Release of the nftables 0.9.3 packet filter.

Published release of the packet filter nftables 0.9.3, evolving as a replacement for iptables, ip6tables, arptables, and ebtables through the unification of packet filtering interfaces for IPv4, IPv6, ARP, and network bridges. The nftables package includes components of the packet filter that operate in user space, while the kernel-level functionality is provided by the nf_tables subsystem, which has been part of the Linux kernel since version 3.13. Essential changes required for nftables 0.9.3 are included in the upcoming Linux kernel 5.5 branch.

At the kernel level, only a general interface is provided that is independent of any particular protocol and offers basic functions for extracting data from packets, performing operations on the data, and managing flows. The filtering logic and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in a special virtual machine similar to BPF (Berkeley Packet Filters). This approach significantly reduces the amount of filtering code running at the kernel level and moves all parsing rules and protocol handling logic into user space.

Key innovations:

• Support for time-based packet matching. It is possible to define ranges of times and dates when a rule will trigger, as well as configure triggers for specific days of the week. A new option "-T" has also been added to output epoch time in seconds.

  meta time "2019-12-24 16:00" — "2020-01-02 7:00"
  meta hour "17:00" — "19:00"
  meta day "Fri"

• Support for restoring and saving SELinux labels (secmark).

  ct secmark set meta secmark
  meta secmark set ct secmark

• Support for map-list synproxy, allowing the definition of more than one rule per backend.

  table ip foo {
  synproxy https-synproxy {
  mss 1460
  wscale 7
  timestamp sack-perm
  }

  synproxy other-synproxy {
  mss 1460
  wscale 5
  }

  chain pre {
  type filter hook prerouting priority raw; policy accept;
  tcp dport 8888 tcp flags syn notrack
  }

  chain bar {
  type filter hook forward priority filter; policy accept;
  ct state invalid,untracked synproxy name ip saddr map { 192.168.1.0/24 : "https-synproxy", 192.168.2.0/24 : "other-synproxy" }
  }
  }

• Ability to dynamically remove elements from set-based rules for packet processing.

  nft add rule … delete @set5 { ip6 saddr . ip6 daddr }

• Support for VLAN matching by identifier and protocol, defined in network bridge interface metadata;

  meta ibrpvid 100
  meta ibrvproto vlan

• The option "-t" ("—terse") to exclude elements from set lists when displaying rules. Executing "nft -t list ruleset" will output:

  table ip x {
  set y {
  type ipv4_addr
  }
  }

  And with "nft list ruleset"

  table ip x {
  set y {
  type ipv4_addr
  elements = { 192.168.10.2, 192.168.20.1,
  192.168.4.4, 192.168.2.34 }
  }
  }

• Ability to specify more than one device in netdev chains (works only with kernel 5.5) for the aggregation of standard filtering rules.

  add table netdev x
  add chain netdev x y { \
  type filter hook ingress devices = { eth0, eth1 } priority 0;
  }

• Ability to add descriptions for data types.

  # nft describe ipv4_addr
  datatype ipv4_addr (IPv4 address) (basetype integer), 32 bits

• Ability to build a CLI interface with the linenoise library instead of libreadline.

  ./configure —with-cli=linenoise

Source: opennet.ru