{"id":106246,"date":"2022-12-23T15:36:42","date_gmt":"2022-12-23T13:36:42","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-1-0-6"},"modified":"2022-12-23T15:36:42","modified_gmt":"2022-12-23T13:36:42","slug":"vypusk-paketnogo-filtra-nftables-1-0-6","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","title":{"rendered":"Lansarea filtrului de pachete nftables 1.0.6","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>A fost publicat un nou release al filtrului de pachete nftables 1.0.6, care unific\u0103 interfe\u021bele de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i pun\u021bi de re\u021bea (destinat \u00eenlocuirii iptables, ip6tables, arptables \u0219i ebtables). Filtrul nftables include componente de filtrare a pachetelor care func\u021bioneaz\u0103 \u00een spa\u021biul utilizatorului, iar la nivelul kernelului, func\u021bionalitatea este asigurat\u0103 de subsystema nf_tables, inclus\u0103 \u00een kernelul Linux \u00eencep\u00e2nd cu versiunea 3.13. La nivel de kernel este furnizat\u0103 doar o interfa\u021b\u0103 general\u0103, independent\u0103 de protocolul utilizat, care ofer\u0103 func\u021bii de baz\u0103 pentru extragerea datelor din pachete, efectuarea opera\u021biunilor pe date \u0219i gestionarea fluxului.    <\/p>\n<p>Regulile de filtrare \u0219i handler-ii specifici pentru protocoale sunt compilate \u00een bytecode \u00een spa\u021biul utilizatorului, dup\u0103 care acest bytecode este \u00eenc\u0103rcat \u00een nucleu prin intermediul interfe\u021bei Netlink \u0219i executat \u00een nucleu \u00eentr-un mod special <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/vps\/abuzoustojchivye-vps\/\"   title=\"ma\u0219ina virtual\u0103\" data-wpil-keyword-link=\"linked\"  data-wpil-monitor-id=\"4332\">ma\u0219ina virtual\u0103<\/a>, similar cu BPF (Berkeley Packet Filters). Aceast\u0103 abordare permite reducerea semnificativ\u0103 a dimensiunii codului de filtrare care func\u021bioneaz\u0103 la nivel de nucleu \u0219i mutarea tuturor func\u021biilor de analiz\u0103 a regulilor \u0219i logica de func\u021bionare cu protocoalele \u00een spa\u021biul utilizatorului.    <\/p>\n<p>Modific\u0103ri principale:  <\/p>\n<ul>\n<li class=\"l\"> \u00cen optimizatorul de reguli, apelat prin specificarea op\u021biunii &#171;-o\/&#8212;optimize&#187;, este configurat\u0103 automatizarea \u00eempachet\u0103rii regulilor prin combinarea \u0219i transformarea acestora \u00een liste de tip map \u0219i set. De exemplu, regulile # cat ruleset.nft table ip x { chain y { type filter hook input priority filter; policy drop; meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.4 accept meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.3.0\/24 accept meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.4.0-2.2.4.10 accept meta iifname eth2 ip saddr 1.1.1.3 ip daddr 2.2.2.5 accept } } dup\u0103 execu\u021bia &#171;nft -o -c -f ruleset.nft&#187; vor fi transformate astfel: ruleset.nft:4:17-74: meta iifname eth1 ip saddr 1.1.1.1 ip daddr 2.2.2.3 accept ruleset.nft:5:17-74: meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.2.4 accept ruleset.nft:6:17-77: meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.3.0\/24 accept ruleset.nft:7:17-83: meta iifname eth1 ip saddr 1.1.1.2 ip daddr 2.2.4.0-2.2.4.10 accept ruleset.nft:8:17-74: meta iifname eth2 ip saddr 1.1.1.3 ip daddr 2.2.2.5 accept \u00een: iifname . ip saddr . ip daddr { eth1 . 1.1.1.1 . 2.2.2.3, eth1 . 1.1.1.2 . 2.2.2.4, eth1 . 1.1.1.2 . 2.2.3.0\/24, eth1 . 1.1.1.2 . 2.2.4.0-2.2.4.10, eth2 . 1.1.1.3 . 2.2.2.5 } accept\n<li class=\"l\"> Optimizatorul poate transforma, de asemenea, \u00een form\u0103 mai compact\u0103 regulile care utilizeaz\u0103 deja liste simple de tip set, de exemplu regulile: # cat ruleset.nft table ip filter { chain input { type filter hook input priority filter; policy drop; iifname &#171;lo&#187; accept ct state established,related accept comment &#171;\u00cen traficul pe care \u00eel ini\u021biem, avem \u00eencredere&#187; iifname &#171;enp0s31f6&#187; ip saddr { 209.115.181.102, 216.197.228.230 } ip daddr 10.0.0.149 udp sport 123 udp dport 32768-65535 accept iifname &#171;enp0s31f6&#187; ip saddr { 64.59.144.17, 64.59.150.133 } ip daddr 10.0.0.149 udp sport 53 udp dport 32768-65535 accept } } dup\u0103 execu\u021bia &#171;nft -o -c -f ruleset.nft&#187; acestea vor fi \u00eempachetate astfel: ruleset.nft:6:22-149: iifname &#171;enp0s31f6&#187; ip saddr { 209.115.181.102, 216.197.228.230 } ip daddr 10.0.0.149 udp sport 123 udp dport 32768-65535 accept ruleset.nft:7:22-143: iifname &#171;enp0s31f6&#187; ip saddr { 64.59.144.17, 64.59.150.133 } ip daddr 10.0.0.149 udp sport 53 udp dport 32768-65535 accept \u00een: iifname . ip saddr . ip daddr . udp sport . udp dport { enp0s31f6 . 