{"id":53598,"date":"2019-12-05T00:00:00","date_gmt":"2019-12-04T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/vypusk-paketnogo-filtra-nftables-0-9-3"},"modified":"2020-02-18T14:01:31","modified_gmt":"2020-02-18T11:01:31","slug":"vypusk-paketnogo-filtra-nftables-0-9-3","status":"publish","type":"post","link":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","title":{"rendered":"Rilascio del filtro pacchetti nftables 0.9.3","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=linux-netdev&#038;m=157532146517289&#038;w=2\">Pubblicato<\/a><\/noindex> rilascio del filtro pacchetti <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.3<\/a><\/noindex>, in fase di sviluppo come sostituto di iptables, ip6tables, arptables ed ebtables grazie all'unificazione delle interfacce di filtraggio dei pacchetti per IPv4, IPv6, ARP e ponti di rete. Il pacchetto nftables include componenti del filtro pacchetti che operano nello spazio utente, mentre a livello del kernel il funzionamento \u00e8 assicurato dal sotto-sistema nf_tables, integrato nel kernel Linux a partire dalla versione 3.13. Le modifiche necessarie per il rilascio di nftables 0.9.3 sono incluse nella futura serie del kernel Linux 5.5.<\/p>\n<p>A livello di kernel viene fornito solo un'interfaccia generale, indipendente dal protocollo specifico e che offre funzioni di base per l\u2019estrazione dei dati dai pacchetti, l'esecuzione di operazioni sui dati e la gestione del flusso. La logica di filtraggio e i gestori specifici per i protocolli vengono compilati in bytecode nello spazio utente, dopo di che questo bytecode viene caricato nel kernel attraverso l'interfaccia Netlink ed eseguito in una speciale macchina virtuale simile ai BPF (Berkeley Packet Filters). Questo approccio consente di ridurre significativamente la dimensione del codice di filtraggio che opera a livello di kernel e di spostare tutte le funzioni di analisi delle regole e logiche di gestione dei protocolli nello spazio utente.<\/p>\n<p>Novit\u00e0 principali:<\/p>\n<ul>\n<li class=\"l\"> Supporto per l'abbinamento dei pacchetti in base al tempo. \u00c8 possibile definire sia gli intervalli di tempo e le date in cui verr\u00e0 attivata la regola, sia configurare attivazioni in giorni specifici della settimana. \u00c8 stata inoltre aggiunta una nuova opzione \u2018-T\u2019 per l'output del tempo epoch in secondi.\n<p>     meta time '2019-12-24 16:00' \u2014 '2020-01-02 7:00'<br \/>\n     meta hour '17:00' \u2014 '19:00'<br \/>\n     meta day 'Fri'<\/p>\n<li class=\"l\"> Supporto per il recupero e il salvataggio delle etichette SELinux (secmark).\n<p>     ct secmark set meta secmark<br \/>\n     meta secmark set ct secmark<\/p>\n<li class=\"l\"> Supporto per le liste map synproxy, che consentono di definire pi\u00f9 di una regola per il backend.\n<p>    table ip foo {<br \/>\n            synproxy https-synproxy {<br \/>\n                    mss 1460<br \/>\n                    wscale 7<br \/>\n                    timestamp sack-perm<br \/>\n            }<\/p>\n<p>            synproxy other-synproxy {<br \/>\n                    mss 1460<br \/>\n                    wscale 5<br \/>\n            }<\/p>\n<p>            chain pre {<br \/>\n                    type filter hook prerouting priority raw; policy accept;<br \/>\n                    tcp dport 8888 tcp flags syn notrack<br \/>\n            }<\/p>\n<p>            chain bar {<br \/>\n                    type filter hook forward priority filter; policy accept;<br \/>\n                    ct state invalid, untracked synproxy name ip saddr map { 192.168.1.0\/24 : 'https-synproxy', 192.168.2.0\/24 : 'other-synproxy' }<br \/>\n            }<br \/>\n     }<\/p>\n<li class=\"l\"> Possibilit\u00e0 di rimuovere dinamicamente elementi dai set di regole per l'elaborazione dei pacchetti.\n<p>     nft add rule \u2026 delete @set5 { ip6 saddr . ip6 daddr }<\/p>\n<li class=\"l\"> Supporto per il confronto VLAN in base all'identificatore e al protocollo, definiti nei metadati dell'interfaccia del ponte di rete;\n<p>        meta ibrpvid 100<br \/>\n        meta ibrvproto vlan<\/p>\n<li class=\"l\"> L'opzione \u2018-t\u2019 (\u2018--terse\u2019) per escludere gli elementi dei set durante la visualizzazione delle regole. Quando si esegue \u2018nft -t list ruleset\u2019 verr\u00e0 visualizzato:\n<p>    tabella ip x {<br \/>\n        set y {<br \/>\n                tipo ipv4_addr<br \/>\n        }<br \/>\n    }<\/p>\n<p>E quando si esegue \u2018nft list ruleset\u2019<\/p>\n<p>    tabella ip x {<br \/>\n        set y {<br \/>\n                tipo ipv4_addr<br \/>\n                elementi = { 192.168.10.2, 192.168.20.1,<br \/>\n                             192.168.4.4, 192.168.2.34 }<br \/>\n        }<br \/>\n    }<\/p>\n<li class=\"l\"> Possibilit\u00e0 di specificare pi\u00f9 di un dispositivo nelle catene netdev (funziona solo con il kernel 5.5) per unire regole di filtraggio standard.\n<p>     aggiungi tabella netdev x<br \/>\n     add chain netdev x y {<br \/>\n        tipo filtro gancio ingress dispositivi = { eth0, eth1 } priorit\u00e0 0;<br \/>\n     }<\/p>\n<li class=\"l\"> Possibilit\u00e0 di aggiungere descrizioni ai tipi di dati.\n<p>    # nft describe ipv4_addr<br \/>\n    datatype ipv4_addr (indirizzo IPv4) (basetype integer), 32 bit<\/p>\n<li class=\"l\"> Possibilit\u00e0 di costruire l'interfaccia CLI con la libreria linenoise invece di libreadline.\n<p>     .\/configure \u2014with-cli=linenoise<\/p>\n<\/ul>\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Fonte: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=51980\">opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-53598","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"it_IT\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-12-04T21:00:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-02-18T11:01:31+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Rilascio del pacchetto di filtraggio nftables 0.9.3 | ProHoster","description":"Rilasciato il pacchetto di filtraggio","canonical_url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"it_IT","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.3 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/it\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-3","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-04T21:00:00+00:00","article:modified_time":"2020-02-18T11:01:31+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"53598","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 08:02:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:22:49","updated":"2026-01-24 08:02:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/53598","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/comments?post=53598"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/posts\/53598\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/media?parent=53598"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/categories?post=53598"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/it\/wp-json\/wp\/v2\/tags?post=53598"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}