Release of the nftables 0.9.4 packet filter

Published release of the packet filter nftables 0.9.4, developing as a replacement for iptables, ip6tables, arptables, and ebtables through the unification of packet filtering interfaces for IPv4, IPv6, ARP, and network bridges. The nftables package includes user-space packet filter components, while at the kernel level, the nf_tables subsystem, which has been part of the Linux kernel since version 3.13, provides the necessary functionalities for nftables 0.9.4. The changes required for the release of nftables 0.9.4 are included in the upcoming kernel branch. Linux 5.6.

At the kernel level, only a generic interface is provided that is independent of specific protocols and offers basic functions for extracting data from packets, performing operations on data, and managing flow. The filtering rules and protocol-specific handlers are compiled into bytecode in user space, which is then loaded into the kernel via the Netlink interface and executed in a special virtual machine reminiscent of BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and moves all rule parsing and protocol handling logic to user space.

Key innovations:

• Support for ranges in concatenations (specific bindings of addresses and ports that simplify matching). For example, for a 'whitelist' set, whose elements are concatenations, specifying the 'interval' flag will indicate that the set can include ranges in the concatenation (for the concatenation 'ipv4_addr . ipv4_addr . inet_service', previously exact matches like '192.168.10.35 . 192.68.11.123 . 80' could be listed, but now address groups like '192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80' can be specified):

  table ip foo {
  set whitelist {
  type ipv4_addr . ipv4_addr . inet_service
  flags interval
  elements = { 192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80 }
  }

  chain bar {
  type filter hook prerouting priority filter; policy drop;
  ip saddr . ip daddr . tcp dport @whitelist accept
  }
  }

• In sets and map lists, the ability to use the 'typeof' directive is provided to define the format of the element during matching.
  For example:

  table ip foo {
  set whitelist {
  typeof ip saddr
  elements = { 192.168.10.35, 192.168.10.101, 192.168.10.135 }
  }

  chain bar {
  type filter hook prerouting priority filter; policy drop;
  ip daddr @whitelist accept
  }
  }

  table ip foo {
  map addr2mark {
  typeof ip saddr : meta mark
  elements = { 192.168.10.35 : 0x00000001, 192.168.10.135 : 0x00000002 }
  }
  }

• The ability to use connections in NAT bindings has been added, allowing you to specify the address and port when defining NAT transformations based on map lists or named sets.

  nft add rule ip nat pre dnat ip addr . port to ip saddr map { 1.1.1.1 : 2.2.2.2 . 30 }

  nft add map ip nat destinations { type ipv4_addr . inet_service : ipv4_addr . inet_service \; }
  nft add rule ip nat pre dnat ip addr . port to ip saddr . tcp dport map @destinations

• Support for hardware acceleration with offloading some filtering operations to the network card. Acceleration is enabled through the ethtool utility ("ethtool -K eth0 hw-tc-offload on"), after which it is activated in nftables for the main chain using the "offload" flag. With Linux kernel 5.6, hardware acceleration is supported for matching header fields and checking the incoming interface in conjunction with accepting, dropping, duplicating (dup), and redirecting (fwd) packets. In the example below, dropping packets coming from the address 192.168.30.20 is performed at the network card level, without passing the packets to the kernel:

  # cat file.nft
  table netdev x {
  chain y {
  type filter hook ingress device eth0 priority 10; flags offload;
  ip saddr 192.168.30.20 drop
  }
  }
  # nft -f file.nft

• Improved error location reporting in rules.

  # nft delete rule ip y z handle 7
  Error: Could not process rule: No such file or directory
  delete rule ip y z handle 7
  ^

  # nft delete rule ip x x handle 7
  Error: Could not process rule: No such file or directory
  delete rule ip x x handle 7
  ^

  # nft delete table twst
  Error: No such file or directory; did you mean table ‘test’ in family ip?
  delete table twst
  ^^^^

  The first example shows that the table "y" is missing from the system, the second that the handler "7" is absent, and the third that a typo suggestion is displayed when typing the table name.

• Support for checking the slave interface has been added via specifying "meta sdif" or "meta sdifname":

  … meta sdifname vrf1 …

• Support for shift operations to the right or left has been added. For example, to shift an existing packet mark left by 1 bit and set the least significant bit to 1:

  … meta mark set meta mark lshift 1 or 0x1 …

• The option "-V" has been implemented to display extended version information.

  # nft -V
  nftables v0.9.4 (Jive at Five)
  cli: readline
  json: yes
  minigmp: no
  libxtables: yes

• Command line options must now be specified before commands. For example, you need to specify "nft -a list ruleset", while running "nft list ruleset -a" will result in an error.

  Source: opennet.ru