An fitar da nftables 1.0.1, tsarin tace fakiti wanda ke haɗa hanyoyin tace fakiti don IPv4, IPv6, ARP, da gadojin sadarwa (wanda aka yi niyya a matsayin madadin iptables, ip6table, arptables, da ebtables). An haɗa canje-canjen da ake buƙata don nftables 1.0.1 cikin kernel. Linux 5.16-rc1.
Kunshin nftables ya ƙunshi abubuwan tace fakiti waɗanda ke aiki a cikin sararin mai amfani, yayin da aikin matakin kernel ke samar da shi ta hanyar tsarin nf_tables, wanda yake ɓangare na kernel. Linux Tun daga fitowar 3.13, hanyar sadarwa mai zaman kanta ta hanyar yarjejeniya ce kawai aka samar a matakin kernel, wanda ke ba da ayyuka na asali don cire bayanai daga fakiti, gudanar da ayyukan bayanai, da kuma sarrafa kwararar bayanai.
Tacewar tana da dokoki da kansu kuma ana tattara masu sarrafa takamaiman yarjejeniya zuwa bytecode a cikin sararin mai amfani, bayan haka ana ɗora wannan bytecode a cikin kernel ta amfani da hanyar haɗin Netlink kuma ana aiwatar da shi a cikin kernel a cikin wani tsari na musamman. injin kama-da-wane, wanda ke kama da BPF (Berkeley Packet Filters). Wannan hanyar tana ba da damar rage girman lambar tacewa da ke gudana a matakin kernel kuma tana motsa duk nazarin dokoki da dabaru na yarjejeniya zuwa sararin mai amfani.
Manyan sabbin abubuwa:
- Rage yawan žwažwalwar ajiya lokacin loda manyan saiti da lissafin taswira.
- An sake shigar da saiti da lissafin taswira.
- An haɓaka fitar da zaɓaɓɓun tebur da sarƙoƙi a cikin manyan saitin ƙa'ida. Misali, lokacin aiwatar da umarnin “nft list ruleset” don nuna saitin dokoki tare da layuka dubu 100 shine 3.049 seconds, kuma lokacin fitar da kawai nat da tebur tebur (“nft list table nat”, “Nft list table filter). ”) an rage shi zuwa 1.969 da 0.697 seconds.
- An ƙaddamar da aiwatar da tambayoyin tare da zaɓin "--terse" yayin aiwatar da dokoki tare da manyan saiti- da lissafin taswira.
- Yana yiwuwa a tace zirga-zirga daga sarkar "egress", wanda aka sarrafa a daidai matakin da mai sarrafa egress a cikin sarkar netdev (egress hook), watau. a matakin lokacin da direba ya karɓi fakiti daga kernel network stack. tebur netdev tace {sarkar egress {nau'in tace ƙugiya egress na'urorin = {eth0, eth1 } fifiko 0; meta fifiko saita ip saddr taswirar {192.168.10.2: abcd:2, 192.168.10.3: abcd:3}}}
- Yana ba da damar daidaitawa da gyaggyarawa na bytes a cikin rubutun kai da abun ciki na fakiti a lokacin da aka bayar. # nft ƙara mulki xy @ih,32,32 0x14000000 counter # nft ƙara mulkin xy @ih,32,32 saita 0x14000000 counter
source: budenet.ru
