{"id":100285,"date":"2021-05-26T10:22:54","date_gmt":"2021-05-26T08:22:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-0-9-9"},"modified":"2021-05-26T10:22:54","modified_gmt":"2021-05-26T08:22:54","slug":"vypusk-paketnogo-filtra-nftables-0-9-9","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9","title":{"rendered":"Lansarea filtrului de pachete nftables 0.9.9","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A fost lansat\u0103 versiunea 0.9.9 a filtrului de pachete nftables, care unific\u0103 interfe\u021bele de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i pun\u021bile de re\u021bea (destinat\u0103 \u00eenlocuirii iptables, ip6tables, arptables \u0219i ebtables). Simultan, a fost lansat\u0103 versiunea 1.2.0 a bibliotecii asociate libnftnl, care ofer\u0103 un API de nivel sc\u0103zut pentru interac\u021biunea cu subsistemul nf_tables. Modific\u0103rile necesare pentru func\u021bionarea versiunii nftables 0.9.9 sunt incluse \u00een nucleul Linux 5.13-rc1.          <\/p>\n<p>Pachetul nftables include componente ale filtrului de pachete care func\u021bioneaz\u0103 \u00een spa\u021biul utilizatorului, \u00een timp ce, la nivel de nucleu, func\u021bionarea este asigurat\u0103 de subsistemul nf_tables, parte a nucleului Linux \u00eencep\u00e2nd cu versiunea 3.13. La nivel de nucleu se ofer\u0103 doar o interfa\u021b\u0103 general\u0103, independent\u0103 de protocolul specific, care asigur\u0103 func\u021bii de baz\u0103 pentru extragerea datelor din pachete, executarea opera\u021biunilor cu datele \u0219i gestionarea fluxului.    <\/p>\n<p>Regulile de filtrare \u0219i handler-ii specifici pentru protocoale sunt compilate \u00een bytecode \u00een spa\u021biul utilizatorului, dup\u0103 care acest bytecode este \u00eenc\u0103rcat \u00een nucleu prin intermediul interfe\u021bei Netlink \u0219i executat \u00een nucleu \u00eentr-un mod special <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/vps\/abuzoustojchivye-vps\/\"   title=\"ma\u0219ina virtual\u0103\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4310\">ma\u0219ina virtual\u0103<\/a>, similar cu BPF (Berkeley Packet Filters). Aceast\u0103 abordare permite reducerea semnificativ\u0103 a dimensiunii codului de filtrare care func\u021bioneaz\u0103 la nivel de nucleu \u0219i mutarea tuturor func\u021biilor de analiz\u0103 a regulilor \u0219i logica de func\u021bionare cu protocoalele \u00een spa\u021biul utilizatorului.    <\/p>\n<p>Nout\u0103\u021bi principale:  <\/p>\n<ul>\n<li class=\"l\"> A fost implementat\u0103 capacitatea de a muta procesarea flowtable pe partea adaptorului de re\u021bea, activat\u0103 printr-un flag &#8216;offload&#8217;. Flowtable reprezint\u0103 un mecanism de optimizare a rutei de redirec\u021bionare a pachetelor, \u00een care trecerea complet\u0103 prin toate lan\u021burile de procesare a regulilor se aplic\u0103 doar pentru primul pachet, iar toate celelalte pachete din flux sunt redirec\u021bionate direct.        table ip global {              flowtable f {                      hook ingress priority filter + 1                      devices = { lan3, lan0, wan }                      flags offload              }                chain forward {                      type filter hook forward priority filter; policy accept;                      ip protocol { tcp, udp } flow add @f              }                chain post {                      type nat hook postrouting priority filter; policy accept;                      oifname &#171;wan&#187; masquerade              }      }\n<li class=\"l\"> A fost ad\u0103ugat\u0103 suportul pentru ata\u0219area unui flag la tabel pentru a se lega de proprietar, ceea ce permite utilizarea exclusiv\u0103 a tabelului de c\u0103tre proces. La terminarea procesului, tabelul ata\u0219at este automat \u0219ters. Informa\u021bia despre proces apare \u00een dump-ul regulilor sub form\u0103 de comentariu:          table ip x { # progname nft              flags owner                chain y {                      type filter hook input priority filter; policy accept;                      counter packets 1 bytes 309              }      }\n<li class=\"l\"> A fost ad\u0103ugat\u0103 suportul pentru specifica\u021bia IEEE 802.1ad (VLAN stacking sau QinQ), care define\u0219te mijloacele de a \u00eenlocui mai multe etichete VLAN \u00eentr-un singur cadru Ethernet. De exemplu, pentru a verifica tipul cadrului Ethernet extern 8021ad \u0219i vlan id=342, se poate folosi construc\u021bia        &#8230; ether type 802.1ad vlan id 342      pentru a verifica tipul externului Ethernet-cadru 8021ad\/vlan id=1, \u00eenv\u0103luit \u00een 802.1q\/vlan id=2 \u0219i pentru a continua incapsularea pachetului IP:         &#8230; ether type 802.1ad vlan id 1 vlan type 8021q vlan id 2 vlan type ip counter\n<li class=\"l\"> A fost ad\u0103ugat suport pentru gestionarea resurselor prin intermediul ierarhiei unificate cgroups v2. Principala diferen\u021b\u0103 \u00eentre cgroups v2 \u0219i v1 este utilizarea unei ierarhii comune de cgroups pentru toate tipurile de resurse, \u00een loc de ierahii separate pentru distribuirea resurselor CPU, pentru reglementarea consumului de memorie \u0219i pentru intrare\/ie\u0219ire.  