The release of the nftables 1.0.3 packet filtering package has been published, unifying the packet filtering interfaces for IPv4, IPv6, ARP, and network bridges (aimed at replacing iptables, ip6tables, arptables, and ebtables). The necessary changes for the operation of nftables 1.0.3 are included in the Linux kernel 5.18.
The nftables package includes user-space packet filter components, while the nf_tables subsystem, which is part of the Linux kernel since version 3.13, handles operations at the kernel level. At the kernel level, only a general interface is provided, which is independent of specific protocols and offers basic functions for extracting data from packets, performing data operations, and managing the flow.
The filtering rules themselves and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special environment resembling BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and offloads all functions related to rule parsing and protocol logic into user space. virtual machineFull support for lightweight tunnel templates, such as vxlan, geneve, and erspan, has been provided: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : "t1", 10.141.10.13 : "t2" } fwd to erspan1 } } Before loading the rules, a network interface erspan1 must be created: ip link add dev erspan1 type erspan external
Key innovations:
- Set lists now support matching network interface names by mask, such as defined using the '*' symbol: table inet testifsets { set simple_wild { type ifname flags interval elements = { "abcdef*", "othername", "ppp0" } } chain v4icmp { type filter hook input priority 0; policy accept; iifname @simple_wild counter packets 0 bytes 0 iifname { "abcdef*", "eth0" } counter packets 0 bytes 0 } }
- Automatic merging of intersecting set list elements during operation has been implemented. Previously, when the 'auto-merge' option was set, merging occurred at the rule declaration stage, but now it is triggered during incremental addition of new elements in operation. For example, at the declaration stage, the list set y { flags interval auto-merge elements = { 1.2.3.0, 1.2.3.255, 1.2.3.0/24, 3.3.3.3, 4.4.4.4, 4.4.4.4-4.4.4.8, 3.3.3.4, 3.3.3.5 } } will be transformed into elements = { 1.2.3.0/24, 3.3.3.3-3.3.3.5, 4.4.4.4-4.4.4.8 } and then if new elements are added # nft add element ip x y { 1.2.3.0-1.2.4.255, 3.3.3.6 } it will look like elements = { 1.2.3.0-1.2.4.255, 3.3.3.3-3.3.3.6, 4.4.4.4-4.4.4.8 }
When removing individual elements from the list that fall within existing range elements, the range is reduced or split.
- Support for combining multiple Network Address Translation (NAT) rules into a map list has been added to the rule optimizer invoked by specifying the option "-o/--optimize". For example, for the set # cat ruleset.nft table ip x { chain y { type nat hook postrouting priority srcnat; policy drop; ip saddr 1.1.1.1 tcp dport 8000 snat to 4.4.4.4:80 ip saddr 2.2.2.2 tcp dport 8001 snat to 5.5.5.5:90 } }
Running "nft -o -c -f ruleset.nft" will convert the separate "ip saddr" rules into a map list: snat to ip saddr . tcp dport map { 1.1.1.1 . 8000 : 4.4.4.4 . 80, 2.2.2.2 . 8001 : 5.5.5.5 . 90 }
Similarly, raw expressions can also be transformed into map lists: # cat ruleset.nft table ip x { […] chain nat_dns_acme { udp length 47-63 @th,160,128 0x0e373135363130333131303735353203 goto nat_dns_dnstc udp length 62-78 @th,160,128 0x0e31393032383939353831343037320e goto nat_dns_this_5301 udp length 62-78 @th,160,128 0x0e31363436323733373931323934300e goto nat_dns_saturn_5301 udp length 62-78 @th,160,128 0x0e32393535373539353636383732310e goto nat_dns_saturn_5302 udp length 62-78 @th,160,128 0x0e38353439353637323038363633390e goto nat_dns_saturn_5303 drop } }
after optimization, we will obtain the map list: udp length . @th,160,128 vmap { 47-63 . 0x0e373135363130333131303735353203 : goto nat_dns_dnstc, 62-78 . 0x0e31393032383939353831343037320e : goto nat_dns_this_5301, 62-78 . 0x0e31363436323733373931323934300e : goto nat_dns_saturn_5301, 62-78 . 0x0e32393535373539353636383732310e : goto nat_dns_saturn_5302, 62-78 . 0x0e38353439353637323038363633390e : goto nat_dns_saturn_5303 }
- The use of raw expressions in concatenation operations is allowed. For example: # nft add rule x y ip saddr . @ih,32,32 { 1.1.1.1 . 0x14, 2.2.2.2 . 0x1e } or table x { set y { typeof ip saddr . @ih,32,32 elements = { 1.1.1.1 . 0x14 } } }
- Support has been added for specifying integer header fields in concatenation operations: table inet t { map m1 { typeof udp length . @ih,32,32 : verdict flags interval elements = { 20-80 . 0x14 : accept, 1-10 . 0xa : drop } } chain c { type filter hook input priority 0; policy drop; udp length . @ih,32,32 vmap @m1 } }
- Support has been added for TCP option resets (only works with Linux kernel 5.18+): tcp flags syn reset tcp option sack-perm
- The execution of chain output commands (“nft list chain x y”) has been accelerated.
Source: opennet.ru
