Category Archives: nftables

`PKG_CHECK_MODULES(LIBMNL, libmnl >= 1.0.0)’ error

If you are installing libnftnl and you have the following error message:

checking for a BSD-compatible install... /usr/bin/install -c
checking whether build environment is sane... yes
checking for a thread-safe mkdir -p... /bin/mkdir -p
checking for gawk... no
checking for mawk... mawk
checking whether make sets $(MAKE)... yes
checking for style of include used by make... GNU
checking how to create a pax tar archive... gnutar
checking dependency style of gcc... gcc3
checking whether make supports nested variables... yes
./configure: line 3960: syntax error near unexpected token `LIBMNL,'
./configure: line 3960: `PKG_CHECK_MODULES(LIBMNL, libmnl >= 1.0.0)'

The first step is to chek the version of libmnl is installed in your system:

$ whereis libmnl
libmnl: /usr/local/lib/ /usr/local/lib/

$ sudo ldd /usr/local/lib/ => (0x00007fffcf5fd000) => /lib/x86_64-linux-gnu/ (0x00007f0c2e14b000)
/lib64/ (0x00007f0c2e6f0000)

I fixed this problem instaling the pkg-config packages. pkg-config is a system for managing library compile and link flags that works with automake and autoconf.

sudo apt-get install pkg-config


Also, It is possible to need the following packages to install nft in your system:

git, make, gcc, bc, libncurses5-dev, autoconf, autotool, libtool, gawk, libjansson-dev, docb, dblatex flex, bison, libgmp-dev, libreadline6-dev

Amazing days in the 2014 Netfilter Workshop

It finished the 2014 Netfilter Workshop. It was amazing and very interesting for me. I’d been in Lyon before this was my first visit to Montpellier in France. This meeting was co-hosted by 15èmes Rencontres Mondiales du Logiciel Libre, the biggest event of free software in France with more than 300 conferences and workshops.

I arrived on Sunday 6th of July, one day before the workshop, and I visited some stands of Open source projects in the “Esplanade Charles-de-Gaulle” of the 15èmes Rencontres Mondiales du Logiciel Libre. There was a conference of Richard Stallman about the history of Free Software.

On monday, It was the Netfilter’s User day. There were a set of talks about DDoS protection using Netfilter/iptables, nft-sync, Nftables and IPS, Netfilter logging at the nftables age, Suricata IDS/IPS, Zorp and kzorp and Vuurmuur. In my opinion, the most important and interesting talk that day was “nftables: a new packet classification framework for Linux” by Pablo Neira, the maintainer of Netfilter project. Nftables is the new packet classification framework that intends to replace the existing {ip,ip6,arp,eb}_tables infrastructure. It’s the future. 🙂

Tuesday and Wednesday were the first days of the Netfilter’s developers days. They passed with interesting talks, an important debates and decision making about the Netfilter project, their projects and related technologies. Those days, we spoke about netfilter updates with a short summary on the Netfilter kernel changes since the last workshop, achievement unlocked, OVS MPLS, nftables quick hacking HOWTO, the switch-o-pocalypse, NIC’s and external switches, the challenge of 10Gbit/s wirespeed and the lessons learned from DPDK, qdisc updates and lockless FIFO, Open vSwitch with conntrack and Use of nftables from OVS. Moreover, there were time to speak about nftables project: “Nftables kernel” and “Nft from userspace” by Patrick McHardy and Pablo Neira, two of the most relevant developers of nftables project. At that time, They spoke and was a debate about what is done, what needs to be fixed/done and future things coming in nftables (in kernel space) and nft (user-space)

In the OPW, I’m working with nft, libnftln and nftables in the kernel space, so, It was the most interesting moment. I heard a very good explanation about these projects.

On Thursday, It was more talk and debates about ipset and ulogd2. Morever, It was the time for the students of Google Summer of Code and me. Arturo Borrero speak about his project nft-sync, a new userspace tool to distribute a nftables ruleset across the network. Alvaro Neira spoke about XML/JSON support for libnftnl and Giussepe Longo spoke about the compatibility layer in nft. Their talks were very good and very interesting. They were about their work around “Google Summer Of Code” period.

I spoke about one of my tasks during the OPW period: “nftables automated tests” I spoke about the motivation to do it, what is checking, options are available to run this test, the structure of the test file and the test folders. Also, I spoke about the future of the testing in nft and the next tasks to do. I was very nervous: It was my first talk in the Netfilter Workshop and in English language. It was an important challenge to me, I did it the best I could. 🙂

During these days, I talked with the developers and they gave me feedback on the importance of the test system and the expectation of the creation of this task. It hasn’t been any test system in nft tools yet.

They were amazing days. I learned a lot about development, network, linux, the kernel, hardware… and it was a landmark in Netfilter Workshop history: It was the first time that a girl are invited to this meeting and also she gave a talk.

Thanks to The Outreach Program for Women. They sponsored me the travel and the hotel during these days. Without their help, I wouldn’t have been to do it.

Here’s the group picture of the 10th Netfilter workshop which is held from July 7th to July 11th in Montpellier, France. By Eric Leblond
Netfilter workshop group picture 2014

Netfilter workshop group of 2014

Netfilter workshop group picture 2014

Netfilter workshop group picture

Here’s the group picture of the 10th Netfilter workshop which is held from July 7th to July 11th in Montpellier, France.

Thanks a lot to #rmll2014 for hosting us!

For left to right:
* First row: Daniel Borkmann, Pabloe Neira Ayuso, Simon Horman, Thomas Graf, Patrick Mchardy, Jozsef Kadlecsik, Martin Topholm
* Second row: +Ana Rey, Florian Westphal, +Eric Dumazet, Hannes Frederic Sowa, +Jesper Dangaard Brouer, Jesper Sander Lindgren, Jesse Gross, Balazs Scheidler, Holger Eitzenberger
* Third row: Alvaro Neira, Guiseppe Longo, Arturo Borrero, Victor Julien, Gert Hansen, Ulrich Weber, Chema Gonzalez, John Fastabend, Alexei Stavoroitov, Maciej Żenczykowski
* Photographer: +Eric Leblond” By Eric Leblond

nftables automated tests : My talk in the Netfilter Workshop

Today, I’ve done my first talk in English in The Netfilter Workshop: “The nftables system test”

Here, It’s the pdf file with my talk: nftables automated tests in pdf (Also from netfilter Workshop Wiki)

Netfilter workshop 2014

Today It starts the 10th Netfilter Workshop until 11th July, in Montpellier, France. This is my first event of the Netfilter project.

This meeting is co-hosted by 15èmes Rencontres Mondiales du Logiciel Libre the biggest event of free software in France.
Pingu of Netfilter

This meeting started yesterday with a big dinner and today is the first day of conferences.

nftables 0.3 and libnftnl 1.0.2 releases

Today, Netfilter project presents nftables 0.3 and libnftnl 1.0.2. It’s good news! Because these announces come with a lot of improvements.

This release of nftables contains bug fixes, syntax cleanups, new features, support for all new features contained in the recent 3.15 kernel release. [More informacion: [ANNOUNCE] nftables 0.3 release]

And this release of libnftnl, comes with new features available in 3.15, the event monitoring and fixes for the XML/JSON infrastructure. [More information: [ANNOUNCE] libnftnl 1.0.2 release].

These weeks, I’ve working hard to fix XML/JSON infraestructure. Now, 76 patches were accepted, but we keep working on it.

I began to fix a bug about incorrect print of unset values, and we end up doing some similar fixes through all library. It was a hard work, but It’ll allow us to improve the import/export feature in nft.

XML and JSON in nftables

libnftnl is an userspace library providing a low-level netlink programming interface (API) to the in-kernel nf_tables subsystem. The library libnftnl has been previously known as libnftables. This library is currently used by nftables.

To use libnftnl, We require the following software:

How to install the library:

./configure --with-xml-parsing --with-json-parsing
sudo make install
make check // To "generate" the tests and examples.

Also we use the library with nftables, We can do some task like run test and example.

Run the tests to check all change in this library:

sudo ./nft-parsing-test [options]
-d/--dir Check test files from .
-u/--update Update test files from .
-f/--file Check test file

Or we can run all test with the following script:


Others things we can do: