{"id":107267,"date":"2023-03-14T12:48:14","date_gmt":"2023-03-14T10:48:14","guid":{"rendered":"https:\/\/prohoster.info\/?p=107267"},"modified":"2023-03-15T19:12:55","modified_gmt":"2023-03-15T17:12:55","slug":"vypusk-paketnogo-filtra-nftables-1-0-7","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","title":{"rendered":"Publication du filtre de paquets nftables 1.0.7","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Publication du filtre de paquets nftables 1.0.7, unifiant les interfaces de filtrage des paquets pour IPv4, IPv6, ARP et les ponts r\u00e9seau (visant \u00e0 remplacer iptables, ip6tables, arptables et ebtables). Le paquet nftables contient des composants de filtre de paquets fonctionnant dans l'espace utilisateur, tandis qu'au niveau du noyau, la sous-syst\u00e8me nf_tables assure cette fonction, int\u00e9gr\u00e9e dans le noyau Linux depuis la version 3.13. Au niveau du noyau, une interface g\u00e9n\u00e9rale est fournie, ind\u00e9pendante du protocole sp\u00e9cifique, permettant des fonctionnalit\u00e9s de base pour extraire des donn\u00e9es des paquets, effectuer des op\u00e9rations sur ces donn\u00e9es et g\u00e9rer le flux.    <\/p>\n<p>Les r\u00e8gles de filtrage et les gestionnaires sp\u00e9cifiques aux protocoles sont compil\u00e9s en bytecode dans l'espace utilisateur, apr\u00e8s quoi ce bytecode est charg\u00e9 dans le noyau via l'interface Netlink et ex\u00e9cut\u00e9 dans le noyau dans une structure sp\u00e9ciale <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/vps\/abuzoustojchivye-vps\/\"   title=\"une machine virtuelle\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4335\">une machine virtuelle<\/a>, similaire aux BPF (Berkeley Packet Filters). Cette approche permet de r\u00e9duire consid\u00e9rablement la taille du code de filtrage fonctionnant au niveau du noyau et de transf\u00e9rer toutes les fonctions de parsing des r\u00e8gles et de logique de traitement des protocoles dans l'espace utilisateur.    <\/p>\n<p>Principales modifications :  <\/p>\n<ul>\n<li class=\"l\"> Pour les syst\u00e8mes avec un noyau Linux 6.2 et plus, la prise en charge du mappage des protocoles vxlan, geneve, gre et gretap a \u00e9t\u00e9 ajout\u00e9e, permettant d'utiliser des expressions simples pour v\u00e9rifier les en-t\u00eates des paquets encapsul\u00e9s. Par exemple, pour v\u00e9rifier <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/fr\/lir\/ipv4\/\"   title=\"adresses IP\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"711\">adresses IP<\/a> Dans l'en-t\u00eate d'un paquet encapsul\u00e9 VxLAN, il est maintenant possible d'utiliser des r\u00e8gles (sans avoir \u00e0 d\u00e9faire l'encapsulation de l'en-t\u00eate VxLAN et \u00e0 lier le filtre \u00e0 l'interface vxlan0) :          \u2026 udp dport 4789 vxlan ip protocol udp        \u2026 udp dport 4789 vxlan ip saddr 1.2.3.0\/24        \u2026 udp dport 4789 vxlan ip saddr . vxlan ip daddr { 1.2.3.4 . 4.3.2.1 }\n<li class=\"l\"> La prise en charge de la fusion automatique des restes apr\u00e8s la suppression partielle d'un \u00e9l\u00e9ment de la liste set a \u00e9t\u00e9 mise en \u0153uvre, permettant de supprimer un \u00e9l\u00e9ment ou une partie d'une plage d'existence (auparavant, une plage ne pouvait \u00eatre supprim\u00e9e que dans son int\u00e9gralit\u00e9). Par exemple, apr\u00e8s la suppression de l'\u00e9l\u00e9ment 25 d'une liste set avec des plages 24-30 et 40-50, la liste contiendra 24, 26-30 et 40-50. Les corrections n\u00e9cessaires au fonctionnement de la fusion automatique seront propos\u00e9es dans les versions correctives des branches stables du noyau 5.10+.              # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24-30, 40-50 }            }        }          # nft delete element ip x y { 25 }          # nft list ruleset        table ip x {            set y {                typeof tcp dport                flags interval                auto-merge                elements = { 24, 26-30, 40-50 }            }        }\n<li class=\"l\"> L'utilisation de contact et de plages est autoris\u00e9e lors du mappage de la traduction d'adresses (NAT).      table ip nat {        chain prerouting {            type nat hook prerouting priority dstnat; policy accept;            dnat to ip daddr . tcp dport map { 10.1.1.136 . 80 : 1.1.2.69 . 1024,   10.1.1.10-10.1.1.20 . 8888-8889 : 1.1.2.69 . 2048-2049 } persistent       }    }\n<li class=\"l\"> Ajout de la prise en charge de l'expression \u00ab last \u00bb, permettant de conna\u00eetre le dernier moment d'utilisation d'un \u00e9l\u00e9ment de r\u00e8gle ou d'un ensemble. Cette fonctionnalit\u00e9 est prise en charge depuis le noyau Linux 5.14.        