{"id":100285,"date":"2021-05-26T10:22:54","date_gmt":"2021-05-26T08:22:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-0-9-9"},"modified":"2021-05-26T10:22:54","modified_gmt":"2021-05-26T08:22:54","slug":"vypusk-paketnogo-filtra-nftables-0-9-9","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9","title":{"rendered":"V\u00e4ljaanne pakettifiltri nftables 0.9.9","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Avaldatud pakettifiltri nftables 0.9.9, mis \u00fchtlustab pakettide filtreerimise liideseid IPv4, IPv6, ARP ja v\u00f5rgu sillade jaoks (suunatud iptables, ip6tables, arptables ja ebtables asendamisele). Samuti on avaldatud seotud teegi libnftnl 1.2.0, mis pakub madala taseme API-d nf_tables alams\u00fcsteemiga suhtlemiseks. vajalikud muudatused nftables 0.9.9 versiooni t\u00f6\u00f6ks on sisse ehitatud Linuxi tuuma 5.13-rc1.          <\/p>\n<p>Nftables'i paketti kuuluvad kasutajaruumi t\u00f6\u00f6tavad pakettfilteri komponendid, samas kui tuuma tasemel tagab t\u00f6\u00f6 nf_tables s\u00fcsteem, mis on osa Linuxi tuumast alates versioonist 3.13. Tuuma tasemel pakutakse vaid \u00fcldist liidest, mis ei s\u00f5ltu konkreetsest protokollist ja pakub p\u00f5hifunktsioone andmete v\u00e4ljav\u00f5tmiseks pakettidest, andmetega t\u00f6\u00f6tamiseks ja voogude haldamiseks.    <\/p>\n<p>Filtreerimise reeglid ja protokollile spetsiifilised t\u00f6\u00f6tlejad kompileeritakse kasutajaruumi baidikoodiks, seej\u00e4rel laaditakse see baidikood tuuma Netlink liidese abil ja t\u00e4idetakse tuumas spetsiaalses <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/vps\/abuzoustojchivye-vps\/\"   title=\"virtuaalses masinas\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4310\">virtuaalses masinas<\/a>, mis meenutab BPF-i (Berkeley Packet Filters). Selline l\u00e4henemine v\u00f5imaldab oluliselt v\u00e4hendada tuuma tasemel t\u00f6\u00f6tava filtreerimiskoodi suurust ja viia k\u00f5ik reeglite t\u00f5lgendamise ja protokollidega t\u00f6\u00f6tamise funktsioonid kasutajaruumi.    <\/p>\n<p>Peamised uuendused:  <\/p>\n<ul>\n<li class=\"l\"> On m\u00f5eldud v\u00f5imalus edastada flowtable'i t\u00f6\u00f6tlemine v\u00f5rguadapteri k\u00fclge, aktiveeritav lippu \"offload\" abil. Flowtable on pakettide suunamise teede optimeerimise mehhanism, kus k\u00f5iki reeglite t\u00f6\u00f6tlemise ahelate samme rakendatakse ainult esimesele pakettile, ning k\u00f5ik j\u00e4rgmised pakettide voos edastatakse otse.        table ip global {              flowtable f {                      hook ingress priority filter + 1                      devices = { lan3, lan0, wan }                      flags offload              }                chain forward {                      type filter hook forward priority filter; policy accept;                      ip protocol { tcp, udp } flow add @f              }                chain post {                      type nat hook postrouting priority filter; policy accept;                      oifname \"wan\" masquerade              }      }\n<li class=\"l\"> Lisatud on lipu toetamine tabelite k\u00fclge kinnitamiseks, mis v\u00f5imaldab tagada tabeli eksklusiivset kasutamist protsessi poolt. Protsessi l\u00f5petamisel eemaldatakse sellele seotud tabel automaatselt. Teave protsessi kohta kuvatakse reeglite dump'is kommentaarina:          table ip x { # progname nft              flags owner                chain y {                      type filter hook input priority filter; policy accept;                      counter packets 1 bytes 309              }      }\n<li class=\"l\"> Lisa tugi IEEE 802.1ad (VLAN stacking v\u00f5i QinQ) spetsifikatsioonile, mis m\u00e4\u00e4ratleb mitme VLAN-i m\u00e4rgise asendamismeetodid \u00fche