{"id":76505,"date":"2020-04-02T19:42:00","date_gmt":"2020-04-02T17:42:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/vypusk-paketnogo-filtra-nftables-0-9-4"},"modified":"2020-04-02T19:42:00","modified_gmt":"2020-04-02T17:42:00","slug":"vypusk-paketnogo-filtra-nftables-0-9-4","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","title":{"rendered":"Lansarea filtrului de pachete nftables 0.9.4","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><noindex><a rel=\"nofollow\" href=\"https:\/\/marc.info\/?l=netfilter&#038;m=158575148505527&#038;w=2\">Publicat<\/a><\/noindex> lansarea filtrului de pachete <noindex><a rel=\"nofollow\" href=\"https:\/\/netfilter.org\/projects\/nftables\/\">nftables 0.9.4<\/a><\/noindex>, dezvolt\u00e2ndu-se ca o alternativ\u0103 la iptables, ip6tables, arptables \u0219i ebtables, prin unificarea interfe\u021belor de filtrare a pachetelor pentru IPv4, IPv6, ARP \u0219i poduri de re\u021bea. Pachetul nftables include componente de filtrare a pachetelor care func\u021bioneaz\u0103 \u00een spa\u021biul utilizatorului, \u00een timp ce la nivelul nucleului, activitatea este asigurat\u0103 de subsystemul nf_tables, care face parte din nucleul Linux \u00eencep\u00e2nd cu versiunea 3.13. Modific\u0103rile necesare pentru lansarea nftables 0.9.4 sunt incluse \u00een ramura viitoare a nucleului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52632\">Linux 5.6<\/a><\/noindex>.<\/p>\n<p>La nivel de kernel se ofer\u0103 doar o interfa\u021b\u0103 general\u0103, independent\u0103 de protocolul specific \u0219i care ofer\u0103 func\u021bii de baz\u0103 pentru extragerea datelor din pachete, efectuarea de opera\u021biuni cu date \u0219i gestionarea fluxului. Reguli de filtrare direct \u0219i gestionarii specifici pentru protocoale sunt compilate \u00een bytecode \u00een spa\u021biul utilizatorului, dup\u0103 care acest bytecode este \u00eenc\u0103rcat \u00een kernel cu ajutorul interfe\u021bei Netlink \u0219i executat \u00een kernel \u00eentr-o ma\u0219in\u0103 virtual\u0103 special\u0103, asem\u0103n\u0103toare cu BPF (Berkeley Packet Filters). Aceast\u0103 abordare permite reducerea semnificativ\u0103 a dimensiunii codului de filtrare care ruleaz\u0103 la nivel de kernel \u0219i externalizarea tuturor func\u021biilor de analiz\u0103 a regulilor \u0219i logicii de lucru cu protocoalele \u00een spa\u021biul utilizatorului.<\/p>\n<p>Nout\u0103\u021bi principale:\n<\/p>\n<ul>\n<li class=\"l\"> Suport pentru intervale \u00een consolid\u0103ri (concatenare, anumite leg\u0103turi de adrese \u0219i porte, care simplific\u0103 asocierea). De exemplu, pentru setul \u201ewhitelist\u201d, al c\u0103rui elemente sunt consolid\u0103ri, specificarea flag-ului \u201einterval\u201d va indica faptul c\u0103 setul poate include intervale \u00een consolidare (pentru consolidarea \u201eipv4_addr . ipv4_addr . inet_service\u201d anterior se puteau lista potriviri exacte de tipul \u201e192.168.10.35 . 192.68.11.123 . 80\u201d, iar acum se pot specifica grupuri de adrese \u201e192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80\u201d):\n<p>    table ip foo {<br \/>\n           set whitelist {<br \/>\n                   type ipv4_addr . ipv4_addr . inet_service<br \/>\n                   flags interval<br \/>\n                   elements = { 192.168.10.35-192.168.10.40 . 192.68.11.123-192.168.11.125 . 80 }<br \/>\n           }<\/p>\n<p>           chain bar {<br \/>\n                   type filter hook prerouting priority filter; policy drop;<br \/>\n                   ip saddr . ip daddr . tcp dport @whitelist accept<br \/>\n           }<br \/>\n    }<\/p>\n<li class=\"l\"> \u00cen seturi \u0219i liste map sunt disponibile directivele \u201etypeof\u201d, care definesc formatul elementului \u00een timpul asocierei.