nixos-firewall-tool: add nftables support

[nbdd0121]

Description of changes

Add nftables support in nixos-firewall-tool and install it by default when NixOS firewall is enabled.

Also add some tests for nixos-firewall-tool in nixosTests.firewall.

This is the continuation of work of #275126 by @duament. I removed the dependency on #275371 (although I think it's still a good refactor to have, but it doesn't have to block this PR).

All the temporary port openings are added to the temp-ports nft set, so that resetting to default would only require flushing this set. This avoids disrupting tables and sets that are maintained by other services.

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.11 Release Notes (or backporting 23.11 and 24.05 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[nbdd0121]

I wonder if the nixos-firewall-tool should just be a single script that handles both iptables and nftables. I was thinking of checking /etc/systemd/system/nftables.service for existence to tell which one is in use.

What do you think? @clerie

[clerie]

Hi @nbdd0121, thank you for the effort putting some work into this. Without looking at the details (as in doing a full review), I think that is something we should merge to get some traction into this topic.

Because nobody found a robust solution for deciding between nf- and iptables in the mean time, I think yielding two different packages based on system config is acceptable for now. If someone finds a proper solution we can still change that later.

[SuperSandro2000]

This can be combined into one echo with mutliline strings. Also echo already prints an empty line.

[nbdd0121]

This was copied verbatim from pkgs/by-name/ni/nixos-firewall-tool/nixos-firewall-tool.sh, and I've changed approach to detect for iptables/nftables support instead of having two separate files.

[nbdd0121]

Given that the firewall module have cfg.package added to the environment package. Maybe the runtimeInputs can be removed completely and rely on iptables/nft being in PATH?

[MarcelCoding]

Note: This implementation differs from the one with iptables. With iptables, all rules are being reset to the definitions done with nix. With nftables only temporarily opened ports are flushed.

I appreciate the nftables implementation more, as it respects dynamic rules done by other tools like Docker, but maybe this should be highlighted, or the subcommands for nftables should be renamed, and a notice added that reset only works with iptables and for nftables the unit should be restarted manually.
Alternatively, reset could be implemented for nftables with the same functionality, and the current implementation gets moved into another separate subcommand.

Although I am also fine with the implementation as it is right now.

[nbdd0121]

It's intentional, since otherwise it's very disruptive. It's especially so when you uses nft sets, everything added there will also be lost.

Arguably the same should be done for iptables by setting up a separate chain, but I don't have bandwidth for it now, I just want to get nftables functionality to work on par with iptables so more people can switch over.