ProHoster > Π‘Π»ΠΎΠ³ > warta internet > nftables packet filter 1.0.0 release

nftables packet filter 1.0.0 release

Rilis packet filter nftables 1.0.0 wis diterbitake, nyawiji antarmuka panyaring paket kanggo IPv4, IPv6, ARP lan jembatan jaringan (kanggo ngganti iptables, ip6table, arptables lan ebtables). Owah-owahan sing dibutuhake kanggo rilis nftables 1.0.0 supaya bisa digunakake kalebu ing kernel Linux 5.13. Owah-owahan wujud ing nomer versi ora digandhengake karo owah-owahan dhasar, nanging mung minangka akibat saka terusan konsisten nomer ing notasi desimal (release sadurungΓ© 0.9.9).

Paket nftables kalebu komponen filter paket sing mlaku ing ruang pangguna, dene karya tingkat kernel diwenehake dening subsistem nf_tables, sing wis dadi bagian saka kernel Linux wiwit dirilis 3.13. Tingkat kernel mung nyedhiyakake antarmuka bebas protokol umum sing nyedhiyakake fungsi dhasar kanggo ngekstrak data saka paket, nindakake operasi data, lan kontrol aliran.

Aturan nyaring dhewe lan panangan khusus protokol dikompilasi menyang bytecode spasi pangguna, sawise bytecode iki dimuat menyang kernel nggunakake antarmuka Netlink lan dieksekusi ing kernel ing mesin virtual khusus sing meh padha karo BPF (Berkeley Packet Filters). Pendekatan iki ndadekake bisa nyuda ukuran kode nyaring sing mlaku ing tingkat kernel lan mindhah kabeh fungsi aturan parsing lan logika nggarap protokol menyang ruang pangguna.

Inovasi utama:

  • Dhukungan kanggo unsur topeng "*" wis ditambahake kanggo nyetel dhaftar, kang micu kanggo sembarang paket sing ora tiba ing unsur liyane ditetepake ing pesawat. tabel x {map blocklist {jinis ipv4_addr: putusan gendera unsur interval = {192.168.0.0/16: nampa, 10.0.0.0/8: nampa, *: nyelehake}} chain y {jinis Filter pancing prerouting prioritas 0; kawicaksanan nampa; ip saddr vmap @blocklist } }
  • Sampeyan bisa nemtokake variabel saka baris printah nggunakake pilihan "--define". # cat test.nft table netdev x { chain y { type filter hook ingress devices = $ dev priority 0; kawicaksanan mudhun; } } # nft β€”define dev="{ eth0, eth1}" -f test.nft
  • Ing dhaptar peta, panggunaan ekspresi konstan (stateful) diidini: filter inet tabel {map portmap {tipe inet_service: elemen counter putusan = {22 paket counter 0 byte 0: mlumpat ssh_input, * paket counter 0 byte 0: drop}} chain ssh_input {} chain wan_input {tcp dport vmap @portmap } chain prerouting {type filter hook prerouting priority raw; kawicaksanan nampa; iif vmap {"lo": mlumpat wan_input}}}
  • Nambahake printah "dhaftar pancing" kanggo nampilake dhaptar panangan kanggo kulawarga paket sing diwenehake: # nft dhaptar pancing ip piranti eth0 kulawarga ip {pancing ingress {+0000000010 chain netdev xy [nf_tables] +0000000300 chain inet mw [nf_tables] } pancing input {-0000000100 chain ip ab [nf_tables] +0000000300 chain inet mz [nf_tables] } hook forward {-0000000225 selinux_ipv4_forward 0000000000 chain ip ac [nf_tables] 0000000225 selinux_ipv4_forward 0000000225 selinux_ipv4_forward pancing postrouting { +XNUMX XNUMX selinux_ipvXNUMX_postroute } }
  • Blok antrian ngidini ekspresi jhash, symhash, lan numgen digabungake kanggo nyebarake paket menyang antrian ing ruang pangguna. … antrian menyang symhash mod 65536 … antrian flag bypass menyang numgen inc mod 65536 … antrian menyang jhash oif . meta tandha mod 32 "Antrian" uga bisa digabungake karo dhaptar peta kanggo milih antrian ing papan pangguna adhedhasar tombol kasepakatan. ... antrian flag bypass menyang oifname map { "eth0" : 0, "ppp0" : 2, "eth1" : 2 }
  • Sampeyan bisa nggedhekake variabel sing kalebu dhaptar set menyang sawetara peta. nemtokake antarmuka = ​​{ eth0, eth1 } tabel ip x { chain y { jinis filter pancing prioritas input 0; kawicaksanan nampa; iifname vmap {lo: nampa, $ antarmuka: nyelehake}}}} # nft -f x.nft # nft dhaftar ruleset tabel ip x { chain y {jinis filter pancing prioritas input 0; kawicaksanan nampa; iifname vmap {"lo": accept, "eth0": drop, "eth1": drop}}}
  • Nggabungke vmaps (peta putusan) ing interval diijini: # nft nambah aturan xy tcp dport. ip saddr vmap { 1025-65535 . 192.168.10.2 : nampa }
  • Sintaks sing disederhanakake kanggo pemetaan NAT. Diijini kanggo nemtokake kisaran alamat: ... snat to ip saddr map { 10.141.11.4 : 192.168.2.2-192.168.2.4 } utawa alamat IP eksplisit lan port: ... dnat to ip saddr map { 10.141.11.4. . 192.168.2.3 } utawa kombinasi kisaran IP lan port: ... dnat to ip saddr . peta tcp dport { 80 . 192.168.1.2: 80-10.141.10.2. 10.141.10.5-8888 }

Source: opennet.ru

Add a comment