ateomnet: move the actor nftables table to the inet family - #26

Open

ygao-g wants to merge 1 commit into

base-1116-3b01db47from

ateomnet-nft-inet

ygao-g commented Sep 4, 2026 •

edited

Loading

Owner

Fork-local review artifact for the amended head of
agent-substrate#1116. The base branch is
pinned to main 3b01db4 so this PR shows exactly the one commit under review.

The single commit 0f965e1 (a message-only amend of 9da5460: same tree, the
commit message now ends in a concise Tested paragraph) carries all three
2026-09-04 self-review rounds: comments trimmed throughout with the family
rationale next to the inet pick, the masquerade helper inlined and its
expression subtest dropped, the nftables probe renamed skipWithoutInetNAT,
actorNftTableExists parameterized by family, and the sweep test table-driven
(ip-only, ip+inet, inet-only) renamed TestRemoveActorNftablesRules alongside
TestSetupActorNetworkEgressRedirect, and teardown split into a per-family
removeActorNftablesTable helper.

🤖 Generated with Claude Code

ygao-g commented

View reviewed changes

internal/ateomnet/net.go

ygao-g commented

View reviewed changes

internal/ateomnet/net.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/rules_linux_test.go Outdated

ygao-g force-pushed the ateomnet-nft-inet branch from 90b0a69 to 4eda01f Compare

September 4, 2026 17:56

ygao-g commented

View reviewed changes

internal/ateomnet/net.go

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go Outdated

ygao-g commented

View reviewed changes

internal/ateomnet/net_linux_test.go Outdated

ygao-g force-pushed the ateomnet-nft-inet branch 2 times, most recently from 4026b86 to 9da5460 Compare

September 4, 2026 23:19


          ateomnet: move the actor nftables table to the inet family

0f965e1

Move the actor's NAT and filter rules from a table of family ip to
one of family inet, so one table can hold both address families when
the actor veth becomes dual-stack.

Teardown sweeps tables of both ip and inet to handle the ip table an
earlier ateom left behind.

Tested: the kernel tests in net_linux_test.go, run as root on Linux,
prove the kernel accepts the redirect in an inet nat chain, repeated
setup/cleanup leaves no table behind, and teardown clears ip, inet,
or both.

ygao-g force-pushed the ateomnet-nft-inet branch from 9da5460 to 0f965e1 Compare

September 4, 2026 23:52

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet