The release of the nftables packet filter 1.1.6 has been published, unifying the filtering interfaces for IPv4, IPv6, ARP, and network bridges (aiming to replace iptables, ip6tables, arptables, and ebtables). Simultaneously, the release of the accompanying libnftnl 1.3.1 library has been published, providing a low-level API for interaction with the nf_tables subsystem.
The nftables package includes user-space packet filter components, while the nf_tables subsystem, which is part of the Linux kernel since version 3.13, handles operations at the kernel level. At the kernel level, only a general interface is provided, which is independent of specific protocols and offers basic functions for extracting data from packets, performing data operations, and managing the flow.
The filtering rules themselves and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special environment resembling BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and offloads all functions related to rule parsing and protocol logic into user space. virtual machineFull support for lightweight tunnel templates, such as vxlan, geneve, and erspan, has been provided: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : "t1", 10.141.10.13 : "t2" } fwd to erspan1 } } Before loading the rules, a network interface erspan1 must be created: ip link add dev erspan1 type erspan external
Key Changes:
- Full support for lightweight tunnel templates such as vxlan, geneve, and erspan is ensured: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : "t1", 10.141.10.13 : "t2" } fwd to erspan1 } } Before loading the rules, the network interface erspan1 must be created: ip link add dev erspan1 type erspan external
- Support for masks in network interface names has been added in netdev handlers. For example, to add a base chain to filter incoming traffic for all VLAN devices, you can specify: table netdev t { chain c { type filter hook ingress devices = { "vlan*", "veth0" } priority filter; policy accept; } }
- On systems with Linux kernel 6.18+, support for passing L2 frames to network bridge interfaces for local processing has been implemented. For example, to direct all Ethernet frames for the MAC address de:ad:00:00:be:ef to the IP stack, you can specify: table bridge global { chain pre { type filter hook prerouting priority 0; policy accept; ether daddr de:ad:00:00:be:ef meta pkttype set host ether daddr set meta ibrhwaddr accept } }
- A new infrastructure for fuzz testing using the afl++ (american fuzzy lop++) toolkit has been added, enabled at the build stage via ".\/configure —with-fuzzer".
Source: opennet.ru