209.115.181.102 . 10.0.0.149 . 123 . 32768-65535, enp0s31f6 . 216.197.228.230 . 10.0.0.149 . 123 . 32768-65535, enp0s31f6 . 64.59.144.17 . 10.0.0.149 . 53 . 32768-65535, enp0s31f6 . 64.59.150.133 . 10.0.0.149 . 53 . 32768-65535 } accept\n<li class=\"l\"> Problema gener\u0103rii de bytecode pentru combinarea intervalelor \u00een care se aplic\u0103 tipuri cu ordine diferit\u0103 de octe\u021bi, cum ar fi IPv4 (ordine de octet de re\u021bea) \u0219i meta mark (ordine de octet a sistemului), a fost rezolvat\u0103.        table ip x {             map w {                   typeof ip saddr . meta mark : verdict                   flags interval                   counter                   elements = {                           127.0.0.1-127.0.0.4 . 0x123434-0xb00122 : accept,                           192.168.0.10-192.168.1.20 . 0x0000aa00-0x0000aaff :   accept,                   }            }            chain k {                   type filter hook input priority filter; policy drop;                   ip saddr . meta mark vmap @w            }      }\n<li class=\"l\"> A fost realizat\u0103 maparea protocoalelor rare folosind expresii raw, de exemplu:         meta l4proto 91 @th,400,16 0x0 accept\n<li class=\"l\"> S-au rezolvat problemele cu includerea regulilor cu intervale:         insert rule x y tcp sport { 3478-3497, 16384-16387 } counter accept\n<li class=\"l\"> API-ul JSON a fost \u00eembun\u0103t\u0103\u021bit, ad\u0103ug\u00e2nd suport pentru expresii \u00een liste set \u0219i map.\n<li class=\"l\"> \u00cen extensiile bibliotecii python nftables, este permis\u0103 \u00eenc\u0103rcarea seturilor de reguli pentru prelucrare \u00een modul de verificare (&#171;-c&#187;) \u0219i a fost ad\u0103ugat\u0103 suportul pentru definirea variabilelor externe.\n<li class=\"l\"> \u00cen elementele listelor set a fost permis\u0103 ad\u0103ugarea comentariilor.\n<li class=\"l\"> \u00cen byte ratelimit a fost permis\u0103 specificarea valorii zero.    <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58378\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables). \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 \u0432\u044b\u043f\u0443\u0441\u043a\u0430 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-106246","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-12-23T13:36:42+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-12-23T13:36:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea filtrului de pachete nftables 1.0.6 | ProHoster","description":"A fost publicat pachetul de filtrare nftables 1.0.6, unific\u00e2nd interfe\u021bele de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i pun\u021bi de re\u021bea (destinat s\u0103 \u00eenlocuiasc\u0103 iptables, ip6tables, arptables \u0219i ebtables).","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 1.0.6, \u0443\u043d\u0438\u0444\u0438\u0446\u0438\u0440\u0443\u044e\u0449\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u044b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432 (\u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0437\u0430\u043c\u0435\u043d\u0443 iptables, ip6table, arptables \u0438 ebtables).","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-1-0-6","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-12-23T13:36:42+00:00","article:modified_time":"2022-12-23T13:36:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/106246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=106246"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/106246\/revisions"}],"predecessor-version":[{"id":164207,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/106246\/revisions\/164207"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=106246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=106246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=106246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}