E wepụtala nftables 1.0.1, usoro nzacha ngwugwu nke na-ejikọta njikọ nzacha ngwugwu maka IPv4, IPv6, ARP, na àkwà mmiri netwọk (a na-elekwasị anya dị ka nnọchi maka iptables, ip6table, arptables, na ebtables). A tinyela mgbanwe ndị achọrọ maka nftables 1.0.1 n'ime kernel. Linux 5.16-rc1.
Ngwugwu nftables nwere ihe nzacha ngwugwu nke na-arụ ọrụ n'ime oghere onye ọrụ, ebe sistemụ nf_tables, nke bụ akụkụ nke kernel, na-enye ọrụ ọkwa kernel. Linux Kemgbe mwepụta 3.13, naanị njikọ na-adabereghị na protocol ka enyere na ọkwa kernel, na-enye ọrụ bụ isi maka iwepụta data site na ngwugwu, ịrụ ọrụ data, na njikwa mmiri.
Nchịkọta nzacha ahụ na-achịkwa onwe ha, a na-achịkọtakwa ndị njikwa kpọmkwem na protocol n'ime bytecode na oghere onye ọrụ, mgbe nke ahụ gasịrị, a na-ebunye bytecode a n'ime kernel site na iji Netlink interface ma rụọ ya na kernel n'ụzọ pụrụ iche. igwe mebere, nke na-echetara BPF (Berkeley Packet Filters). Ụzọ a na-enye ohere maka mbelata dị ukwuu na nha nke koodu nzacha na-agba ọsọ na ọkwa kernel ma na-ebugharị nkọwa iwu niile na usoro nhazi n'ime oghere onye ọrụ.
Isi ihe ọhụrụ:
- Ewelatala oriri ebe nchekwa mgbe ị na-ebu nnukwu set na ndepụta maapụ.
- Ekwalitela ndetu nhazi na eserese ngosi maapụ ngwa ngwa.
- Mwepụta nke tebụl ahọpụtara na agbụ na nnukwu usoro iwu ka emelitere ngwa ngwa. Dịka ọmụmaatụ, oge mmebe nke iwu "nft list lawset" iji gosipụta usoro iwu na 100 puku ahịrị bụ 3.049 sekọnd, na mgbe ị na-emepụta naanị tebụl nat na filter ("nft list table nat", "nft list table filter" ”) na-ebelata ka 1.969 na 0.697 sekọnd.
- Mmezu nke ajụjụ na nhọrọ “--terse” agbagoro ngwa ngwa mgbe ị na-ahazi iwu nwere nnukwu set- na ndepụta maapụ.
- Ọ ga-ekwe omume nzacha okporo ụzọ site na agbụ "egress", nke a na-edozi n'otu ọkwa ahụ dị ka onye na-ahụ maka egress na netdev chain (egress hook), i.e. na ogbo mgbe onye ọkwọ ụgbọala na-anata ngwugwu site na kernel netwọk tojupụtara. table netdev filter { yinye egress {ụdị nzacha nko egress ngwaọrụ = {eth0, eth1 } mkpa 0; meta priorit set ip saddr map {192.168.10.2: abcd:2, 192.168.10.3: abcd:3}}}
- Na-enye ohere ndakọrịta na ngbanwe nke bytes na nkụnye eji isi mee na ọdịnaya nke ngwugwu na nkwụghachi enyere. # nft tinye iwu xy @ih,32,32 0x14000000 counter # nft tinye iwu xy @ih,32,32 set 0x14000000 counter
isi: opennet.ru
