refactor(sandbox): replace iptables with nftables for network policy enforcement#1401
refactor(sandbox): replace iptables with nftables for network policy enforcement#1401russellb wants to merge 1 commit into
Conversation
russellb
requested review from
a team,
derekwaynecarr,
maxamillion and
mrunalp
as code owners
|
Label |
|
/ok to test 7ed0df7 |
johntmyers
left a comment
johntmyers
left a comment
There was a problem hiding this comment.
Code review feedback:
-
[P1]
crates/openshell-sandbox/Cargo.toml:85movestempfilefrom[dev-dependencies]into Linux-only dependencies, but many unconditional test modules still usetempfile, for examplecrates/openshell-sandbox/src/identity.rs:178. Non-Linux test builds will no longer resolvetempfile. Please keep the Linux runtime dependency for the new temp-file ruleset loader, but addtempfile = "3"back under[dev-dependencies]. -
[P1]
crates/openshell-driver-vm/src/nft_ruleset.rs:31installs standalone nftablesforwardandinputbase chains withacceptrules. That is not equivalent to appending accepts into the existing iptablesFORWARD/INPUTchains: anacceptverdict in one nftables base chain does not guarantee later base chains on the same hook/firewall policy will not still drop the packet. Hosts with default-drop firewall posture can lose VM guest connectivity to the gateway or outbound network. Please preserve the old allow behavior in the effective host filter path, or explicitly preflight/document the required host firewall posture.
Oops. I made this change on linux and didn't test the branch again after that on mac. That would have caught it. Easy fix, at least.
This one points out a fundamental difference in how rules are structured between nftables and iptables. I need to think about this one, but it definitely must be addressed before proceeding. |
…enforcement Migrate all sandbox and VM driver network policy enforcement from iptables to nftables. nftables provides atomic ruleset loading, a cleaner rule syntax, and is the standard netfilter interface in modern kernels. Sandbox bypass enforcement (openshell-sandbox): - Replace iptables chain of individual rule insertions with a single atomic nftables ruleset load via nft -f - New nft_ruleset module with pure functions for ruleset generation and unit tests - Combine log and reject rules in one inet family table (handles both IPv4 and IPv6 in a single ruleset) - Fall back to reject-only ruleset when kernel lacks nft_log support - Enable net.netfilter.nf_log_all_netns so log rules work from non-init network namespaces - Use temp file for nft ruleset loading instead of stdin for compatibility with minimal VM guest environments VM TAP networking (openshell-driver-vm): - Replace iptables NAT/forwarding rules with nftables equivalents - New nft_ruleset module for TAP network rule generation with unit tests - Atomic table-per-TAP-device lifecycle (create/destroy) - Host-side rules provide NAT infrastructure and defense-in-depth isolation (input chain restricts VM to gateway port only, forward chain blocks unsolicited inbound); primary security enforcement happens inside the VM guest via the sandbox supervisor's own rules VM init script: - Load nft kernel modules at sandbox init - Enable nf_log_all_netns sysctl for bypass detection logging OCSF / docs: - Update firewall rule engine references from iptables to nftables - Document host firewall interaction model and two-layer enforcement architecture in VM driver README and compute drivers reference Closes NVIDIA#1335 Signed-off-by: Russell Bryant <rbryant@redhat.com>
russellb
force-pushed
the
refactor/nftables-migration
branch
from
4acf125 to
158054f
Compare
Good catch on the iptables-vs-nftables semantic difference. Investigated this and landed on a defense-in-depth approach rather than trying to replicate the iptables accept-into-shared-chain behavior. What changed: The host-side VM driver rules serve two purposes: NAT infrastructure (required) and defense-in-depth host isolation (hardening). Primary security enforcement — proxy-only egress and bypass detection — is handled by the sandbox supervisor's own nftables rules inside the VM guest, in a network namespace. The host-side rules are not the security boundary. Given that, instead of trying to preserve the old iptables allow-passthrough semantics (which nftables can't exactly replicate across independent base chains), I added explicit drop rules at the end of the forward and input chains to make them whitelist-only:
The |
2 participants
Summary
Migrate all sandbox and VM driver network policy enforcement from iptables to nftables. nftables provides atomic ruleset loading, a cleaner rule syntax, and is the standard netfilter interface in modern kernels.
Closes #1335
Changes
Sandbox bypass enforcement (
openshell-sandbox):nft -fnft_rulesetmodule with pure functions for ruleset generation and unit testsinetfamily table (handles both IPv4 and IPv6 in a single ruleset)nft_logsupportnet.netfilter.nf_log_all_netnsso log rules work from non-init network namespacestempfilein both Linux-only runtime deps and[dev-dependencies]so non-Linux test builds resolve itVM TAP networking (
openshell-driver-vm):nft_rulesetmodule for TAP network rule generation with unit testsVM init script:
nftkernel modules at sandbox initnf_log_all_netnssysctl so bypass detection LOG rules work from non-init network namespaces inside the guestOCSF / docs:
iptablestonftablesdocs/security/best-practices.mdxand BYOC Dockerfile to referencenftdocs/reference/sandbox-compute-drivers.mdxTesting
mise run pre-commitpassesnft_rulesetmodules cover ruleset generation with and without log rulese2e/rust/tests/bypass_detection.rs) run successfully on Linux host withgateway:vmdriverChecklist