<br \/>\n De exemplu:<\/p>\n<p>     table ip foo {<br \/>\n            set whitelist {<br \/>\n                    typeof ip saddr<br \/>\n                    elements = { 192.168.10.35, 192.168.10.101, 192.168.10.135 }<br \/>\n            }<\/p>\n<p>            chain bar {<br \/>\n                    type filter hook prerouting priority filter; policy drop;<br \/>\n                    ip daddr @whitelist accept<br \/>\n            }<br \/>\n     }<\/p>\n<p>     table ip foo {<br \/>\n            map addr2mark {<br \/>\n                typeof ip saddr : meta mark<br \/>\n                elements = { 192.168.10.35 : 0x00000001, 192.168.10.135 : 0x00000002 }<br \/>\n            }<br \/>\n     }<\/p>\n<li class=\"l\"> A fost ad\u0103ugat\u0103 posibilitatea utiliz\u0103rii concaten\u0103rilor \u00een regulile NAT, ceea ce permite specificarea adresei \u0219i portului la definirea transform\u0103rilor NAT pe baza listelor mapate sau a seturilor denumite:\n<p>      nft add rule ip nat pre dnat ip addr . port to ip saddr map { 1.1.1.1 : 2.2.2.2 . 30 }<\/p>\n<p>      nft add map ip nat destinations { type ipv4_addr . inet_service : ipv4_addr . inet_service \\ };<br \/>\n      nft add rule ip nat pre dnat ip addr . port to ip saddr . tcp dport map @destinations<\/p>\n<li class=\"l\"> Suport pentru accelerarea hardware-ului prin externalizarea unor opera\u021biuni de filtrare pe umerii pl\u0103cii de re\u021bea. Accelerarea se activeaz\u0103 prin utilitarul ethtool (\u201eethtool -K eth0 hw-tc-offload on\u201d), dup\u0103 care se activeaz\u0103 \u00een nftables pentru lan\u021bul principal cu ajutorul flag-ului \u201eoffload\u201d. C\u00e2nd se folose\u0219te kernel-ul Linux 5.6, se suport\u0103 accelerarea hardware-ului pentru asocierea c\u00e2mpurilor antet \u0219i verificarea interfe\u021bei de intrare combinat\u0103 cu primirea, respingerea, duplicarea (dup) \u0219i redirec\u021bionarea (fwd) pachetelor. \u00cen exemplul de mai jos, opera\u021biunile de respingere a pachetelor provenind de la adresa 192.168.30.20 se efectueaz\u0103 la nivelul pl\u0103cii de re\u021bea, f\u0103r\u0103 a transmite pachetele c\u0103tre kernel:\n<p>     # cat file.nft<br \/>\n     table netdev x {<br \/>\n            lan\u021b y {<br \/>\n                tipul filtrului hook ingress dispozitiv eth0 prioritate 10; steaguri offload;<br \/>\n                ip saddr 192.168.30.20 drop<br \/>\n            }<br \/>\n     }<br \/>\n     # nft -f file.nft<\/p>\n<li class=\"l\"> \u00cembun\u0103t\u0103\u021bit\u0103 informarea despre loca\u021bia erorii \u00een reguli.\n<p>     # nft delete rule ip y z handle 7<br \/>\n     Eroare: Nu s-a putut procesa regula: Nu exist\u0103 un astfel de fi\u0219ier sau director<br \/>\n     \u0219terge regula ip y z handle 7<br \/>\n                    ^<\/p>\n<p>     # nft delete rule ip x x handle 7<br \/>\n     Eroare: Nu s-a putut procesa regula: Nu exist\u0103 un astfel de fi\u0219ier sau director<br \/>\n     \u0219terge regula ip x x handle 7<br \/>\n                               ^<\/p>\n<p>     # nft delete table twst<br \/>\n     Error: Nu exist\u0103 un fi\u0219ier sau un director; ai vrut s\u0103 spui tabelul \u201etest\u201d \u00een familia ip?<br \/>\n     \u0219terge tabela twst<br \/>\n                  ^^^^<\/p>\n<p>\u00cen primul exemplu se arat\u0103 c\u0103 tabelul \u201ey\u201d nu exist\u0103 \u00een sistem, \u00een al doilea c\u0103 lipse\u0219te handler-ul \u201e7\u201d, iar \u00een al treilea c\u0103 este afi\u0219at un indiciu pentru o gre\u0219eal\u0103 de tipar la introducerea numelui tabelului.