The release of the nftables 1.0.1 packet filter has been published, which unifies packet filtering interfaces for IPv4, IPv6, ARP, and network bridges (aimed at replacing iptables, ip6tables, arptables, and ebtables). The necessary changes for the nftables 1.0.1 release are included in the Linux kernel 5.16-rc1.
The nftables package includes user-space packet filter components, while the nf_tables subsystem, which is part of the Linux kernel since version 3.13, handles operations at the kernel level. At the kernel level, only a general interface is provided, which is independent of specific protocols and offers basic functions for extracting data from packets, performing data operations, and managing the flow.
The filtering rules themselves and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special environment resembling BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and offloads all functions related to rule parsing and protocol logic into user space. virtual machineFull support for lightweight tunnel templates, such as vxlan, geneve, and erspan, has been provided: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : "t1", 10.141.10.13 : "t2" } fwd to erspan1 } } Before loading the rules, a network interface erspan1 must be created: ip link add dev erspan1 type erspan external
Key innovations:
- Reduced memory consumption when loading large set and map lists.
- Rebooting of set and map lists has been accelerated.
- Output of selected tables and chains in large rule sets has been sped up. For example, the execution time of the command 'nft list ruleset' for displaying a rule set with 100 thousand lines is 3.049 seconds, while displaying only the nat and filter tables ('nft list table nat', 'nft list table filter') reduces it to 1.969 and 0.697 seconds.
- Execution of queries with the '--terse' option when processing rules with large set and map lists has been accelerated.
- Filtering of traffic from the 'egress' chain is now allowed, processed at the same level as the egress handler in the netdev chain (egress hook), i.e., at the stage when the driver receives a packet from the kernel's networking stack. table netdev filter { chain egress { type filter hook egress devices = { eth0, eth1 } priority 0; meta priority set ip saddr map { 192.168.10.2 : abcd:2, 192.168.10.3 : abcd:3 } } }
- Matching and modifying bytes in the header and payload of a packet at a specified offset is now allowed. # nft add rule x y @ih,32,32 0x14000000 counter # nft add rule x y @ih,32,32 set 0x14000000 counter
Source: opennet.ru
