{"id":76505,"date":"2020-04-02T19:42:00","date_gmt":"2020-04-02T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-0-9-4"},"modified":"2020-04-02T19:42:00","modified_gmt":"2020-04-02T17:42:00","slug":"vypusk-paketnogo-filtra-nftables-0-9-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","title":{"rendered":"Udgivelse af pakkefilter nftables 0.9.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=158575148505527&#038;w=2\">Publiceret<\/a><\/noindex> udgivelse af pakkefilter <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.4<\/a><\/noindex>, der udvikler sig som en erstatning for iptables, ip6tables, arptables og ebtables ved at forene gr\u00e6nsefladerne til pakkefiltrering for IPv4, IPv6, ARP og netv\u00e6rksbroer. Pakkens nftables indeholder komponenter til pakkefiltre, der arbejder i brugermilj\u00f8et, mens nf_tables under-systemet, der er en del af Linux-kernen siden version 3.13, s\u00f8rger for funktionaliteten p\u00e5 kerne-niveau. De n\u00f8dvendige \u00e6ndringer til nftables 0.9.4 er inkluderet i en kommende kernetr\u00e6. <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52632\">Linux 5.6<\/a><\/noindex>.<\/p>\n<p>P\u00e5 kerne-niveau tilbydes der kun en generel gr\u00e6nseflade, der ikke afh\u00e6nger af et specifikt protokol og tilbyder grundl\u00e6ggende funktioner til at udtr\u00e6kke data fra pakker, udf\u00f8re operationer med data og styre str\u00f8mmen. De faktiske filtreringsregler og protokolspecifikke h\u00e5ndterere kompileres til bytekode i brugermilj\u00f8et, hvorefter denne bytekode indl\u00e6ses i kernen via Netlink-gr\u00e6nsefladen og udf\u00f8res i kernen i en speciel virtuel maskine, der ligner BPF (Berkeley Packet Filters). Denne tilgang muligg\u00f8r en betydelig reduktion af den kode, der k\u00f8rer p\u00e5 kerne-niveau, og flytter alle funktioner til regelparsing og logikken vedr\u00f8rende protokoller ind i brugermilj\u00f8et.<\/p>\n<p>Hovednyhederne:\n<\/p>\n<ul>\n<li class=\"l\"> Support for ranges in concatenations (specific address and port combinations that simplify matching). For example, for the set 'whitelist', whose elements are concatenations, specifying the flag 'interval' will indicate that the set can include ranges in the concatenation (for the concatenation 'ipv4_addr . ipv4_addr . inet_service', it was previously possible to list specific matches like '192.168.10.35 . 192.68.11.123 . 80', but now it is possible to specify address groups '192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80'):\n<p>    tabel ip foo {<br \/>\n           s\u00e6t whitelist {<br \/>\n                   type ipv4_addr . ipv4_addr . inet_service<br \/>\n                   flag interval<br \/>\n                   elementer = { 192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80 }<br \/>\n           }<\/p>\n<p>           k\u00e6de bar {<br \/>\n                   type filter hook prerouting prioritet filter; politik drop;<br \/>\n                   ip saddr . ip daddr . tcp dport @whitelist accept<br \/>\n           }<br \/>\n    }<\/p>\n<li class=\"l\"> In sets and map lists, the ability to use the 'typeof' directive has been provided, which defines the format of the element during matching.<br \/>\n For eksempel:<\/p>\n<p>     tabel ip foo {<br \/>\n            s\u00e6t whitelist {<br \/>\n                    typeof ip saddr<br \/>\n                    elementer = { 192.168.10.35, 192.168.10.101, 192.168.10.135 }<br \/>\n            }<\/p>\n<p>            k\u00e6de bar {<br \/>\n                    type filter hook prerouting prioritet filter; politik drop;<br \/>\n                    ip daddr @whitelist accept<br \/>\n            }<br \/>\n     }<\/p>\n<p>     tabel ip foo {<br \/>\n            map addr2mark {<br \/>\n                typeof ip saddr : meta mark<br \/>\n                elementer = { 192.168.10.35 : 0x00000001, 192.168.10.135 : 0x00000002 }<br \/>\n            }<br \/>\n     }<\/p>\n<li class=\"l\"> Muligheden for at bruge tilslutninger i NAT-bindings er blevet tilf\u00f8jet, hvilket g\u00f8r det muligt at angive adresse og port, n\u00e5r man definerer NAT-transformationer baseret p\u00e5 map-lister eller navngivne s\u00e6t:\n<p>      nft add rule ip nat pre dnat ip addr . port to ip saddr map { 1.1.1.1 : 2.2.2.2 . 