{"id":37278,"date":"2019-10-31T22:16:45","date_gmt":"2019-10-31T19:16:45","guid":{"rendered":"https:\/\/prohoster.info\/blog\/vypusk-paketnogo-filtra-nftables-0-9-2\/"},"modified":"2019-10-31T22:16:45","modified_gmt":"2019-10-31T19:16:45","slug":"vypusk-paketnogo-filtra-nftables-0-9-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-2","title":{"rendered":"Release of nftables version 0.9.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Took place<\/a><\/noindex> release of the packet filter nftables 0.9.2<\/a><\/noindex>, which is being developed as a replacement for iptables, ip6tables, arptables, and ebtables through the unification of packet filtering interfaces for IPv4, IPv6, ARP, and network bridges. The nftables package includes user-space packet filtering components, while the kernel-level functionality is provided by the nf_tables subsystem, which has been a part of the Linux kernel since version 3.13. The necessary changes for the release of nftables 0.9.2 are included in kernel version 5.3.<\/p>\n

At the kernel level, only a general interface is provided that is independent of any particular protocol and offers basic functions for extracting data from packets, performing operations on the data, and managing flows. The filtering logic and protocol-specific handlers are compiled into bytecode in user space, after which this bytecode is loaded into the kernel via the Netlink interface and executed in a special virtual machine similar to BPF (Berkeley Packet Filters). This approach significantly reduces the amount of filtering code running at the kernel level and moves all parsing rules and protocol handling logic into user space.<\/p>\n

Key innovations:<\/p>\n