[PATCH v4 04/10] vm/sys/net: integrate xdp-forwarder

Yureka Lilian
2025-11-29T19:47:13Z

Signed-off-by: Yureka Lilian <yureka@cyberchaos.dev>
Reviewed-by: Alyssa Ross <hi@alyssa.is>
---
.../etc/s6-rc/mdevd/dependencies.d/nftables | 0
vm/sys/net/default.nix | 11 ++++++--
vm/sys/net/image/etc/fstab | 2 ++
vm/sys/net/image/etc/mdev/iface | 28 ++++++-------------
vm/sys/net/image/etc/nftables.conf | 16 ++++++++---
5 files changed, 31 insertions(+), 26 deletions(-)
create mode 100644 img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables

diff --git a/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables b/img/app/image/etc/s6-rc/mdevd/dependencies.d/nftables
new file mode 100644
index 0000000..e69de29
diff --git a/vm/sys/net/default.nix b/vm/sys/net/default.nix
index ae7fdc5..f4e51dd 100644
--- a/vm/sys/net/default.nix
+++ b/vm/sys/net/default.nix
@@ -8,7 +8,7 @@ pkgsMusl.callPackage (
{ lib, stdenvNoCC, nixos, runCommand, writeClosure
, erofs-utils, jq, s6-rc, util-linux, xorg
, busybox, dbus, execline, kmod, linux_latest, mdevd, nftables
-, s6, s6-linux-init
+, s6, s6-linux-init, xdp-tools, spectrum-driver-tools
}:

let
@@ -52,7 +52,7 @@ let
});

packages = [
- dbus execline kmod mdevd s6 s6-linux-init s6-rc
+ dbus execline kmod mdevd s6 s6-linux-init s6-rc xdp-tools

(busybox.override {
extraConfig = ''
@@ -71,7 +71,12 @@ let

# Packages that should be fully linked into /usr,
# (not just their bin/* files).
- usrPackages = [ dbus firmware kernel.modules terminfo ];
+ usrPackages = [
+ dbus firmware kernel.modules terminfo
+
+ # for xdp-forwarder
+ spectrum-driver-tools
+ ];

packagesSysroot = runCommand "packages-sysroot" {
inherit packages;
diff --git a/vm/sys/net/image/etc/fstab b/vm/sys/net/image/etc/fstab
index 5dc9b2a..a0b62fa 100644
--- a/vm/sys/net/image/etc/fstab
+++ b/vm/sys/net/image/etc/fstab
@@ -1,6 +1,8 @@
# SPDX-License-Identifier: CC0-1.0
# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>
proc /proc proc defaults 0 0
devpts /dev/pts devpts gid=5,mode=620 0 0
tmpfs /dev/shm tmpfs defaults 0 0
sysfs /sys sysfs defaults 0 0
+bpffs /sys/fs/bpf bpf defaults 0 0
diff --git a/vm/sys/net/image/etc/mdev/iface b/vm/sys/net/image/etc/mdev/iface
index 2306575..da45ce9 100755
--- a/vm/sys/net/image/etc/mdev/iface
+++ b/vm/sys/net/image/etc/mdev/iface
@@ -1,36 +1,26 @@
#!/bin/execlineb -P
# SPDX-License-Identifier: EUPL-1.2+
# SPDX-FileCopyrightText: 2020-2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>

importas -Si INTERFACE

ifte

{
- # This interface is connected to another VM.
-
- # The other VM's IP is encoded in the NIC-specific portion of the
- # interface's MAC address.
- backtick -E CLIENT_IP {
- awk -F: "{printf \"100.64.%d.%d\\n\", \"0x\" $5, \"0x\" $6}"
- /sys/class/net/${INTERFACE}/address
- }
-
- if { ip address add 169.254.0.1/32 dev $INTERFACE }
- if { ip link set $INTERFACE up }
- ip route add $CLIENT_IP dev $INTERFACE
+ # This interface is connected to the router
+ if { xdp-loader load $INTERFACE /usr/lib/xdp/prog_router.o -m skb -p /sys/fs/bpf }
+ if { ip link set $INTERFACE promisc on }
+ if { set-router-iface $INTERFACE }
+ ip link set $INTERFACE up
}

{
if { test $INTERFACE != lo }
# This is a physical connection to a network device.
- background { s6-rc -bu change connman }
- if { s6-rc -bu change nftables }
- if {
- forx -pE module { nft_counter nft_masq }
- modprobe $module
- }
- nft add rule ip nat postrouting oifname $INTERFACE counter masquerade
+ if { xdp-loader load $INTERFACE /usr/lib/xdp/prog_physical.o -m skb -p /sys/fs/bpf }
+ if { ip link set $INTERFACE promisc on }
+ ip link set $INTERFACE up
}

grep -iq ^02:01: /sys/class/net/${INTERFACE}/address
diff --git a/vm/sys/net/image/etc/nftables.conf b/vm/sys/net/image/etc/nftables.conf
index 296d92c..cc8e462 100644
--- a/vm/sys/net/image/etc/nftables.conf
+++ b/vm/sys/net/image/etc/nftables.conf
@@ -1,8 +1,16 @@
# SPDX-License-Identifier: EUPL-1.2+
-# SPDX-FileCopyrightText: 2021 Alyssa Ross <hi@alyssa.is>
+# SPDX-FileCopyrightText: 2025 Yureka Lilian <yureka@cyberchaos.dev>

-table nat {
- chain postrouting {
- type nat hook postrouting priority 100;
+table driver-fw {
+ chain input {
+ type filter hook input priority filter; policy drop;
+ }
+
+ chain output {
+ type filter hook output priority filter; policy drop;
+ }
+
+ chain forward {
+ type filter hook forward priority filter; policy drop;
}
}
--
2.51.2