The release of the nftables 1.0.7 batch filter has been published, unifying the filtering interfaces for IPv4, IPv6, ARP, and network bridges (aimed at replacing iptables, ip6tables, arptables, and ebtables). The nftables package includes packet filter components that operate in user space, while the kernel-level work is handled by the nf_tables subsystem, included in the Linux kernel since version 3.13. At the kernel level, only a generic interface is provided, independent of specific protocols and offering basic functions for extracting data from packets, performing operations on data, and managing traffic.
The filtering rules themselves and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in the kernel in a special environment resembling BPF (Berkeley Packet Filters). This approach significantly reduces the size of the filtering code running at the kernel level and offloads all functions related to rule parsing and protocol logic into user space. virtual machineFull support for lightweight tunnel templates, such as vxlan, geneve, and erspan, has been provided: table netdev global { tunnel t1 { id 10 ip saddr 192.168.2.10 ip daddr 192.168.2.11 sport 1025 dport 20020 ttl 1 erspan { version 1 index 2 } } tunnel t2 { id 10 ip saddr 192.168.3.10 ip daddr 192.168.3.11 sport 1025 dport 21021 ttl 1 erspan { version 1 index 2 } } chain in { type filter hook ingress device veth0 priority 0; tunnel name ip saddr map { 10.141.10.12 : "t1", 10.141.10.13 : "t2" } fwd to erspan1 } } Before loading the rules, a network interface erspan1 must be created: ip link add dev erspan1 type erspan external
Key Changes:
- Support for matching vxlan, geneve, gre, and gretap protocol types has been added for systems with Linux kernel 6.2 and above, allowing simple expressions to check the headers in encapsulated packets. For example, to check an IP address in the header of an inner VxLAN packet, rules can now be used (without needing to pre-decapsulate the VxLAN header and bind the filter to the vxlan0 interface): … udp dport 4789 vxlan ip protocol udp … udp dport 4789 vxlan ip saddr 1.2.3.0/24 … udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 }
- Support for automatic merging of leftovers after partial deletion of a set-list element has been implemented, allowing an element or part of a range to be removed from an existing range (previously, a range could only be deleted entirely). For example, after removing element 25 from a set list with ranges 24-30 and 40-50, the list will remain with 24, 26-30, and 40-50. The fixes necessary for the auto-merge functionality will be proposed in correction releases for the stable branches of kernel 5.10 and above. # nft list ruleset table ip x { set y { typeof tcp dport flags interval auto-merge elements = { 24-30, 40-50 } } } # nft delete element ip x y { 25 } # nft list ruleset table ip x { set y { typeof tcp dport flags interval auto-merge elements = { 24, 26-30, 40-50 } } }
- The use of contacts and ranges is allowed when mapping address translation (NAT). table ip nat { chain prerouting { type nat hook prerouting priority dstnat; policy accept; dnat to ip daddr . tcp dport map { 10.1.1.136 . 80 : 1.1.2.69 . 1024, 10.1.1.10-10.1.1.20 . 8888-8889 : 1.1.2.69 . 2048-2049 } persistent } }
- Support for the 'last' expression has been added, allowing you to find out the last time an element of a rule or set list was used. This feature is supported starting from kernel Linux 5.14. table ip x { set y { typeof ip daddr . tcp dport size 65535 flags dynamic,timeout last timeout 1h } chain z { type filter hook output priority filter; policy accept; update @y { ip daddr . tcp dport } } } # nft list set ip x y table ip x { set y { typeof ip daddr . tcp dport size 65535 flags dynamic,timeout last timeout 1h elements = { 172.217.17.14 . 443 last used 1s591ms timeout 1h expires 59m58s409ms, 172.67.69.19 . 443 last used 4s636ms timeout 1h expires 59m55s364ms, 142.250.201.72 . 443 last used 4s748ms timeout 1h expires 59m55s252ms, 172.67.70.134 . 443 last used 4s688ms timeout 1h expires 59m55s312ms, 35.241.9.150 . 443 last used 5s204ms timeout 1h expires 59m54s796ms, 138.201.122.174 . 443 last used 4s537ms timeout 1h expires 59m55s463ms, 34.160.144.191 . 443 last used 5s205ms timeout 1h expires 59m54s795ms, 130.211.23.194 . 443 last used 4s436ms timeout 1h expires 59m55s564ms } } }
- The ability to define quotas in set lists has been added. For example, to define a traffic quota for each target IP address, you can specify: table netdev x { set y { typeof ip daddr size 65535 quota over 10000 mbytes } chain y { type filter hook egress device 'eth0' priority filter; policy accept; ip daddr @y drop } } # nft add element inet x y { 8.8.8.8 } # ping -c 2 8.8.8.8 # nft list ruleset table netdev x { set y { type ipv4_addr size 65535 quota over 10000 mbytes elements = { 8.8.8.8 quota over 10000 mbytes used 196 bytes } } chain y { type filter hook egress device 'eth0' priority filter; policy accept; ip daddr @y drop } }
- Usage of constants in set lists is now allowed. For example, when using the destination address and VLAN ID as keys for the list, you can directly specify the VLAN number (daddr . 123): table netdev t { set s { typeof ether saddr . vlan id size 2048 flags dynamic,timeout timeout 1m } chain c { type filter hook ingress device eth0 priority 0; policy accept; ether type != 8021q update @s { ether daddr . 123 } counter } }
- A new 'destroy' command has been added for unconditionally deleting objects (in contrast to the delete command, it does not generate ENOENT when trying to remove a non-existent object). A minimum of Linux kernel 6.3-rc is required to operate. destroy table ip filter
Source: opennet.ru
