{"id":102342,"date":"2021-11-20T15:36:48","date_gmt":"2021-11-20T13:36:48","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-1"},"modified":"2021-11-20T15:36:48","modified_gmt":"2021-11-20T13:36:48","slug":"vypusk-paketnogo-filtra-nftables-1-0-1","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-1","title":{"rendered":"Publication du filtre de paquets nftables 1.0.1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>La version du filtre de paquets nftables 1.0.1 a \u00e9t\u00e9 publi\u00e9e, unifiant les interfaces de filtrage de paquets pour IPv4, IPv6, ARP et les ponts r\u00e9seau (destin\u00e9 \u00e0 remplacer iptables, ip6tables, arptables et ebtables). Les modifications n\u00e9cessaires pour faire fonctionner la version nftables 1.0.1 sont incluses dans le noyau Linux 5.16-rc1.      <\/p>\n<p>Le paquet nftables comprend des composants du filtre de paquets fonctionnant dans l'espace utilisateur, tandis qu'au niveau du noyau, le fonctionnement est assur\u00e9 par la sous-syst\u00e8me nf_tables, int\u00e9gr\u00e9 dans le noyau Linux depuis la version 3.13. Au niveau du noyau, une interface g\u00e9n\u00e9rale est fournie, ind\u00e9pendante du protocole sp\u00e9cifique, offrant des fonctions de base pour l'extraction de donn\u00e9es des paquets, l'ex\u00e9cution d'op\u00e9rations sur les donn\u00e9es et la gestion de flux.    <\/p>\n<p>Les r\u00e8gles de filtrage et les gestionnaires sp\u00e9cifiques aux protocoles sont compil\u00e9s en bytecode dans l'espace utilisateur, apr\u00e8s quoi ce bytecode est charg\u00e9 dans le noyau via l'interface Netlink et ex\u00e9cut\u00e9 dans le noyau dans une structure sp\u00e9ciale <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/vps\/abuzoustojchivye-vps\/\"   title=\"une machine virtuelle\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4318\">une machine virtuelle<\/a>, similaire aux BPF (Berkeley Packet Filters). Cette approche permet de r\u00e9duire consid\u00e9rablement la taille du code de filtrage fonctionnant au niveau du noyau et de transf\u00e9rer toutes les fonctions de parsing des r\u00e8gles et de logique de traitement des protocoles dans l'espace utilisateur.    <\/p>\n<p>Les principales nouveaut\u00e9s :  <\/p>\n<ul>\n<li class=\"l\"> La consommation de m\u00e9moire a \u00e9t\u00e9 r\u00e9duite lors du chargement de grandes listes set et map.\n<li class=\"l\"> Le rechargement des listes set et map a \u00e9t\u00e9 acc\u00e9l\u00e9r\u00e9.\n<li class=\"l\"> L'affichage des tables et des cha\u00eenes s\u00e9lectionn\u00e9es est d\u00e9sormais plus rapide dans de grands ensembles de r\u00e8gles. Par exemple, le temps d'ex\u00e9cution de la commande \u00ab nft list ruleset \u00bb pour afficher un ensemble de r\u00e8gles comprenant 100 000 lignes est de 3,049 secondes, tandis qu'en affichant uniquement les tables nat et filter (\u00ab nft list table nat \u00bb, \u00ab nft list table filter \u00bb), il est r\u00e9duit \u00e0 1,969 et 0,697 secondes.\n<li class=\"l\"> L'ex\u00e9cution des requ\u00eates avec l'option \u00ab --terse \u00bb a \u00e9t\u00e9 acc\u00e9l\u00e9r\u00e9e lors du traitement des r\u00e8gles avec de grandes listes set et map.\n<li class=\"l\"> Il est d\u00e9sormais possible de filtrer le trafic de la cha\u00eene \u00ab egress \u00bb, trait\u00e9 au m\u00eame niveau que le gestionnaire egress dans la cha\u00eene netdev (hook egress), c'est-\u00e0-dire \u00e0 l'\u00e9tape o\u00f9 le pilote re\u00e7oit le paquet de la pile r\u00e9seau du noyau. table netdev filter { chain egress { type filter hook egress devices = { eth0, eth1 } priority 0; meta priority set ip saddr map { 192.168.10.2 : abcd:2, 192.168.10.3 : abcd:3 } } }\n<li class=\"l\"> La correspondance et la modification des octets dans l'en-t\u00eate et le contenu du paquet \u00e0 un d\u00e9calage donn\u00e9 sont autoris\u00e9es.      # nft add rule x y @ih,32,32 0x14000000 counter    # nft add rule x y @ih,32,32 set 0x14000000 counter    <\/ul>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56192\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.1, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u0443\u0441\u043a\u0430 nftables 1.0.1 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.16-rc1. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-102342","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.1, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-1\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.1 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.1, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-1\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-11-20T13:36:48+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-11-20T13:36:48+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sortie du filtrage de paquets nftables 1.0.1 | ProHoster","description":"Publication de la version 1.0.1 du filtrage de paquets nftables, unifiant les interfaces de filtrage pour IPv4, IPv6, ARP et les ponts r\u00e9seaux (vis\u00e9e \u00e0 remplacer iptables, ip6table, arptables et ebtables).","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-1","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.1 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.1, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-1","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-11-20T13:36:48+00:00","article:modified_time":"2021-11-20T13:36:48+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"102342","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-11-20 13:38:30","updated":"2022-10-02 07:24:43","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/102342","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=102342"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/102342\/revisions"}],"predecessor-version":[{"id":164193,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/102342\/revisions\/164193"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=102342"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=102342"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=102342"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}