netdev - [ANNOUNCE] nftables 0.9.8 release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20210115215942.GA20205@salvia>
Date:   Fri, 15 Jan 2021 22:59:42 +0100
From:   Pablo Neira Ayuso <pablo@...filter.org>
To:     netfilter <netfilter@...r.kernel.org>,
        netfilter-devel <netfilter-devel@...r.kernel.org>
Cc:     netdev@...r.kernel.org, netfilter-announce@...ts.netfilter.org,
        lwn@....net
Subject: [ANNOUNCE] nftables 0.9.8 release

Hi!

The Netfilter project proudly presents:

        nftables 0.9.8

This release contains fixes, documentation updates and new features
available up to the Linux kernel 5.11-rc1 release.

* Complete support for matching ICMP header content fields.

  ... icmp type { echo-reply, echo-request} icmp id 1 icmp sequence 2
  ... icmpv6 type packet-too-big icmpv6 mtu 1280

* Add raw tcp option match support

  ... tcp option @42,16,4

  where you can specify @kind,offset,length

* Allow to check for the presence of any tcp option

  ... tcp option 42 exists

* Support for reject traffic from the ingress chain:

  table netdev x {
      chain y {
            type filter hook ingress device eth0 priority 0; policy accept;

            tcp dport 22 reject with tcp reset
      }
  }

* Optimized bytecode generation for prefix match

# nft --debug=netlink x y ip saddr 192.168.2.0/24
ip
  [ payload load 3b @ network header + 12 => reg 1 ]
  [ cmp eq reg 1 0x0002a8c0 ]

Resulting in two instructions instead of three (bitwise is removed on
byte-boundaries).

* Support for several statements per set element. The example below
  updates a set from the packet path (dynamic set), and it shows how
  to ratelimit first then count packets that go through per set element.

  table ip x {
       set y {
               type ipv4_addr
               size 65535
               flags dynamic,timeout
               timeout 1h
       }

       chain z {
               type filter hook output priority filter; policy accept;
               update @y { ip daddr limit rate 1/second counter }
       }
  }

  You can also use the multi-statement support for (non-dynamic) sets.

  table ip x {
       set y {
               type ipv4_addr
               limit rate 1/second counter
               elements = { 1.1.1.1, 4.4.4.4, 5.5.5.5 }
       }

       chain y {
               type filter hook output priority filter; policy accept;
               ip daddr @y
       }
  }

  In this case, you can add new elements from the control plane:

  # nft add element x y { 6.6.6.6 }

  which run the specified rate limit and counter statements.

  This requires a Linux kernel >= 5.11-rc1.

* editline support for nft -i (CLI), you can enable it at compile time:

        ./configure --with-cli=editline

You can download this new release from:

https://www.netfilter.org/projects/nftables/downloads.html#nftables-0.9.8

To build the code, libnftnl >= 1.1.9 and libmnl >= 1.0.4 are required:

* https://netfilter.org/projects/libnftnl/index.html
* https://netfilter.org/projects/libmnl/index.html

Visit our wikipage for user documentation at:

* https://wiki.nftables.org

For the manpage reference, check man(8) nft.

In case of bugs and feature request, file them via:

* https://bugzilla.netfilter.org

Happy firewalling.

View attachment "changes-nftables-0.9.8.txt" of type "text/plain" (3184 bytes)