Release of the nftables 1.1.0 packet filter

The release of the nftables 1.1.0 batch filter has been published, unifying packet filtering interfaces for IPv4, IPv6, ARP, and network bridges (aiming to replace iptables, ip6tables, arptables, and ebtables). The significant change in the version number is not due to any radical changes, but simply continues the numbering in decimal (the previous release was 1.0.9). At the same time, the accompanying library libnftnl 1.2.7 has been released, providing a low-level API for interaction with the nf_tables subsystem.

The nftables package includes user-space packet filter components, while the nf_tables subsystem, which is part of the Linux kernel since version 3.13, handles operations at the kernel level. At the kernel level, only a general interface is provided, which is independent of specific protocols and offers basic functions for extracting data from packets, performing data operations, and managing the flow.

The filtering rules themselves and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special environment resembling BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and offloads all functions related to rule parsing and protocol logic into user space. virtual machineFull support for lightweight tunnel templates, such as vxlan, geneve, and erspan, has been provided: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : "t1", 10.141.10.13 : "t2" } fwd to erspan1 } } Before loading the rules, a network interface erspan1 must be created: ip link add dev erspan1 type erspan external

Key Changes:

• Support for variables has been added in map expressions: define dst_map = { ::1234 : 5678 } table ip6 nat { map dst_map { typeof ip6 daddr : tcp dport; elements = $dst_map } chain prerouting { ip6 nexthdr tcp redirect to ip6 daddr map @dst_map } }
• VLAN support has been added: ip saddr 10.1.1.1 icmp type echo-request vlan id set 321 # payload ether type 8021ad vlan id 10 vlan type 8021q vlan id 100 vlan type ip accept
• A new string preprocessor with support for variables has been implemented for log expressions: define message="test" log prefix "my $message"
• When calculating the value of the expression "meta hour", processing of negative offsets in the time zone specified through the TZ environment variable has been realized: TZ=UTC-4 nft add rule x y meta hour "22:00"
• Byte order conversion has been ensured when using ct and meta expressions, as well as during merging operations and specifying ranges in set sets. map mapv6 { typeof ip6 dscp : meta mark; } meta mark set ip6 dscp map @map1 will generate the bytecode: [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = ( reg 1 & 0x0000c00f ) ^ 0x00000000 ] [ byteorder reg 1 = ntoh(reg 1, 2, 2) ] [ bitwise reg 1 = ( reg 1 > 0x00000006 ) ] [ lookup reg 1 set mapv6 dreg 1 ] [ meta set mark with reg 1 ]
• Support for the "replace rule" command has been resumed. replace rule ip t1 c1 handle 3 ‘jhash ip protocol . ip saddr mod 170 vmap { 0-94 : goto wan1, 95-169 : goto wan2, 170-269 }’
• The possibility of adding network devices to existing flowtables has been resumed: create flowtable inet filter f1 { hook ingress priority 0; counter } add flowtable inet filter f1 { devices = { dummy1 } ; }
• Issues with using the "create set" command have been resolved: define ip-block-4 = { 1.1.1.1 } create set netdev filter ip-block-4-test { type ipv4_addr flags interval auto-merge elements = $ip-block-4 }
• Issues with using the numeric representation of tcp options have been resolved: tcp option 254
• Issues with using meta and ct expressions with map sets have been resolved: meta mark set vlan id map { 1 : 0x00000001, 4095 : 0x00004095 }
• In payload and concat expressions, data sizes larger than 512 bytes are prohibited.
• When executing the 'nft describe' command, value tracking from the group, rt_mark, and rt_realms files located in the /etc/iproute2/ and /usr/share/iproute2/ directories has been implemented. # nft describe meta rtclassid meta expression, datatype realm (routing realm) (basetype integer), 32 bits pre-defined symbolic constants from /etc/iproute2/rt_realms (in decimal): cosmos 0 Reject statement with range meta mark set 0-100
• The operation of listing tables has been accelerated. Support for the -t/—terse option has been implemented to speed up the 'list table' and 'list set' commands.
• Conversion of meter expressions to dynamic sets has been ensured: add rule t c tcp dport 80 meter m size 128 { ip saddr timeout 2s limit rate 10/second } will be converted to set m { type ipv4_addr size 128 flags dynamic,timeout } tcp dport 80 update @m { ip saddr timeout 2s limit rate 10/second burst 5 packets }
• Support for synproxy objects and map sets with combined data has been added in the JSON format representation.
• In JSON format defined sets, support for the auto-merge flag has been implemented.
• When using the JSON format representation, it is allowed to specify multiple devices in the 'chain' block.
• When using the -f/—filename options, relative path processing from the current file's directory has been ensured.
• When using the -I/—include options, path iteration by default is now performed from the end of the list.
• The operation of the -o/—optimize options on expressions containing value counters has been fine-tuned: # nft -c -o -f ruleset.nft Merging: ruleset.nft:5:17-45: ct state invalid counter drop ruleset.nft:6:17-59: ct state established,related counter accept into: ct state vmap { invalid counter : drop, established counter : accept, related counter : accept } Merging: ruleset.nft:7:17-43: tcp dport 80 counter accept ruleset.nft:8:17-44: tcp dport 123 counter accept into: tcp dport { 80, 123 } counter accept Merging: ruleset.nft:9:17-64: ip saddr 1.1.1.1 ip daddr 2.2.2.2 counter accept ruleset.nft:10:17-62: ip saddr 1.1.1.2 ip daddr 3.3.3.3 counter drop into: ip saddr . ip daddr vmap { 1.1.1.1 . 2.2.2.2 counter : accept, 1.1.1.2 . 3.3.3.3 counter : drop }
• Compatibility with set element dumps created in nftables prior to version 0.9.8 has been restored.

Source: opennet.ru