{"id":103407,"date":"2022-02-22T03:36:42","date_gmt":"2022-02-22T01:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-2"},"modified":"2022-02-22T03:36:42","modified_gmt":"2022-02-22T01:36:42","slug":"vypusk-paketnogo-filtra-nftables-1-0-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","title":{"rendered":"Sortie du filtre de paquets nftables 1.0.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>La publication de la version 1.0.2 du filtre de paquets nftables, unifiant les interfaces de filtrage de paquets pour IPv4, IPv6, ARP et les ponts r\u00e9seau (visant \u00e0 remplacer iptables, ip6tables, arptables et ebtables), a \u00e9t\u00e9 r\u00e9alis\u00e9e. Les modifications n\u00e9cessaires pour le fonctionnement de la version nftables 1.0.2 sont incluses dans le noyau Linux 5.17-rc.      <\/p>\n<p>Le paquet nftables comprend des composants du filtre de paquets fonctionnant dans l'espace utilisateur, tandis qu'au niveau du noyau, le fonctionnement est assur\u00e9 par la sous-syst\u00e8me nf_tables, int\u00e9gr\u00e9 dans le noyau Linux depuis la version 3.13. Au niveau du noyau, une interface g\u00e9n\u00e9rale est fournie, ind\u00e9pendante du protocole sp\u00e9cifique, offrant des fonctions de base pour l'extraction de donn\u00e9es des paquets, l'ex\u00e9cution d'op\u00e9rations sur les donn\u00e9es et la gestion de flux.    <\/p>\n<p>Les r\u00e8gles de filtrage et les gestionnaires sp\u00e9cifiques aux protocoles sont compil\u00e9s en bytecode dans l'espace utilisateur, apr\u00e8s quoi ce bytecode est charg\u00e9 dans le noyau via l'interface Netlink et ex\u00e9cut\u00e9 dans le noyau dans une structure sp\u00e9ciale <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/vps\/abuzoustojchivye-vps\/\"   title=\"une machine virtuelle\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4319\">une machine virtuelle<\/a>, similaire aux BPF (Berkeley Packet Filters). Cette approche permet de r\u00e9duire consid\u00e9rablement la taille du code de filtrage fonctionnant au niveau du noyau et de transf\u00e9rer toutes les fonctions de parsing des r\u00e8gles et de logique de traitement des protocoles dans l'espace utilisateur.    <\/p>\n<p>Les principales nouveaut\u00e9s :  <\/p>\n<ul>\n<li class=\"l\"> Un mode d'optimisation des r\u00e8gles a \u00e9t\u00e9 ajout\u00e9, activ\u00e9 par une nouvelle option &#171;-o&#187; (&#171;&#8212;optimize&#187;), qui peut \u00eatre combin\u00e9e avec l'option &#171;&#8212;check&#187; pour v\u00e9rifier et optimiser les modifications dans un fichier contenant un ensemble de r\u00e8gles sans le charger r\u00e9ellement. L'optimisation permet de regrouper des r\u00e8gles similaires, par exemple, les r\u00e8gles :          meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept        meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.5 accept        ip saddr 1.1.1.1 ip daddr 2.2.2.2 accept        ip saddr 2.2.2.2 ip daddr 3.3.3.3 drop\n<p>seront combin\u00e9es en           meta iifname . ip saddr . ip daddr { eth1 . 1.1.1.1 . 2.2.2.3, eth1 .   1.1.1.2 . 2.2.2.5 } accept        ip saddr . ip daddr vmap { 1.1.1.1 . 2.2.2.2 : accept, 2.2.2.2 . 3.3.3.3   : drop }    <\/p>\n<p>Exemple d'utilisation :       # nft -c -o -f ruleset.test     Fusion :       ruleset.nft:16:3-37:  ip daddr 192.168.0.1 counter accept       ruleset.nft:17:3-37:  ip daddr 192.168.0.2 counter accept       ruleset.nft:18:3-37:  ip daddr 192.168.0.3 counter accept     dans :       ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 } counter packets 0 bytes 0 accept      <\/p>\n<li class=\"l\"> Dans les listes set, il est d\u00e9sormais possible d'indiquer des options ip et tcp ainsi que des chunks sctp :            set s5 {                 typeof ip option ra value                 elements = { 1, 1024 }          }            set s7 {                 typeof sctp chunk init num-inbound-streams                 elements = { 1, 4 }          }            chain c5 {                 ip option ra value @s5 accept          }            chain c7 {                 sctp chunk init num-inbound-streams @s7 accept          }\n<li class=\"l\"> Ajout de la prise en charge des options TCP fastopen, md5sig et mptcp.\n<li class=\"l\"> Ajout de la prise en charge de l'utilisation dans les correspondances du sous-type mp-tcp :            tcp option mptcp subtype 1\n<li class=\"l\"> Le code de filtrage fonctionnant du c\u00f4t\u00e9 du noyau a \u00e9t\u00e9 am\u00e9lior\u00e9.\n<li class=\"l\"> Pour flowtable, une prise en charge compl\u00e8te du format JSON a \u00e9t\u00e9 r\u00e9alis\u00e9e.\n<li class=\"l\"> Il est maintenant possible d'utiliser l'action &#171;reject&#187; lors des op\u00e9rations de correspondance des trames Ethernet.            ether saddr aa:bb:cc:dd:ee:ff ip daddr 192.168.0.1 reject      <\/ul>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56739\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u0443\u0441\u043a\u0430 nftables 1.0.2 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.17-rc. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103407","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-22T01:36:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-22T01:36:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lancement du filtre de paquets nftables 1.0.2 | ProHoster","description":"La publication de la version 1.0.2 du filtre de paquets nftables, unifiant les interfaces de filtrage de paquets pour IPv4, IPv6, ARP et les ponts r\u00e9seau (visant \u00e0 remplacer iptables, ip6tables, arptables et ebtables), a eu lieu.","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-22T01:36:42+00:00","article:modified_time":"2022-02-22T01:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103407","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-22 01:37:39","updated":"2022-09-28 07:06:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/103407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=103407"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/103407\/revisions"}],"predecessor-version":[{"id":164194,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/103407\/revisions\/164194"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=103407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=103407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=103407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}