{"id":103407,"date":"2022-02-22T03:36:42","date_gmt":"2022-02-22T01:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-2"},"modified":"2022-02-22T03:36:42","modified_gmt":"2022-02-22T01:36:42","slug":"vypusk-paketnogo-filtra-nftables-1-0-2","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","title":{"rendered":"Lansarea filtrului de pachete nftables 1.0.2","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A fost publicat\u0103 versiunea 1.0.2 a filtrului de pachete nftables, care unific\u0103 interfe\u021bele de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i pun\u021bi de re\u021bea (destinat\u0103 s\u0103 \u00eenlocuiasc\u0103 iptables, ip6tables, arptables \u0219i ebtables). Modific\u0103rile necesare pentru func\u021bionarea versiunii 1.0.2 a nftables sunt incluse \u00een nucleul Linux 5.17-rc.      <\/p>\n<p>Pachetul nftables include componente ale filtrului de pachete care func\u021bioneaz\u0103 \u00een spa\u021biul utilizatorului, \u00een timp ce, la nivel de nucleu, func\u021bionarea este asigurat\u0103 de subsistemul nf_tables, parte a nucleului Linux \u00eencep\u00e2nd cu versiunea 3.13. La nivel de nucleu se ofer\u0103 doar o interfa\u021b\u0103 general\u0103, independent\u0103 de protocolul specific, care asigur\u0103 func\u021bii de baz\u0103 pentru extragerea datelor din pachete, executarea opera\u021biunilor cu datele \u0219i gestionarea fluxului.    <\/p>\n<p>Regulile de filtrare \u0219i handler-ii specifici pentru protocoale sunt compilate \u00een bytecode \u00een spa\u021biul utilizatorului, dup\u0103 care acest bytecode este \u00eenc\u0103rcat \u00een nucleu prin intermediul interfe\u021bei Netlink \u0219i executat \u00een nucleu \u00eentr-un mod special <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/vps\/abuzoustojchivye-vps\/\"   title=\"ma\u0219ina virtual\u0103\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4319\">ma\u0219ina virtual\u0103<\/a>, similar cu BPF (Berkeley Packet Filters). Aceast\u0103 abordare permite reducerea semnificativ\u0103 a dimensiunii codului de filtrare care func\u021bioneaz\u0103 la nivel de nucleu \u0219i mutarea tuturor func\u021biilor de analiz\u0103 a regulilor \u0219i logica de func\u021bionare cu protocoalele \u00een spa\u021biul utilizatorului.    <\/p>\n<p>Nout\u0103\u021bi principale:  <\/p>\n<ul>\n<li class=\"l\"> A fost ad\u0103ugat\u0103 o op\u021biune de optimizare a regulilor, care poate fi activat\u0103 prin noua op\u021biune &#171;-o&#187; (&#171;&#8212;optimize&#187;), ce poate fi combinat\u0103 cu op\u021biunea &#171;&#8212;check&#187; pentru a verifica \u0219i optimiza modific\u0103rile din fi\u0219ierul cu setul de reguli f\u0103r\u0103 a-l \u00eenc\u0103rca efectiv. Optimizarea permite combinarea regulilor similare, de exemplu, regulile:          meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept        meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.5 accept        ip saddr 1.1.1.1 ip daddr 2.2.2.2 accept        ip saddr 2.2.2.2 ip daddr 3.3.3.3 drop\n<p>vor fi combinate \u00een           meta iifname . ip saddr . ip daddr { eth1 . 1.1.1.1 . 2.2.2.3, eth1 .   1.1.1.2 . 2.2.2.5 } accept        ip saddr . ip daddr vmap { 1.1.1.1 . 2.2.2.2 : accept, 2.2.2.2 . 3.3.3.3   : drop }    <\/p>\n<p>Exemplu de utilizare:       # nft -c -o -f ruleset.test     Fuziune:       ruleset.nft:16:3-37:  ip daddr 192.168.0.1 counter accept       ruleset.nft:17:3-37:  ip daddr 192.168.0.2 counter accept       ruleset.nft:18:3-37:  ip daddr 192.168.0.3 counter accept     \u00een:       ip daddr { 192.168.0.1, 192.168.0.2, 192.168.0.3 } counter packets 0 bytes 0 accept      <\/p>\n<li class=\"l\"> \u00cen listele set-urilor a fost implementat\u0103 posibilitatea de a specifica op\u021biuni ip \u0219i tcp, precum \u0219i chunk-uri sctp:            set s5 {                 typeof ip option ra value                 elements = { 1, 1024 }          }            set s7 {                 typeof sctp chunk init num-inbound-streams                 elements = { 1, 4 }          }            chain c5 {                 ip option ra value @s5 accept          }            chain c7 {                 sctp chunk init num-inbound-streams @s7 accept          }\n<li class=\"l\"> A fost ad\u0103ugat\u0103 suport pentru op\u021biunile TCP fastopen, md5sig \u0219i mptcp.\n<li class=\"l\"> A fost ad\u0103ugat\u0103 suport pentru utilizarea subtipului mp-tcp \u00een potriviri:            tcp option mptcp subtype 1\n<li class=\"l\"> Codul de filtrare, care func\u021bioneaz\u0103 la nivelul nucleului, a fost \u00eembun\u0103t\u0103\u021bit.\n<li class=\"l\"> Pentru flowtable a fost implementat suport complet pentru formatul JSON.\n<li class=\"l\"> A fost oferit\u0103 posibilitatea de a utiliza ac\u021biunea &#171;reject&#187; \u00een opera\u021biunile de potrivire a cadrelor Ethernet.            ether saddr aa:bb:cc:dd:ee:ff ip daddr 192.168.0.1 reject      <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=56739\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u041d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u0440\u0430\u0431\u043e\u0442\u044b \u0432\u044b\u043f\u0443\u0441\u043a\u0430 nftables 1.0.2 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux 5.17-rc. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-103407","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-02-22T01:36:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-02-22T01:36:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea filtrului de pachete nftables 1.0.2 | ProHoster","description":"A fost publicat\u0103 versiunea 1.0.2 a filtrului de pachete nftables, care unific\u0103 interfe\u021bele de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i pun\u021bi de re\u021bea (destinat\u0103 s\u0103 \u00eenlocuiasc\u0103 iptables, ip6tables, arptables \u0219i ebtables).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.2, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-2","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-02-22T01:36:42+00:00","article:modified_time":"2022-02-22T01:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"103407","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2022-02-22 01:37:39","updated":"2022-09-28 07:06:54","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103407","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=103407"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103407\/revisions"}],"predecessor-version":[{"id":164194,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/103407\/revisions\/164194"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=103407"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=103407"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=103407"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}