De exemplu, pentru a verifica dac\u0103 p\u0103rintele socket-ului la primul nivel cgroupv2 corespunde m\u0103\u0219tii &#171;system.slice&#187;, se poate folosi construc\u021bia:       &#8230; socket cgroupv2 level 1 &#171;system.slice&#187;\n<li class=\"l\"> A fost ad\u0103ugat\u0103 capacitatea de a verifica componentele pachetelor SCTP (func\u021bionalitatea necesar\u0103 va ap\u0103rea \u00een kernel-ul Linux 5.14). De exemplu, pentru a verifica existen\u021ba unui chunk de tip &#8216;data&#8217; \u00een pachet \u0219i c\u00e2mpul &#8216;type&#8217;:       &#8230; sctp chunk data exists    &#8230; sctp chunk data type 0\n<li class=\"l\"> Execu\u021bia opera\u021biunii de \u00eenc\u0103rcare a regulilor a fost accelerat\u0103 de aproximativ dou\u0103 ori folosind flag-ul &#171;-f&#187;. De asemenea, s-a accelerat generarea listei de reguli.\n<li class=\"l\"> A fost furnizat\u0103 o form\u0103 compact\u0103 de verificare a set\u0103rii bi\u021bilor \u00een steaguri. De exemplu, pentru a verifica c\u0103 bi\u021bii st\u0103rii snat \u0219i dnat nu sunt seta\u021bi, se poate specifica: ... ct status ! snat,dnat pentru a verifica c\u0103 bitul syn este setat \u00een masca de bi\u021bi syn,ack: ... tcp flags syn \/ syn,ack pentru a verifica c\u0103 bi\u021bii fin \u0219i rst nu sunt seta\u021bi \u00een masca de bi\u021bi syn,ack,fin,rst: ... tcp flags != fin,rst \/ syn,ack,fin,rst\n<li class=\"l\"> Este permis\u0103 utilizarea cuv\u00e2ntului cheie \u00abverdict\u00bb \u00een defini\u021biile typeof pentru set\/map: add map x m { typeof iifname . ip protocol . th dport : verdict;}    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=55214\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041e\u0434\u043d\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u0441\u043e\u043f\u0443\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u0439 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0438 libnftnl 1.2.0, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044e\u0449\u0435\u0439 \u043d\u0438\u0437\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u044b\u0439 API \u0434\u043b\u044f \u0432\u0437\u0430\u0438\u043c\u043e\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f \u0441 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 nf_tables. \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u0443\u0441\u043a\u0430 nftables 0.9.9 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.13-rc1. \u0412 \u043f\u0430\u043a\u0435\u0442 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-100285","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2021-05-26T08:22:54+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2021-05-26T08:22:54+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Versiunea 0.9.9 a filtrului de pachete nftables | ProHoster","description":"A fost publicat\u0103 versiunea 0.9.9 a filtrului de pachete nftables, unific\u00e2nd interfe\u021bele de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i pun\u021bi de re\u021bea (destinat \u00eenlocuirii iptables, ip6tables, arptables \u0219i ebtables).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.9, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-9","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2021-05-26T08:22:54+00:00","article:modified_time":"2021-05-26T08:22:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"100285","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-05-26 08:38:02","updated":"2022-10-04 04:29:06","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100285","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=100285"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100285\/revisions"}],"predecessor-version":[{"id":164185,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/100285\/revisions\/164185"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=100285"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=100285"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=100285"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}