ateomnet: move the actor nftables table to the inet family - #1116
Draft
Yuan Gao (ygao-g) wants to merge 1 commit into
Draft
ateomnet: move the actor nftables table to the inet family#1116Yuan Gao (ygao-g) wants to merge 1 commit into
Yuan Gao (ygao-g) wants to merge 1 commit into
Conversation
This was referenced Aug 21, 2026
Draft
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
August 21, 2026 04:40
aab125d to
d7aab40
Compare
Benjamin Elder (BenTheElder)
added a commit
to BenTheElder/substrate
that referenced
this pull request
Aug 21, 2026
Both ateoms now build actor networking through internal/actornet, so ateomnet's version has had no caller outside its own package since the micro-VM ateom moved. This deletes it: SetupActorNetwork, NetworkConfig, CleanupActorNetwork, ConfigureActorVeth, the nftables install and remove, their expression helpers, and PodIPv4 and DumpNetInfo, which only those used. What stays is what actornet actually consumes -- the veth constants and addresses, MustParse*, EnableIPv4Forwarding, TCPProtocol, and the namespace helpers. Leaving it would not have been merely untidy. It creates a table named ateom_actor in the ip family, and actornet creates one under the same name for the actors that are really running; a table name is unique per family, so the two are invisible to each other's cleanup and either could delete or shadow the other's. That is latent while nothing calls the dead path, and stops being latent the moment anyone does. The table name moves to actornet with it, unexported, since actornet is now its only creator. The value is unchanged so an ateom rolling onto this code still recognises and clears the table its predecessor left behind. Two smaller leftovers of the same replacement: prepareOCIBundles no longer takes the ateom pod UID, because the namespace it writes into the bundle is keyed by actor now; and ateomnet's tests go with the code they covered, after porting the three that pin behaviour actornet still has -- repeatable setup, the fixed host-veth MAC, and the interior-link sweep. The last two are micro-VM requirements, so losing their coverage would have been a real gap rather than a bookkeeping one. NOTE: this collides with agent-substrate#1116, which moves the same table to the inet family, and with agent-substrate#1057 behind it. Both are dual-stack work on code this deletes. Whichever lands first, the other side is a delete-vs-modify conflict -- loud, and resolved by keeping the delete -- but the dual-stack change will need to be made in actornet instead. Worth settling before any of this becomes a real PR.
2 tasks
The actor's NAT and filter rules lived in an ip table, which can only ever carry IPv4. They are now in an inet table, so one table can hold both address families when the actor veth becomes dual-stack. Every IPv4 match opens with an NFPROTO comparison, because a bare payload match in an inet table would read an IPv4 offset out of an IPv6 header. IPv4 behaviour is unchanged, but the move is not a no-op on a dual-stack pod: inet nat chains register the nat hooks for both families, so IPv6 traffic in the worker pod netns is now conntracked, and the forward accept now covers IPv6. NAT in the inet family needs Linux 5.2 or later. Teardown sweeps ip as well as inet. A table name is unique per family, so the ip table an earlier ateom left behind is invisible to an inet-only cleanup: the dump comes back empty, the "already clean" path reports success, and the stale table keeps redirecting alongside the new one. Part of agent-substrate#246
Yuan Gao (ygao-g)
force-pushed
the
ateomnet-nft-inet
branch
from
August 21, 2026 20:03
d7aab40 to
b33d33a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part of #246.
The actor's NAT and filter rules live in an
iptable, which can only ever carry IPv4. This moves them to aninettable so one table can hold both address families once the actor veth is dual-stack. Every IPv4 match now opens with anNFPROTO_IPV4comparison, because a bare payload match in aninettable would read an IPv4 offset out of an IPv6 header. Teardown sweepsipas well asinet: a table name is unique per family, and the pod netns outlives an in-place container restart.IPv4 behaviour is unchanged, but this is not a no-op on a dual-stack pod.
inetnat chains register the nat hooks for both families, so IPv6 traffic in the worker pod netns is now conntracked — measured in a netns replica, where theiptable produced no IPv6 conntrack entries and theinettable does. The forward chain'sacceptnow covers IPv6 too; it is per-table, so it cannot override a drop from the CNI's own chains. NAT in theinetfamily needs Linux 5.2 or later, and the tests skip rather than fail below that.First of two: #1057 builds on this to give the actor an IPv6 address. This one has no dependency of its own.
Testing
TestActorNftablesRuleExprspins the rule expressions and needs no root, so it runs inmake test. Root-gated:TestSetupActorNetworkInstallsEgressRedirectchecks that aninetnat chain actually takes the redirect,TestRemoveActorNftablesRulesSweepsIPv4Familycovers theip→inetupgrade, andTestSetupActorNetworkIsRepeatableasserts the table is gone after each teardown.Three negative controls discriminate (Linux 6.17, under root): deleting the NFPROTO guard fails
TestActorNftablesRuleExprsandTestSetupActorNetworkInstallsEgressRedirectand nothing else, droppingipfrom the sweep fails onlyTestRemoveActorNftablesRulesSweepsIPv4Family, and skipping the redirect install fails onlyTestSetupActorNetworkInstallsEgressRedirect.🤖 Generated with Claude Code