miniupnp.tuxfamily.org

[GurliGebis]

Hey,

Since nftables seems to moving along nicely, would it be an idea to start looking at integrating with it, along with iptables?

From what I can read, the API shouldn't be that difficult to use.

[miniupnp]

yes I'm thinking about it but have no time to do it... anybody motivated ?
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

[s1061123]

[s1061123]

[miniupnp]

it looks promising !
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

[s1061123]

Hi Folks,

Let me update current status on it.
Currently SNAT and DNAT are worked.

Currently my code is under github.
https://github.com/s1061123/miniupnp

To compile miniupnpd for nftables, just make with Makefiles.linux_nft instead of Makefile.linux.

Comments and some experiment reports are welcome!

Thanks,
Tomofumi

[s1061123]

[miniupnp]

make the pull request on github, I will look at it and merge if possible
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

[s1061123]

[miniupnp]

it has now been merged.
see http://miniupnp.free.fr/files/download.php?file=miniupnpd-1.9.20150430.tar.gz
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

[Paul.Chambers]

I'd be willing to put some effort into this, too.

I'm still learning nftables, and the approach miniupnpd currently takes to support it.

One thing I'm curious about is that the front end (UPnP IGD server) and backends (network rule manipulation on the machine itself) aren't quite as cleanly separated as my OCD tendencies would like. Perhaps something that evolved over time? nothing wrong with that, I'm just a little wary of muddying the waters further.

Is that something people agree could be improved? is there an appetite for refining the separation between frontend and backends?

The reason I ask is that I'd rather help converge the various derivatives than diverge one of them further. However, I'd hate to dig into that without some confidence that the resulting pull requests are going to be looked on favorably.

Your thoughts?

Best regards,

- Paul

[miniupnp]

I won't spend time on any reorganisation of the code before the nftables code really works.
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/

[miniupnp]

you should also consider that miniupnpd is designed to run on small home routers. So consuming more memory is a big deal.

that's also why I think we should first implement privilege dropping before full privilege separation
_________________
Main miniUPnP author.
https://miniupnp.tuxfamily.org/