3

I'm looking to apply firewall rules on egress to control DHCP output from a Docker container. I don't want the DHCP container to share the host's network stack as adding CAP_NET_ADMIN effectively gives the container control of the network stack.

I notice here that an egress hook was added to netfilter in kernel 5.7 (uname -r says I have 5.10).

According to information in this commit, I have added the following table:

table netdev filterfinal_lan {
    chain egress {
        type filter hook egress device enp1s0 priority 0; policy accept;
    }
}

However when I attempt to apply the config it tells me it's not recognised:

/etc/nftables.conf:107:20-25: Error: unknown chain hook
                type filter hook egress device enp1s0 priority 0; policy accept;
                                 ^^^^^^

I'm unsure which version of nftables supports the egress hook, but my nft --version is nftables v0.9.8 (E.D.S.). Information on the egress hook seems quite elusive.

What is required to enable the use of this hook?

2
  • Does ingress rule as a test work? It might be missing kernel module. Add output of lsmod | sort to your post.
    – raspi
    Aug 6, 2022 at 8:33
  • lsmod | sort gives a very long output, but I know that the ingress rule works as I have it in the config too Aug 6, 2022 at 9:15

1 Answer 1

4

Actually nftables's egress hook was added in kernel 5.16, and improved support (fwd) in 5.17.

There were several attempts earlier, and one of them was NACK-ed at the same time it was initially committed, making it appear in Kernel Newbies for version 5.7, and apparently even nftables' wiki has it wrong by linking to Kernelnewbies for Linux 5.7 instead of Linux 5.16.

Here is a relevant mailing list link from March 2020 (around kernel 5.7):

Subject: Re: [PATCH 00/29] Netfilter updates for net-next
From: David Miller <davem () davemloft ! net>

From: Alexei Starovoitov <[email protected]>
Date: Tue, 17 Mar 2020 20:55:46 -1000

On Tue, Mar 17, 2020 at 2:42 PM Pablo Neira Ayuso [email protected] wrote:

  1. Add new egress hook, from Lukas Wunner.

NACKed-by: Alexei Starovoitov [email protected]

Sorry I just saw this after pushing this pull request back out.

Please someone deal with this via a revert or similar.

It was subsequently reverted in this commit: netfilter: revert introduction of egress hook. This revert might not have been posted in all relevant mailing lists, adding a bit to the confusion.


Fast forward almost two years. Issues and concerns (among them about interactions with tc/qdisc) having been addressed, egress was added again in kernel 5.16 (9 Jan 2022). Kernelnewbies for Linux 5.16 has this entry:

Netfilter

On Linux Kernel Driver Database:

CONFIG_NETFILTER_EGRESS: Netfilter egress support

[...]

  • found in Linux kernels: 5.16–5.19, 5.19+HEAD

Likewise, nftables userland support for egress was officially added only after kernel support was committed in nf-next (so a bit before 5.16 was out) and was made available in the nftables 1.0.1 release:

This release contains new features available up to the Linux kernel 5.16-rc1 release:

[...]

  • egress hook support (available since 5.16-rc1).

OP's ruleset is accepted on a kernel with relevant kernel option CONFIG_NETFILTER_EGRESS which has to be version >= 5.16 along nftables >= 1.0.1.

2
  • Thanks. Is upgrading one's kernel and nftables version risky if the system is used in a production (home router) environment? I'm concerned aswell about automatic updates and leaving behind more binaries (from having to compile) for an attacker to use should they gain access to the system. Aug 12, 2022 at 6:57
  • Some distributions sometimes provide packaged newer versions in alternate channels (eg Debian 11 provides newer kernels using bullseye-backports but currently doesn't provide newer nftables). I'd worry first about a nonfunctional result. You can compile elsewhere than on the router and install the result as package, but if it's about cross-compiling ok that's not the easiest (though using qemu to compile in an LXC container in an other arch is even a (slow) possibility). Anyway you never hinted what's the environment.
    – A.B
    Aug 12, 2022 at 7:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .