ebtables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH + PATH=${lib.makeBinPath ([ dnsmasq ] ++ optionals stdenv.isLinux [ iproute2 iptables lvm2 systemd numad ] ++ optionals enableIscsi [ openiscsi ])}:$PATH # the path to qemu-kvm will be stored in VM's .xml and .save files # do not use "''${qemu_kvm}/bin/qemu-kvm" to avoid bound VMs to particular qemu derivations substituteInPlace src/lxc/lxc_conf.c \ @@ -75,7 +75,6 @@ in stdenv.mkDerivation rec { ] ++ optionals stdenv.isLinux [ "QEMU_BRIDGE_HELPER=/run/wrappers/bin/qemu-bridge-helper" "QEMU_PR_HELPER=/run/libvirt/nix-helpers/qemu-pr-helper" - "EBTABLES_PATH=${ebtables}/bin/ebtables-legacy" "CFLAGS=-I${libtirpc.dev}/include/tirpc" "--with-attr" "--with-apparmor" @@ -101,7 +100,7 @@ in stdenv.mkDerivation rec { postInstall = let - binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ebtables ] ++ optionals enableIscsi [ openiscsi ]; + binPath = [ iptables iproute2 pmutils numad numactl bridge-utils dmidecode dnsmasq ] ++ optionals enableIscsi [ openiscsi ]; in '' substituteInPlace $out/libexec/libvirt-guests.sh \ --replace 'ON_BOOT=start' 'ON_BOOT=''${ON_BOOT:-start}' \ From 595b328a1772936bf701c642f09631ad0fcb1907 Mon Sep 17 00:00:00 2001 From: misuzu Date: Sun, 15 Mar 2020 17:03:26 +0200 Subject: [PATCH 05/10] lxd: use ebtables from iptables package --- pkgs/tools/admin/lxd/default.nix | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/pkgs/tools/admin/lxd/default.nix b/pkgs/tools/admin/lxd/default.nix index 523f8165802e..ecdcefdd773f 100644 --- a/pkgs/tools/admin/lxd/default.nix +++ b/pkgs/tools/admin/lxd/default.nix @@ -1,22 +1,14 @@ { lib, hwdata, pkg-config, lxc, buildGoPackage, fetchurl , makeWrapper, acl, rsync, gnutar, xz, btrfs-progs, gzip, dnsmasq, attr -, squashfsTools, iproute2, iptables, ebtables, iptables-nftables-compat, libcap +, squashfsTools, iproute2, iptables, libcap , dqlite, raft-canonical, sqlite-replication, udev , writeShellScriptBin, apparmor-profiles, apparmor-parser , criu , bash , installShellFiles -, nftablesSupport ? false , nixosTests }: -let - networkPkgs = if nftablesSupport then - [ iptables-nftables-compat ] - else - [ iptables ebtables ]; - -in buildGoPackage rec { pname = "lxd"; version = "4.18"; @@ -45,7 +37,7 @@ buildGoPackage rec { rm $out/bin/{deps,macaroon-identity,generate} wrapProgram $out/bin/lxd --prefix PATH : ${lib.makeBinPath ( - networkPkgs + [ iptables ] ++ [ acl rsync gnutar xz btrfs-progs gzip dnsmasq squashfsTools iproute2 bash criu attr ] ++ [ (writeShellScriptBin "apparmor_parser" '' exec '${apparmor-parser}/bin/apparmor_parser' -I '${apparmor-profiles}/etc/apparmor.d' "$@" From 4ee79312c13ab99fd6a893f66a79e4bfca09ae32 Mon Sep 17 00:00:00 2001 From: misuzu Date: Sun, 15 Mar 2020 17:06:25 +0200 Subject: [PATCH 06/10] shorewall: drop ipset for compatibility with iptables-nft --- pkgs/tools/networking/shorewall/default.nix | 6 ------ 1 file changed, 6 deletions(-) diff --git a/pkgs/tools/networking/shorewall/default.nix b/pkgs/tools/networking/shorewall/default.nix index f95fc9d92b18..0c9e515ce094 100644 --- a/pkgs/tools/networking/shorewall/default.nix +++ b/pkgs/tools/networking/shorewall/default.nix @@ -1,10 +1,8 @@ { coreutils -, ebtables , fetchurl , gnugrep , gnused , iproute2 -, ipset , iptables , perl , perlPackages @@ -17,8 +15,6 @@ let [ "${coreutils}/bin" "${iproute2}/bin" "${iptables}/bin" - "${ipset}/bin" - "${ebtables}/bin" "${util-linux}/bin" "${gnugrep}/bin" "${gnused}/bin" @@ -47,9 +43,7 @@ stdenv.mkDerivation rec { buildInputs = [ coreutils iproute2 - ipset iptables - ebtables util-linux gnugrep gnused From e0c2ed20c7a7f2b238cdf56e981f9a146fdf3792 Mon Sep 17 00:00:00 2001 From: misuzu Date: Sun, 15 Mar 2020 17:07:04 +0200 Subject: [PATCH 07/10] ferm: drop ipset for compatibility with iptables-nft --- pkgs/tools/networking/ferm/default.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pkgs/tools/networking/ferm/default.nix b/pkgs/tools/networking/ferm/default.nix index 29f9481fe328..580ca848c62b 100644 --- a/pkgs/tools/networking/ferm/default.nix +++ b/pkgs/tools/networking/ferm/default.nix @@ -1,4 +1,4 @@ -{ lib, stdenv, fetchurl, makeWrapper, perl, ebtables, ipset, iptables, nixosTests }: +{ lib, stdenv, fetchurl, makeWrapper, perl, iptables, nixosTests }: let inherit (lib.versions) majorMinor; @@ -23,7 +23,7 @@ in stdenv.mkDerivation rec { postInstall = '' rm -r $out/lib/systemd for i in "$out/sbin/"*; do - wrapProgram "$i" --prefix PATH : "${lib.makeBinPath [ iptables ipset ebtables ]}" + wrapProgram "$i" --prefix PATH : "${lib.makeBinPath [ iptables ]}" done ''; From 26461ee73b91f9ba7e16571fc83cb98910528fdb Mon Sep 17 00:00:00 2001 From: misuzu Date: Tue, 28 Apr 2020 13:33:27 +0300 Subject: [PATCH 08/10] firehol: drop ipset for compatibility with iptables-nft --- pkgs/applications/networking/firehol/default.nix | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkgs/applications/networking/firehol/default.nix b/pkgs/applications/networking/firehol/default.nix index 424c67721046..145fae2553a2 100644 --- a/pkgs/applications/networking/firehol/default.nix +++ b/pkgs/applications/networking/firehol/default.nix @@ -1,5 +1,5 @@ { stdenv, lib, fetchFromGitHub, pkgs -, autoconf, automake, curl, iprange, iproute2, ipset, iptables, iputils +, autoconf, automake, curl, iprange, iproute2, iptables, iputils , kmod, nettools, procps, tcpdump, traceroute, util-linux, whois # If true, just install FireQOS without FireHOL @@ -35,13 +35,14 @@ stdenv.mkDerivation rec { nativeBuildInputs = [ autoconf automake ]; buildInputs = [ - curl iprange iproute2 ipset iptables iputils kmod + curl iprange iproute2 iptables iputils kmod nettools procps tcpdump traceroute util-linux whois ]; preConfigure = "./autogen.sh"; configureFlags = [ "--localstatedir=/var" - "--disable-doc" "--disable-man" ] ++ + "--disable-doc" "--disable-man" + "--disable-update-ipsets" ] ++ lib.optional onlyQOS [ "--disable-firehol" ]; meta = with lib; { From f8235a59817c2d7107145e3caf6b2c1900728e6a Mon Sep 17 00:00:00 2001 From: misuzu Date: Tue, 22 Sep 2020 13:50:53 +0300 Subject: [PATCH 09/10] k3s: drop ipset for compatibility with iptables-nft --- pkgs/applications/networking/cluster/k3s/default.nix | 2 -- 1 file changed, 2 deletions(-) diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix index 445483c1ecde..fa077fbbcdaf 100644 --- a/pkgs/applications/networking/cluster/k3s/default.nix +++ b/pkgs/applications/networking/cluster/k3s/default.nix @@ -13,7 +13,6 @@ , pkg-config , ethtool , util-linux -, ipset , fetchFromGitHub , fetchurl , fetchzip @@ -254,7 +253,6 @@ stdenv.mkDerivation rec { bridge-utils ethtool util-linux # kubelet wants 'nsenter' from util-linux: https://github.com/kubernetes/kubernetes/issues/26093#issuecomment-705994388 - ipset conntrack-tools ]; From f898fde5860cf7b61519fbde0c8152ea888ed491 Mon Sep 17 00:00:00 2001 From: misuzu Date: Tue, 28 Apr 2020 16:36:13 +0300 Subject: [PATCH 10/10] docs/release-notes: mention iptables switch --- .../from_md/release-notes/rl-2111.section.xml | 14 ++++++++++++++ nixos/doc/manual/release-notes/rl-2111.section.md | 4 ++++ 2 files changed, 18 insertions(+) diff --git a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml index 8af8f1dd6437..ba07b60cf684 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2111.section.xml @@ -15,6 +15,12 @@
Highlights + + + iptables now uses + nf_tables backend. + + PHP now defaults to PHP 8.0, updated from 7.4. @@ -328,6 +334,14 @@ nobody/nogroup, which is unsafe. + + + Since iptables now uses + nf_tables backend and + ipset doesn’t support it, some applications + (ferm, shorewall, firehol) may have limited functionality. + + The paperless module and package have been diff --git a/nixos/doc/manual/release-notes/rl-2111.section.md b/nixos/doc/manual/release-notes/rl-2111.section.md index f22a532972be..4f153632b73c 100644 --- a/nixos/doc/manual/release-notes/rl-2111.section.md +++ b/nixos/doc/manual/release-notes/rl-2111.section.md @@ -6,6 +6,8 @@ In addition to numerous new and upgraded packages, this release has the followin ## Highlights {#sec-release-21.11-highlights} +- `iptables` now uses `nf_tables` backend. + - PHP now defaults to PHP 8.0, updated from 7.4. - kOps now defaults to 1.21.1, which uses containerd as the default runtime. @@ -103,6 +105,8 @@ In addition to numerous new and upgraded packages, this release has the followin - The `security.wrappers` option now requires to always specify an owner, group and whether the setuid/setgid bit should be set. This is motivated by the fact that before NixOS 21.11, specifying either setuid or setgid but not owner/group resulted in wrappers owned by nobody/nogroup, which is unsafe. +- Since `iptables` now uses `nf_tables` backend and `ipset` doesn't support it, some applications (ferm, shorewall, firehol) may have limited functionality. + - The `paperless` module and package have been removed. All users should migrate to the successor `paperless-ng` instead. The Paperless project [has been archived](https://github.com/the-paperless-project/paperless/commit/9b0063c9731f7c5f65b1852cb8caff97f5e40ba4)