table ip x {        set y {            typeof ip daddr . tcp dport            size 65535            flags dynamic,timeout            last            timeout 1h        }          chain z {            type filter hook output priority filter; policy accept;            update @y { ip daddr . tcp dport }        }    }      # nft list set ip x y    table ip x {        set y {            typeof ip daddr . tcp dport            size 65535            flags dynamic,timeout            last            timeout 1h            elements = { 172.217.17.14 . 443 last used 1s591ms timeout 1h expires 59m58s409ms,                         172.67.69.19 . 443 last used 4s636ms timeout 1h expires 59m55s364ms,                         142.250.201.72 . 443 last used 4s748ms timeout 1h expires 59m55s252ms,                         172.67.70.134 . 443 last used 4s688ms timeout 1h expires 59m55s312ms,                         35.241.9.150 . 443 last used 5s204ms timeout 1h expires 59m54s796ms,                         138.201.122.174 . 443 last used 4s537ms timeout 1h expires 59m55s463ms,                         34.160.144.191 . 443 last used 5s205ms timeout 1h expires 59m54s795ms,                         130.211.23.194 . 443 last used 4s436ms timeout 1h expires 59m55s564ms }           }    }\n<li class=\"l\"> Ajout de la possibilit\u00e9 de d\u00e9finir des quotas dans des ensembles. Par exemple, pour d\u00e9finir un quota de trafic pour chaque adresse IP cible, on peut sp\u00e9cifier :      table netdev x {        set y {            typeof ip daddr            size 65535            quota over 10000 mbytes        }          chain y {            type filter hook egress device \u00ab eth0 \u00bb priority filter; policy accept;            ip daddr @y drop        }    }      # nft add element inet x y { 8.8.8.8 }    # ping -c 2 8.8.8.8       # nft list ruleset    table netdev x {        set y {            type ipv4_addr            size 65535            quota over 10000 mbytes            elements = { 8.8.8.8 quota over 10000 mbytes used 196 bytes }        }          chain y {            type filter hook egress device \u00ab eth0 \u00bb priority filter; policy accept;            ip daddr @y drop        }    }\n<li class=\"l\"> L'utilisation de constantes dans les listes set est autoris\u00e9e. Par exemple, en utilisant l'adresse de destination et l'identifiant VLAN comme cl\u00e9 de liste, on peut directement indiquer le num\u00e9ro VLAN (daddr . 123):          table netdev t {            set s {                typeof ether saddr . vlan id                size 2048                flags dynamic,timeout                timeout 1m            }              chain c {                type filter hook ingress device eth0 priority 0; policy accept;                ether type != 8021q update @s { ether daddr . 123 } counter            }        }\n<li class=\"l\"> Ajout de la nouvelle commande \u00ab destroy \u00bb pour supprimer sans condition des objets (contrairement \u00e0 la commande delete, elle ne g\u00e9n\u00e8re pas ENOENT lors de la tentative de suppression d'un objet manquant). Pour fonctionner, un noyau Linux 6.3-rc au minimum est requis.         destroy table ip filter        <\/ul>\n<p>Source : <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58791\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-107267","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2023-03-14T10:48:14+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2023-03-15T17:12:55+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Sortie du filtre de paquets nftables 1.0.7 | ProHoster","description":"La publication de la version 1.0.7 du filtre de paquets nftables unifie les interfaces de filtrage pour IPv4, IPv6, ARP et les ponts r\u00e9seau (visant \u00e0 remplacer iptables, ip6tables, arptables et ebtables).","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.7, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-7","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2023-03-14T10:48:14+00:00","article:modified_time":"2023-03-15T17:12:55+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"107267","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-02-08 20:24:08","updated":"2026-02-08 20:24:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/107267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=107267"}],"version-history":[{"count":2,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/107267\/revisions"}],"predecessor-version":[{"id":164210,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/107267\/revisions\/164210"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=107267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=107267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=107267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}