search

tylertreat / comcast

Simulating shitty network connections so you can build better systems.
Apache License 2.0
10.29k stars 383 forks source link

nftables support on linux #52

Open hvenev opened 7 years ago

hvenev commented 7 years ago

It would be nice to use it instead as it's meant to replace *tables.

ghost commented 7 years ago

nftables has been around quite a long time, and it's always been slated as the "replacement" for iptables. I don't think there's any significant momentum in this regard.

That being said.. the adaptation of nftables to Comcast rule generation wouldn't be all that difficult.

Most of the heavy lifting is done with TC. TC still exists with an nftables system. We'd only have to replace the functionality to bind the filter rules to the queue set up by TC. Really, the only thing iptables does is classify the packet in postrouting to target it at the TC class.

There's some way to do that in nftables, we'd just need to figure out that command and template it and add it as an option (similar to how we switch between iptables and ip6tablkes).

q2dg commented 1 year ago

Well, nowadays resolving this issue is mandatory