Mailing List Archive

[ANNOUNCE] nftables 0.7 release
Hi!

The Netfilter project proudly presents:

nftables 0.7

This release contains many accumulated bug fixes and new features
available up to the (upcoming) Linux 4.10-rc1 kernel release.

* Facilitate migration from iptables to nftables:

At compilation time, you have to pass this option.

# ./configure --with-xtables

And libxtables needs to be installed in your system. This allows you
to list a ruleset containing xt extensions loaded through
iptables-compat-restore tool. The nft tool provides a native
translation for iptables extensions (if available).

* Add new fib expression, which can be used to obtain the output
interface from the route table based on either source or destination
address of a packet. This can be used to e.g. add reverse path
filtering, eg. drop if not coming from the same interface packet
arrived on:

# nft add rule x prerouting fib saddr . iif oif eq 0 drop

Accept only if from eth:

# nft add rule x prerouting fib saddr . iif oif eq "eth0" accept

Accept if from any valid interface:

# nft add rule x prerouting fib saddr oif accept

Querying of address type is also supported, this can be used
to only accept packets to addresses configured in the same
interface, eg.

# nft add rule x prerouting fib daddr . iif type local accept

Its also possible to use mark and verdict map, eg,

# nft add rule x prerouting \
meta mark set 0xdead fib daddr . mark type vmap {
blackhole : drop,
prohibit : drop,
unicast : accept
}

* Support hashing of any arbitrary key combination, eg.

# nft add rule x y \
dnat to jhash ip saddr . tcp dport mod 2 map { \
0 : 192.168.20.100, \
1 : 192.168.30.100 \
}

Another usecase: Set packet marks based on any arbitrary hashing.

* Add number generation support. Useful for round-robin packet mark
setting, eg.

# nft add rule filter prerouting meta mark set numgen inc mod 2

You can also specify an offset to indicate from what value you want
to start from.

The modulus provides the scale of the counting sequence. You can
also use this from maps, eg.

# nft add rule nat prerouting \
dnat to numgen inc mod 2 map { 0 : 192.168.10.100, 1 : 192.168.20.200 }

So this is distributing new connections in a round-robin fashion
between 192.168.10.100 and 192.168.20.200. Don't forget the special NAT
chain semantics: Only the first packet evaluates the rule, follow up
packets rely on conntrack to apply the NAT information.

You can also emulate flow distribution with different backend weights
using intervals, eg.

# nft add rule nat prerouting \
dnat to numgen inc mod 10 map { 0-5 : 192.168.10.100, 6-9 : 192.168.20.200 }

* Add quota support, eg.

# nft add rule filter input \
flow table http { ip saddr timeout 60s quota over 50 mbytes } drop

This creates a flow table, where every flow gets a quota of 50
mbytes. You can also from use simple rules too to enforce quotas, of
course.

* Introduce routing expression, for routing related data with support
for nexthop (i.e. the directly connected IP address that an outgoing
packet is sent to), which can be used either for matching or accounting, eg.

# nft add rule filter postrouting \
ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop

This will drop any traffic to 192.168.1.0/24 that is not routed via
192.168.0.1.

# nft add rule filter postrouting \
flow table acct { rt nexthop timeout 600s counter }

# nft add rule ip6 filter postrouting \
flow table acct { rt nexthop timeout 600s counter }

These rules count outgoing traffic per nexthop. Note that the timeout
releases an entry if no traffic is seen for this nexthop within 10
minutes.

* Notrack support, to explicitly skip connection tracking for matching
packets, eg.

# nft add rule ip raw prerouting tcp dport { 80, 443 } notrack

So you can skip tracking for http and https traffic.

* Support to set non-byte bound packet header fields, including
checksum adjustment, eg. ip6 ecn set 1.

* Add 'create set' and 'create element' commands, eg.

# nft add set x y { type ipv4_addr\; }
# nft create set x y { type ipv4_addr\; }
<cmdline>:1:1-35: Error: Could not process rule: File exists
create set x y { type ipv4_addr; }
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# nft add set x y { type ipv4_addr\; }
#

So 'create' bails out if the set already exists, while 'add'
doesn't, for more ergonomic usage as several users requested on
the mailing list.

* Allow to use variable reference for set element definitions, eg.

# cat ruleset.nft
define s-ext-2-int = { 10.10.10.10 . 25, 10.10.10.10 . 143 }

table inet forward {
set s-ext-2-int {
type ipv4_addr . inet_service
elements = $s-ext-2-int
}
}
# nft -f ruleset.nft

Useful to improve ruleset maintainability, as you can split out
variable and set definitions from the filtering policy itself.