Etherneti raami sees. N\u00e4iteks, et kontrollida v\u00e4lise Etherneti raami 8021ad t\u00fc\u00fcpi ja vlan id=342, v\u00f5id kasutada konstruktsiooni        ... ether type 802.1ad vlan id 342      v\u00e4lise Etherneti raami 8021ad\/vlan id=1, sisse pandud 802.1q\/vlan id=2 ja edasise IP-paketi kapseldamise kontrollimiseks:         ... ether type 8021ad vlan id 1 vlan type 8021q vlan id 2 vlan type ip counter\n<li class=\"l\"> Lisatud ressursside haldamine \u00fchtse cgroups v2 hierarhia kaudu. Cgroups v2 olulisim erinevus v1-st on, et see rakendab \u00fchise cgroups hierarhia k\u00f5igi ressursside jaoks, mitte eraldi hierarhiad CPU, m\u00e4lu ja sisendi\/v\u00e4ljundi ressursside jaotamiseks.  N\u00e4iteks, et kontrollida, kas socket'i eelk\u00e4ija esimeses tasemes cgroupv2 vastab maskile \"system.slice\", v\u00f5id kasutada konstruktsiooni:       ... socket cgroupv2 level 1 \"system.slice\"\n<li class=\"l\"> Lisatud v\u00f5imalus kontrollida SCTP pakettide komponente (vajalik funktsionaalsus ilmub Linuxi kerneli 5.14-s). N\u00e4iteks, et kontrollida, kas chunk-il on t\u00fc\u00fcp 'data' ja v\u00e4li    'type':       ... sctp chunk data exists    ... sctp chunk data type 0\n<li class=\"l\"> Reeglite laadimise operatsiooni t\u00e4itmine on kaks korda kiirem lipu \"-f\" abil. Samuti on kiirem reeglite loendi v\u00e4ljastamine.\n<li class=\"l\"> Esitatakse kompaktne vorm bitiflagide installimise kontrollimiseks. N\u00e4iteks, et kontrollida, et snat ja dnat olekubitid ei ole seatud, v\u00f5ib kasutada:       \u2026 ct status ! snat,dnat    et kontrollida, et bit syn on seatud bitimaskis syn,ack:       \u2026 tcp flags syn \/ syn,ack    et kontrollida, et bitti fin ja rst ei ole seatud bitimaskis syn,ack,fin,rst:       \u2026 tcp flags != fin,rst \/ syn,ack,fin,rst\n<li class=\"l\"> Kasutamine v\u00f5tmes\u00f5na \u00abverdict\u00bb on lubatud typeof m\u00e4\u00e4ratlustes set\/map:        add map x m { typeof iifname . ip protocol . th dport : verdict ;}    <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55214\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libnftnl 1.2.0, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0439 API \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 nf_tables. \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u0443\u0441\u043a\u0430 nftables 0.9.9 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.13-rc1. \u0412 \u043f\u0430\u043a\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100285","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-05-26T08:22:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-05-26T08:22:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Paketifiltri nftables 0.9.9 v\u00e4ljalase | ProHoster","description":"Avaldatud paketifiltri nftables 0.9.9 v\u00e4ljaanne, mis unifitseerib pakettide filtreerimise liidesed IPv4, IPv6, ARP ja v\u00f5rgusildade jaoks (suunatud iptablesi, ip6table'i, arptablesi ja ebtablesi asendamiseks).","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-26T08:22:54+00:00","article:modified_time":"2021-05-26T08:22:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100285","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-26 08:38:02","updated":"2022-10-04 04:29:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=100285"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100285\/revisions"}],"predecessor-version":[{"id":164185,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/100285\/revisions\/164185"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=100285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=100285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=100285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}