From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from atuin.qyliss.net (localhost [IPv6:::1]) by atuin.qyliss.net (Postfix) with ESMTP id 8B8171F4EF; Sat, 29 Nov 2025 18:15:46 +0000 (UTC) Received: by atuin.qyliss.net (Postfix, from userid 993) id 2E1CF1F42A; Sat, 29 Nov 2025 18:15:34 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on atuin.qyliss.net X-Spam-Level: X-Spam-Status: No, score=-0.1 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,DMARC_PASS,RCVD_IN_DNSWL_NONE,SPF_HELO_NONE autolearn=unavailable autolearn_force=no version=4.0.1 Received: from mail.cyberchaos.dev (mail.cyberchaos.dev [195.39.247.168]) by atuin.qyliss.net (Postfix) with ESMTPS id D71891F41B for ; Sat, 29 Nov 2025 18:15:32 +0000 (UTC) From: Yureka Lilian DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cyberchaos.dev; s=mail; t=1764440131; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=o69ROb4CakroPeGpebPXd2xfyvM+QH3awtLa3HeGtM8=; b=2sCZfHyRTq9oxiqupca8Wk/oM8+CVGThPXOPD9qaaYZ++wYvPJ+4QKGfnuwl/G1df4dVcU e/4nTwUd6voJX9aQbC+SSA9vD2Pq1PGy56cPpxXQEzpaoiGPQztkAu67R5phClOV3Nm23M 5SbOj/Y9ZW4syrkSkilaY1vT5rmiCmI= To: devel@spectrum-os.org Subject: [PATCH v3 04/10] vm/sys/net: integrate xdp-forwarder Date: Sat, 29 Nov 2025 19:15:03 +0100 Message-ID: <20251129181514.20296-5-yureka@cyberchaos.dev> In-Reply-To: <20251129181514.20296-1-yureka@cyberchaos.dev> References: <20251129181514.20296-1-yureka@cyberchaos.dev> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Message-ID-Hash: T2ETY2IXTOU6I4DIHDP76IKGPFNY4HBM X-Message-ID-Hash: T2ETY2IXTOU6I4DIHDP76IKGPFNY4HBM X-MailFrom: yureka@cyberchaos.dev X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-devel.spectrum-os.org-0; header-match-devel.spectrum-os.org-1; header-match-devel.spectrum-os.org-2; header-match-devel.spectrum-os.org-3; header-match-devel.spectrum-os.org-4; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Yureka Lilian , Alyssa Ross X-Mailman-Version: 3.3.9 Precedence: list List-Id: Patches and low-level development discussion Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Signed-off-by: Yureka Lilian Reviewed-by: Alyssa Ross --- .../etc/s6-rc/mdevd/dependencies.d/nftables | 0 vm/sys/net/default.nix | 11 ++++++-- vm/sys/net/image/etc/fstab | 2 ++ vm/sys/net/image/etc/mdev/iface | 28 ++++++------------- vm/sys/net/image/etc/nftables.conf | 16 ++++++++--- 5 files changed, 31 insertions(+), 26 deletions(-) create mode 100644 img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables diff --git a/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables b/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables new file mode 100644 index 0000000..e69de29 diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix index ae7fdc5..f4e51dd 100644 --- a/vm/sys/net/default.nix +++ b/vm/sys/net/default.nix @@ -8,7 +8,7 @@ pkgsMusl.callPackage ( { lib, stdenvNoCC, nixos, runCommand, writeClosure , erofs-utils, jq, s6-rc, util-linux, xorg , busybox, dbus, execline, kmod, linux_latest, mdevd, nftables -, s6, s6-linux-init +, s6, s6-linux-init, xdp-tools, spectrum-driver-tools }: let @@ -52,7 +52,7 @@ let }); packages = [ - dbus execline kmod mdevd s6 s6-linux-init s6-rc + dbus execline kmod mdevd s6 s6-linux-init s6-rc xdp-tools (busybox.override { extraConfig = '' @@ -71,7 +71,12 @@ let # Packages that should be fully linked into /usr, # (not just their bin/* files). - usrPackages = [ dbus firmware kernel.modules terminfo ]; + usrPackages = [ + dbus firmware kernel.modules terminfo + + # for xdp-forwarder + spectrum-driver-tools + ]; packagesSysroot = runCommand "packages-sysroot" { inherit packages; diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab index 5dc9b2a..a0b62fa 100644 --- a/vm/sys/net/image/etc/fstab +++ b/vm/sys/net/image/etc/fstab @@ -1,6 +1,8 @@ # SPDX-License-Identifier: CC0-1.0 # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Yureka Lilian proc /proc proc defaults 0 0 devpts /dev/pts devpts gid=5,mode=620 0 0 tmpfs /dev/shm tmpfs defaults 0 0 sysfs /sys sysfs defaults 0 0 +bpffs /sys/fs/bpf bpf defaults 0 0 diff --git a/vm/sys/net/image/etc/mdev/iface b/vm/sys/net/image/etc/mdev/iface index 2306575..da45ce9 100755 --- a/vm/sys/net/image/etc/mdev/iface +++ b/vm/sys/net/image/etc/mdev/iface @@ -1,36 +1,26 @@ #!/bin/execlineb -P # SPDX-License-Identifier: EUPL-1.2+ # SPDX-FileCopyrightText: 2020-2021 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Yureka Lilian importas -Si INTERFACE ifte { - # This interface is connected to another VM. - - # The other VM's IP is encoded in the NIC-specific portion of the - # interface's MAC address. - backtick -E CLIENT_IP { - awk -F: "{printf \"100.64.%d.%d\\n\", \"0x\" $5, \"0x\" $6}" - /sys/class/net/${INTERFACE}/address - } - - if { ip address add 169.254.0.1/32 dev $INTERFACE } - if { ip link set $INTERFACE up } - ip route add $CLIENT_IP dev $INTERFACE + # This interface is connected to the router + if { xdp-loader load $INTERFACE /usr/lib/xdp/prog_router.o -m skb -p /sys/fs/bpf } + if { ip link set $INTERFACE promisc on } + if { set-router-iface $INTERFACE } + ip link set $INTERFACE up } { if { test $INTERFACE != lo } # This is a physical connection to a network device. - background { s6-rc -bu change connman } - if { s6-rc -bu change nftables } - if { - forx -pE module { nft_counter nft_masq } - modprobe $module - } - nft add rule ip nat postrouting oifname $INTERFACE counter masquerade + if { xdp-loader load $INTERFACE /usr/lib/xdp/prog_physical.o -m skb -p /sys/fs/bpf } + if { ip link set $INTERFACE promisc on } + ip link set $INTERFACE up } grep -iq ^02:01: /sys/class/net/${INTERFACE}/address diff --git a/vm/sys/net/image/etc/nftables.conf b/vm/sys/net/image/etc/nftables.conf index 296d92c..cc8e462 100644 --- a/vm/sys/net/image/etc/nftables.conf +++ b/vm/sys/net/image/etc/nftables.conf @@ -1,8 +1,16 @@ # SPDX-License-Identifier: EUPL-1.2+ -# SPDX-FileCopyrightText: 2021 Alyssa Ross +# SPDX-FileCopyrightText: 2025 Yureka Lilian -table nat { - chain postrouting { - type nat hook postrouting priority 100; +table driver-fw { + chain input { + type filter hook input priority filter; policy drop; + } + + chain output { + type filter hook output priority filter; policy drop; + } + + chain forward { + type filter hook forward priority filter; policy drop; } } -- 2.51.2