Release of the nftables 0.9.5 packet filter

Published release of the packet filter nftables 0.9.5, evolving as a replacement for iptables, ip6tables, arptables, and ebtables by unifying packet filtering interfaces for IPv4, IPv6, ARP, and network bridges. The nftables package includes user-space packet filter components, while kernel operations are managed by the nf_tables subsystem, which has been part of the Linux kernel since version 3.13. The necessary changes for nftables 0.9.5 are included in the kernel. Linux 5.7.

At the kernel level, only a generic interface is provided that is independent of specific protocols and offers basic functions for extracting data from packets, performing operations on data, and managing flow. The filtering rules and protocol-specific handlers are compiled into bytecode in user space, which is then loaded into the kernel via the Netlink interface and executed in a special virtual machine reminiscent of BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and moves all rule parsing and protocol handling logic to user space.

Key innovations:

• The set has added support for packet and traffic counters linked to set elements. Counters are enabled using the keyword "counter":

  table ip x {
  set y {
  typeof ip saddr
  counter
  elements = { 192.168.10.35, 192.168.10.101, 192.168.10.135 }
  }

  chain z {
  type filter hook output priority filter; policy accept;
  ip daddr @y
  }
  }

• To set the initial values of the counters, for example, to restore past counters after a restart, the command "nft -f" can be used:

  # cat ruleset.nft
  table ip x {
  set y {
  typeof ip saddr
  counter
  elements = { 192.168.10.35 counter packets 1 bytes 84, 192.168.10.101 \
  counter p 192.168.10.135 counter packets 0 bytes 0 }
  }

  chain z {
  type filter hook output priority filter; policy accept;
  ip daddr @y
  }
  }
  # nft -f ruleset.nft
  # nft list ruleset
  table ip x {
  set y {
  typeof ip saddr
  counter
  elements = { 192.168.10.35 counter packets 1 bytes 84, 192.168.10.101 \
  counter p 192.168.10.135 counter packets 0 bytes 0 }
  }

  chain z {
  type filter hook output priority filter; policy accept;
  ip daddr @y
  }
  }

• Support for counters has also been added to the flowtable:

  table ip foo {
  flowtable bar {
  hook ingress priority -100
  devices = { eth0, eth1 }
  counter
  }

  chain forward {
  type filter hook forward priority filter;
  flow add @bar counter
  }
  }

  The list of counters can be viewed with the command "conntrack -L":

  tcp 6 src=192.168.10.2 dst=10.0.1.2 sport=47278 dport=5201 packets=9 bytes=608 \
  src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=47278 packets=8 bytes=428 [OFFLOAD] mark=0 \
  secctx=null use=2 tcp 6 src=192.168.10.2 dst=10.0.1.2 sport=47280 dport=5201 \
  packets=1005763 bytes=44075714753 src=10.0.1.2 dst=10.0.1.1 sport=5201 dport=47280 \
  packets=967505 bytes=50310268 [OFFLOAD] mark=0 secctx=null use=2

• In sets for concatenation (specific bindings of addresses and ports that simplify matching), the ability to use the "typeof" directive has been added, defining the data type of elements for the composite elements of the set:

  table ip foo {
  set whitelist {
  typeof ip saddr . tcp dport
  elements = { 192.168.10.35 . 80, 192.168.10.101 . 80 }
  }

  chain bar {
  type filter hook prerouting priority filter; policy drop;
  ip daddr . tcp dport @whitelist accept
  }
  }

• The typeof directive is now also applicable for concatenations in map lists:

  table ip foo {
  map addr2mark {
  typeof ip saddr . tcp dport : meta mark
  elements = { 192.168.10.35 . 80 : 0x00000001,
  192.168.10.135 . 80 : 0x00000002 }
  }

  chain bar {
  type filter hook prerouting priority filter; policy drop;
  meta mark set ip daddr . tcp dport map @addr2mark accept
  }
  }

• Support for range concatenation in anonymous (unnamed) sets has been added:

  # nft add rule inet filter input ip daddr . tcp dport \
  { 10.0.0.0/8 . 10-23, 192.168.1.1-192.168.3.8 . 80-443 } accept

• Support for dropping packets with 802.1q (VLAN) flags when processing network bridges has been provided:

  # nft add rule bridge foo bar ether type vlan reject with tcp reset

• Support for matching by TCP session identifier (conntrack ID) has been added. The "--output id" option can be used to determine the conntrack ID:

  # conntrack -L —output id
  udp 17 18 src=192.168.2.118 dst=192.168.2.1 sport=36424 dport=53 packets=2 \
  bytes=122 src=192.168.2.1 dst=192.168.2.118 sport=53 dport=36424 packets=2 bytes=320 \
  [ASSURED] mark=0 use=1 id=2779986232

  # nft add rule foo bar ct id 2779986232 counter

Source: opennet.ru