firewall-util: drop FirewallContext

After iptables support is dropped, FirewallContext is a trivial
wrapper of sd_netlink. Let's drop it and directly use sd_netlink.

src/network/networkd-address.c

@@ -669,6 +669,10 @@ static int address_set_masquerade(Address *address, bool add) {
 
         assert(address);
         assert(address->link);
+        assert(address->link->manager);
+
+        if (!address->link->manager->nfnl)
+                return 0;
 
         if (!address->link->network)
                 return 0;
@@ -687,7 +691,7 @@ static int address_set_masquerade(Address *address, bool add) {
         if (r < 0)
                 return r;
 
-        r = fw_add_masquerade(&address->link->manager->fw_ctx, add, address->family, &masked, address->prefixlen);
+        r = fw_nftables_add_masquerade(address->link->manager->nfnl, add, address->family, &masked, address->prefixlen);
         if (r < 0)
                 return r;
 
@@ -702,14 +706,9 @@ static void address_modify_nft_set_context(Address *address, bool add, NFTSetCon
         assert(address);
         assert(address->link);
         assert(address->link->manager);
+        assert(address->link->manager->nfnl);
         assert(nft_set_context);
 
-        if (!address->link->manager->fw_ctx) {
-                r = fw_ctx_new_full(&address->link->manager->fw_ctx, /* init_tables= */ false);
-                if (r < 0)
-                        return;
-        }
-
         FOREACH_ARRAY(nft_set, nft_set_context->sets, nft_set_context->n_sets) {
                 uint32_t ifindex;
 
@@ -717,16 +716,16 @@ static void address_modify_nft_set_context(Address *address, bool add, NFTSetCon
 
                 switch (nft_set->source) {
                 case NFT_SET_SOURCE_ADDRESS:
-                        r = nft_set_element_modify_ip(address->link->manager->fw_ctx, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
+                        r = nft_set_element_modify_ip(address->link->manager->nfnl, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
                                                       &address->in_addr);
                         break;
                 case NFT_SET_SOURCE_PREFIX:
-                        r = nft_set_element_modify_iprange(address->link->manager->fw_ctx, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
+                        r = nft_set_element_modify_iprange(address->link->manager->nfnl, add, nft_set->nfproto, address->family, nft_set->table, nft_set->set,
                                                            &address->in_addr, address->prefixlen);
                         break;
                 case NFT_SET_SOURCE_IFINDEX:
                         ifindex = address->link->ifindex;
-                        r = nft_set_element_modify_any(address->link->manager->fw_ctx, add, nft_set->nfproto, nft_set->table, nft_set->set,
+                        r = nft_set_element_modify_any(address->link->manager->nfnl, add, nft_set->nfproto, nft_set->table, nft_set->set,
                                                        &ifindex, sizeof(ifindex));
                         break;
                 default:
@@ -749,6 +748,10 @@ static void address_modify_nft_set_context(Address *address, bool add, NFTSetCon
 static void address_modify_nft_set(Address *address, bool add) {
         assert(address);
         assert(address->link);
+        assert(address->link->manager);
+
+        if (!address->link->manager->nfnl)
+                return;
 
         if (!IN_SET(address->family, AF_INET, AF_INET6))
                 return;

src/network/networkd-manager.c

@@ -23,9 +23,9 @@
 #include "env-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
-#include "firewall-util.h"
 #include "initrd-util.h"
 #include "mount-util.h"
+#include "netlink-internal.h"
 #include "netlink-util.h"
 #include "networkd-address.h"
 #include "networkd-address-label.h"
@@ -285,6 +285,28 @@ static int manager_connect_genl(Manager *m) {
         return 0;
 }
 
+static int manager_connect_nfnl(Manager *m) {
+        int r;
+
+        assert(m);
+
+        r = sd_nfnl_socket_open(&m->nfnl);
+        if (r < 0) {
+                log_warning_errno(r, "Failed to open nftables netlink socket. IPMasquerade= and NFTSet= settings will not be applied. Ignoring: %m");
+                return 0;
+        }
+
+        r = sd_netlink_increase_rxbuf(m->nfnl, RCVBUF_SIZE);
+        if (r < 0)
+                log_warning_errno(r, "Failed to increase receive buffer size for nftables netlink socket, ignoring: %m");
+
+        r = sd_netlink_attach_event(m->nfnl, m->event, 0);
+        if (r < 0)
+                return r;
+
+        return 0;
+}
+
 static int manager_setup_rtnl_filter(Manager *manager) {
         struct sock_filter filter[] = {
                 /* Check the packet length. */
@@ -435,7 +457,7 @@ static int manager_post_handler(sd_event_source *s, void *userdata) {
 
                 if (netlink_get_reply_callback_count(manager->rtnl) > 0 ||
                     netlink_get_reply_callback_count(manager->genl) > 0 ||
-                    fw_ctx_get_reply_callback_count(manager->fw_ctx) > 0)
+                    netlink_get_reply_callback_count(manager->nfnl) > 0)
                         return 0; /* There are some message calls waiting for their replies. */
 
                 (void) manager_serialize(manager);
@@ -557,6 +579,10 @@ int manager_setup(Manager *m) {
         if (r < 0)
                 return r;
 
+        r = manager_connect_nfnl(m);
+        if (r < 0)
+                return r;
+
         if (m->test_mode)
                 return 0;
 
@@ -696,6 +722,7 @@ Manager* manager_free(Manager *m) {
 
         sd_netlink_unref(m->rtnl);
         sd_netlink_unref(m->genl);
+        sd_netlink_unref(m->nfnl);
         sd_resolve_unref(m->resolve);
 
         m->routes = set_free(m->routes);
@@ -720,8 +747,6 @@ Manager* manager_free(Manager *m) {
         safe_close(m->ethtool_fd);
         safe_close(m->persistent_storage_fd);
 
-        m->fw_ctx = fw_ctx_free(m->fw_ctx);
-
         m->serialization_fd = safe_close(m->serialization_fd);
 
         return mfree(m);

src/network/networkd-manager.h

@@ -17,6 +17,7 @@ typedef struct Manager {
         sd_netlink *rtnl;
         /* lazy initialized */
         sd_netlink *genl;
+        sd_netlink *nfnl;
         sd_event *event;
         sd_resolve *resolve;
         sd_bus *bus;
@@ -103,8 +104,6 @@ typedef struct Manager {
         usec_t speed_meter_usec_new;
         usec_t speed_meter_usec_old;
 
-        FirewallContext *fw_ctx;
-
         bool request_queued;
         OrderedSet *request_queue;
         OrderedSet *remove_request_queue;

src/network/networkd-queue.c

@@ -293,7 +293,7 @@ int manager_process_requests(Manager *manager) {
                  * queued, then this event may make reply callback queue in sd-netlink full. */
                 if (netlink_get_reply_callback_count(manager->rtnl) >= REPLY_CALLBACK_COUNT_THRESHOLD ||
                     netlink_get_reply_callback_count(manager->genl) >= REPLY_CALLBACK_COUNT_THRESHOLD ||
-                    fw_ctx_get_reply_callback_count(manager->fw_ctx) >= REPLY_CALLBACK_COUNT_THRESHOLD)
+                    netlink_get_reply_callback_count(manager->nfnl) >= REPLY_CALLBACK_COUNT_THRESHOLD)
                         break;
 
                 /* Avoid the request and link freed by req->process() and request_detach(). */