{"id":53598,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-paketnogo-filtra-nftables-0-9-3"},"modified":"2020-02-18T14:01:31","modified_gmt":"2020-02-18T11:01:31","slug":"vypusk-paketnogo-filtra-nftables-0-9-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","title":{"rendered":"Sortie du filtre de paquets nftables 0.9.3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=linux-netdev&#038;m=157532146517289&#038;w=2\">Publi\u00e9<\/a><\/noindex> publication du filtre de paquets <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.3<\/a><\/noindex>, se d\u00e9veloppant comme un remplacement d'iptables, ip6table, arptables et ebtables gr\u00e2ce \u00e0 l'unification des interfaces de filtrage de paquets pour IPv4, IPv6, ARP et les ponts r\u00e9seau. Le paquet nftables comprend des composants de filtre de paquets fonctionnant en espace utilisateur, tandis qu'au niveau du noyau, le syst\u00e8me nf_tables, qui fait partie du noyau Linux depuis la version 3.13, assure la fonctionnalit\u00e9. Les modifications n\u00e9cessaires au fonctionnement de la version nftables 0.9.3 sont incluses dans la future branche du noyau Linux 5.5.<\/p>\n<p>Au niveau du noyau, seule une interface g\u00e9n\u00e9rale, ind\u00e9pendante du protocole sp\u00e9cifique, est fournie, offrant des fonctions de base pour l'extraction de donn\u00e9es \u00e0 partir de paquets, l'ex\u00e9cution d'op\u00e9rations sur les donn\u00e9es et la gestion du flux. La logique de filtrage et les gestionnaires sp\u00e9cifiques aux protocoles sont compil\u00e9s en bytecode en espace utilisateur, apr\u00e8s quoi ce bytecode est charg\u00e9 dans le noyau via l'interface Netlink et ex\u00e9cut\u00e9 dans une machine virtuelle sp\u00e9ciale, similaire \u00e0 BPF (Berkeley Packet Filters). Cette approche permet de r\u00e9duire consid\u00e9rablement la taille du code de filtrage qui fonctionne au niveau du noyau et d'externaliser toutes les fonctions d'analyse des r\u00e8gles et de logique de travail avec les protocoles en espace utilisateur.<\/p>\n<p>Les principales nouveaut\u00e9s :<\/p>\n<ul>\n<li class=\"l\"> Support de la correspondance des paquets par heure. Il est possible de d\u00e9finir \u00e0 la fois des plages horaires et des dates pendant lesquelles la r\u00e8gle s'appliquera, ainsi que de programmer son activation certains jours de la semaine. Une nouvelle option \u00ab -T \u00bb a \u00e9galement \u00e9t\u00e9 ajout\u00e9e pour afficher le temps \u00e9pocal en secondes.\n<p>     meta time  \u2014<br \/>\n     meta hour  \u2014<br \/>\n     meta day<\/p>\n<li class=\"l\"> Prise en charge de la r\u00e9cup\u00e9ration et de la sauvegarde des marques SELinux (secmark).\n<p>     ct secmark set meta secmark<br \/>\n     meta secmark set ct secmark<\/p>\n<li class=\"l\"> Prise en charge des listes de mappage synproxy, permettant de d\u00e9finir plus d'une r\u00e8gle sur le backend.\n<p>    table ip foo {<br \/>\n            synproxy https-synproxy {<br \/>\n                    mss 1460<br \/>\n                    wscale 7<br \/>\n                    timestamp sack-perm<br \/>\n            }<\/p>\n<p>            synproxy other-synproxy {<br \/>\n                    mss 1460<br \/>\n                    wscale 5<br \/>\n            }<\/p>\n<p>            chain pre {<br \/>\n                    type filter hook prerouting priority raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            chain bar {<br \/>\n                    type filter hook forward priority filter; policy accept;<br \/>\n                    ct state invalid, untracked synproxy name ip saddr map { 192.168.1.0\/24 : \u00ab https-synproxy \u00bb, 192.168.2.0\/24 : \u00ab other-synproxy \u00bb }<br \/>\n            }<br \/>\n     }<\/p>\n<li class=\"l\"> Capacit\u00e9 \u00e0 supprimer dynamiquement des \u00e9l\u00e9ments des ensembles set des r\u00e8gles de traitement des paquets.\n<p>     nft add rule \u2026 delete @set5 { ip6 saddr . ip6 daddr }<\/p>\n<li class=\"l\"> Prise en charge de la correspondance VLAN par identifiant et protocole, d\u00e9finis dans les m\u00e9tadonn\u00e9es de l'interface de pont r\u00e9seau;\n<p>        meta ibrpvid 100<br \/>\n        meta ibrvproto vlan<\/p>\n<li class=\"l\"> L'option \u00ab -t \u00bb (\u00ab --terse \u00bb) pour exclure les \u00e9l\u00e9ments des ensembles lors de l'affichage des r\u00e8gles. Lorsque vous ex\u00e9cutez \u00ab nft -t list ruleset \u00bb, il sera affich\u00e9 :\n<p>    table ip x {<br \/>\n        set y {<br \/>\n                type ipv4_addr<br \/>\n        }<br \/>\n    }<\/p>\n<p>Et avec \u00ab nft list ruleset \u00bb<\/p>\n<p>    table ip x {<br \/>\n        set y {<br \/>\n                type ipv4_addr<br \/>\n                elements = { 192.168.10.2, 192.168.20.1,<br \/>\n                             192.168.4.4, 192.168.2.34 }<br \/>\n        }<br \/>\n    }<\/p>\n<li class=\"l\"> Possibilit\u00e9 de sp\u00e9cifier plusieurs dispositifs dans les cha\u00eenes netdev (fonctionne uniquement avec le noyau 5.5) pour combiner des r\u00e8gles de filtrage standard.\n<p>     add table netdev x<br \/>\n     add chain netdev x y { &lt;<br \/>\n        type filter hook ingress devices = { eth0, eth1 } priority 0;<br \/>\n     }<\/p>\n<li class=\"l\"> Possibilit\u00e9 d'ajouter des descriptions de types de donn\u00e9es.\n<p>    # nft describe ipv4_addr<br \/>\n    datatype ipv4_addr (adresse IPv4) (type de base integer), 32 bits<\/p>\n<li class=\"l\"> Possibilit\u00e9 de construire une interface CLI avec la biblioth\u00e8que linenoise au lieu de libreadline.\n<p>     .\/configure \u2014with-cli=linenoise<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Source : <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51980\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53598","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"fr_FR\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:31+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Version du filtre de paquets nftables 0.9.3 | ProHoster","description":"Publication de la version du filtre de paquets","canonical_url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"fr_FR","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/fr\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53598","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:02:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:49","updated":"2026-01-24 08:02:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/53598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/comments?post=53598"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/posts\/53598\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/media?parent=53598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/categories?post=53598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/fr\/wp-json\/wp\/v2\/tags?post=53598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}