* Allow to use variable definitions from element commands, eg.

define whitelist_v4 = { 1.1.1.1 }

table inet filter {
set whitelist_v4 { type ipv4_addr; }
}

add element inet filter whitelist_v4 $whitelist_v4

* Add support to flush set. You can use this new command to remove all
existing elements in a set, eg.

# nft flush set filter xyz

Note that this requires (upcoming) Linux kernel 4.10-rc versions.

* Inverted set lookups, eg. tcp dport != { 80, 443 }.

* Honor absolute and relative paths via include file, where:

include "./ruleset.nft"

refers to a file in the working directory.

include "ruleset.nft"

refers to a file in the nftables root path (via sysconfdir), and:

include "/etc/nftables/ruleset.nft"

provides an absolute reference to the file that need to be included.
This also solves an ambiguity if the same file name is used both under
sysconfdir and the current working directory.

* Support log flags, to enable logging TCP sequence and options:

# nft add rule x y log flags tcp sequence,options

... IP options, eg:

# nft add rule x y log flags ip options

... socket UID, eg.

# nft add rule x y log flags skuid

... decide ethernet link layer address, eg.

# nft add rule x y log flags ether

... or simply set on all flags:

# nft add rule x y log flags all

* tc classid parser support, eg.

nft add rule filter forward meta priority abcd:1234

* Allow numeric connlabels, so if connlabel still works with undefined
labels, eg. ct label set 2.

* Document log, reject, counter, meta, limit, nat, ct, payload and
queue statements from nft(8) manpage.

Bugfixes
========

Not strictly limited to this list below, but some highlights:

* Allow split table definitions, eg.

# cat ruleset.nft
table inet filter {
chain ssh {
type filter hook input priority 0; policy accept;
tcp dport ssh accept;
}
}
table inet filter {
chain input {
type filter hook input priority 1; policy drop;
}
}
# nft -f ruleset.nft

* Use new range expression to represent inverted intervals, eg.
ip saddr != 1.1.1.1-2.2.2.2, since previously generated bytecode was
not correct.
* Solve endianness problems with link layer address.
* Fix parser to keep map flag around on definition.
* Skip timeout attribute in dynamic set updates, other kernel bails
out with EINVAL.
* Restore parsing of dynamic set element updates.
* The time datatype now uses milliseconds, as the kernel expects.
* Allow numeric interface index numbers, eg. in meta iif, oif.
* Fix monitor trace crash with netdev family.
* Flow table with concatenation fixes.
* Keep element comments around when using set intervals.
* Fixed memory corruption in userspace when deleting lots of elements
in one go via nft -f.
* Several nft internal cache fixes, including cache reset on 'flush
ruleset'.
* Restore parens on right-hand side of relational expression.
* Replace getnameinfo() by internal lookup table, so we don't rely on
/etc/services anymore for service names, so we restrict them to
a well-known set that is supported by our scanner. You can list
service names via 'nft describe tcp dport'.
* Display symbol table values in the right hostbyte order and
decimal/hexadecimal representation.
* Fix a nasty bug in the set interval code triggering huge memory
consumption in userspace for set and map intervals with runtime
updates.

We also got lots more tests added to our infrastructure to catch up
regressions.

Syntax updates
==============

Several minor syntax updates, although previous syntax has been
preserved by now to facilitate transition, the new one is prefered:

* Consistency grammar fixes: 'snat' and 'dnat' now require 'to', eg.
snat to 1.2.3.4. For consistency with existing statements such as
redirect, masquerade, dup and fwd. Moreover, add colon after 'to' in
'redirect' for consistency with nat and masq statements.

* Allow ct l3proto/protocol without direction since they are unrelated
to the direction.

* Explicit ruleset exportation, eg. nft export ruleset json, for
consistency with other existing ruleset commands.

* Always quote user-defined strings from rules when listing them.

* Support for RFC2732 IPv6 address format with brackets, eg.

dnat to [2001:838:35f:1::]:80

* Allow strings starting by underscores and dots in user-define
strings, conforming with POSIX.1-2008 (which is simultaneously IEEE
Std 1003.1-2008).

Resources
=========

The nftables code can be obtained from:

* http://netfilter.org/projects/nftables/downloads.html
* ftp://ftp.netfilter.org/pub/nftables
* git://git.netfilter.org/nftables

To build the code, libnftnl 1.0.7 and libmnl >= 1.0.2 are required:

* http://netfilter.org/projects/libnftnl/index.html
* http://netfilter.org/projects/libmnl/index.html

Visit our wikipage for user documentation at:

* http://wiki.nftables.org

For the manpage reference, check man(8) nft.

In case of bugs and feature request, file them via:

* https://bugzilla.netfilter.org

Make sure you create no duplicates already, thanks!

Happy holidays!