30 }<\/p>\n<p>      nft add map ip nat destinations { type ipv4_addr . inet_service : ipv4_addr . inet_service \\; }<br \/>\n      nft add rule ip nat pre dnat ip addr . port to ip saddr . tcp dport map @destinations<\/p>\n<li class=\"l\"> Support for hardware acceleration by offloading some filtering operations to the network card. Acceleration is enabled via the ethtool utility ('ethtool -K eth0 hw-tc-offload on'), after which it is activated in nftables for the main chain using the 'offload' flag. When using Linux kernel 5.6, hardware acceleration is supported for matching header fields and checking the incoming interface in conjunction with accepting, dropping, duplicating (dup), and forwarding (fwd) packets. In the example below, dropping packets coming from address 192.168.30.20 is performed at the network card level, without passing packets to the kernel:\n<p>     # cat file.nft<br \/>\n     table netdev x {<br \/>\n            chain y {<br \/>\n                type filter hook ingress device eth0 priority 10; flags offload;<br \/>\n                ip saddr 192.168.30.20 drop<br \/>\n            }<br \/>\n     }<br \/>\n     # nft -f file.nft<\/p>\n<li class=\"l\"> Forbedret information om fejlstedet i reglerne.\n<p>     # nft delete rule ip y z handle 7<br \/>\n     Error: Kunne ikke behandle regel: Ingen s\u00e5dan fil eller katalog<br \/>\n     delete rule ip y z handle 7<br \/>\n                    ^<\/p>\n<p>     # nft delete rule ip x x handle 7<br \/>\n     Error: Kunne ikke behandle regel: Ingen s\u00e5dan fil eller katalog<br \/>\n     delete rule ip x x handle 7<br \/>\n                               ^<\/p>\n<p>     # nft delete table twst<br \/>\n     Error: No such file or directory; did you mean table \u2018test\u2019 in family ip?<br \/>\n     delete table twst<br \/>\n                  ^^^^<\/p>\n<p>In the first example, it is shown that the table 'y' is missing from the system, in the second, that handler '7' is absent, and in the third, that a suggestion for a typo in the table name is displayed.<\/p>\n<li class=\"l\"> Support has been added for checking the slave interface by specifying 'meta sdif' or 'meta sdifname':\n<p>        \u2026 meta sdifname vrf1 \u2026<\/p>\n<li class=\"l\"> Underst\u00f8ttelse af skift-operation til h\u00f8jre eller venstre er blevet tilf\u00f8jet. For eksempel for at skifte en eksisterende pakke m\u00e6rke til venstre med 1 bit og s\u00e6tte den mindste bit til 1:\n<p>        \u2026 meta mark set meta mark lshift 1 or 0x1 \u2026<\/p>\n<li class=\"l\"> The option '-V' has been implemented to display extended version information.\n<p>     # nft -V<br \/>\n       nftables v0.9.4 (Jive at Five)<br \/>\n          cli: readline<br \/>\n          json: yes<br \/>\n          minigmp: no<br \/>\n          libxtables: yes<\/p>\n<li class=\"l\"> Command-line options must now be specified before commands. For example, you must specify 'nft -a list ruleset', while running 'nft list ruleset -a' will result in an error.\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Kilde: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52656\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-76505","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"da_DK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-02T17:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-02T17:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Udgivelsen af pakkefilteret nftables 0.9.4 | ProHoster","description":"Udgivet en version af pakkefilteret","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-02T17:42:00+00:00","article:modified_time":"2020-04-02T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76505","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:35:41","updated":"2022-10-07 02:56:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/76505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=76505"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/76505\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=76505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=76505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=76505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}