<\/p>\n<li class=\"l\"> A fost ad\u0103ugat\u0103 suportul pentru verificarea interfe\u021bei slave prin specificarea \u201emeta sdif\u201d sau \u201emeta sdifname\u201d:\n<p>        \u2026 meta sdifname vrf1 \u2026<\/p>\n<li class=\"l\"> A fost ad\u0103ugat\u0103 suportul pentru opera\u021bia de deplasare la dreapta sau la st\u00e2nga. De exemplu, pentru a deplasa un marcaj de pachet existent la st\u00e2nga cu 1 bit \u0219i a seta bitul inferior la 1:\n<p>        \u2026 meta mark set meta mark lshift 1 or 0x1 \u2026<\/p>\n<li class=\"l\"> A fost implementat\u0103 op\u021biunea \u201e-V\u201d pentru a afi\u0219a informa\u021bii extinse despre versiune.\n<p>     # nft -V<br \/>\n       nftables v0.9.4 (Jive at Five)<br \/>\n          cli:          readline<br \/>\n          json:         yes<br \/>\n          minigmp:      no<br \/>\n          libxtables:   yes<\/p>\n<li class=\"l\"> Op\u021biunile liniei de comand\u0103 trebuie acum s\u0103 fie specificate \u00eenaintea comenzilor. De exemplu, trebuie specificat \u201enft -a list ruleset\u201d, iar rularea \u201enft list ruleset -a\u201d va duce la afi\u0219area unei erori.\n<p><noindex><a rel=\"nofollow\" name=\"link\"><\/a><\/noindex><\/p>\n<p>Sursa: <a \ncontent=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=52656\">opennet.ro<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4, \u0440\u0430\u0437\u0432\u0438\u0432\u0430\u044e\u0449\u0435\u0433\u043e\u0441\u044f \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u0437\u0430\u043c\u0435\u043d\u044b iptables, ip6table, arptables \u0438 ebtables \u0437\u0430 \u0441\u0447\u0451\u0442 \u0443\u043d\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u0432 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0434\u043b\u044f IPv4, IPv6, ARP \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u043c\u043e\u0441\u0442\u043e\u0432. \u0412 \u043f\u0430\u043a\u0435\u0442 nftables \u0432\u0445\u043e\u0434\u044f\u0442 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u044b \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u0432 \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0432 \u0442\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u0430\u043a \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u0440\u0430\u0431\u043e\u0442\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 nf_tables, \u0432\u0445\u043e\u0434\u044f\u0449\u0430\u044f \u0432 \u0441\u043e\u0441\u0442\u0430\u0432 \u044f\u0434\u0440\u0430 Linux [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-76505","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4 | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-04-02T17:42:00+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-04-02T17:42:00+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Lansarea filtrului de pachete nftables 0.9.4 | ProHoster","description":"A fost publicat lansarea filtrului de pachete","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430 nftables 0.9.4 | ProHoster","og:description":"\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d \u0432\u044b\u043f\u0443\u0441\u043a \u043f\u0430\u043a\u0435\u0442\u043d\u043e\u0433\u043e \u0444\u0438\u043b\u044c\u0442\u0440\u0430","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/vypusk-paketnogo-filtra-nftables-0-9-4","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-04-02T17:42:00+00:00","article:modified_time":"2020-04-02T17:42:00+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"76505","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 17:35:41","updated":"2022-10-07 02:56:47","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/76505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=76505"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/76505\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=76505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=76505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=76505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}