Linux ядросындағы Netfilter және пакеттік өңдеу құралдары

Packet alteration framework for Linux and the umbrella project for software of the same

Netfilter is a framework provided by the Linux kernel that allows various networking related operations to be implemented in the form of customized handlers. Netfilter offers various functions and operations for packet filtering, network address translation, and port translation, which provide the functionality required for directing packets through a network and prohibiting packets from reaching sensitive locations within a network. Netfilter represents a set of hooks inside the Linux kernel, allowing specific kernel modules to register callback functions with the kernel's networking stack. Those functions, usually applied to the traffic in the form of filtering and modification rules, are called for every packet that traverses the respective hook within the networking stack.

Rusty Russell started the netfilter/iptables project in 1998; he had also authored the project's predecessor, ipchains. As the project grew, he founded the Netfilter Core Team (or simply coreteam) in 1999. The software they produced (called netfilter hereafter) uses the GNU General Public License (GPL) license, and on 26 August 1999 it was merged into version 2.3.15 of the Linux kernel mainline and thus was in the 2.4.0 stable version. In August 2003 Harald Welte became chairman of the coreteam. In April 2004, following a crack down by the project on those distributing the project's software embedded in routers without complying with the GPL, a German court granted Welte an historic injunction against Sitecom Germany, which refused to follow the GPL's terms (see GPL related disputes). In September 2007 Patrick McHardy, who led development for past years, was elected as new chairman of the coreteam. Prior to iptables, the predominant software packages for creating Linux firewalls were ipchains in Linux kernel 2.2. x and ipfwadm in Linux kernel 2.0. x,

Through the use of plugin modules, connection tracking can be given knowledge of application layer protocols and thus understand that two or more distinct connections are "related". For example, consider the FTP protocol. A control connection is established, but whenever data is transferred, a separate connection is established to transfer it. When the nf conntrack ftp module is loaded, the first packet of an FTP data connection will be classified as "related" instead of "new", as it is logically part of an existing connection. The helpers only inspect one packet at a time, so if vital information for connection tracking is split across two packets, either due to IP fragmentation or TCP segmentation, the helper will not necessarily recognize patterns and therefore not perform its operation. IP fragmentation is dealt with the connection tracking subsystem requiring defragmentation, though TCP segmentation is not handled. In case of FTP, segmentation is deemed not to happen "near" a command like PASV with standard segment sizes, so is not dealt with in Netfilter either.

Each connection has a set of original addresses and reply addresses, which initially start out the same. NAT in Netfilter is implemented by simply changing the reply address, and where desired, port. When packets are received, their connection tuple will also be compared against the reply address pair (and ports). Being fragment free is also a requirement for NAT. (If need be, IPv4 packets may be refragmented by the normal, non Netfilter, IPv4 stack.)

Similar to connection tracking helpers, NAT helpers will do a packet inspection and substitute original addresses by reply addresses in the payload.

Though not being kernel modules that make use of Netfilter code directly, the Netfilter project hosts a few more noteworthy software.

conntrack tools is a set of user space tools for Linux that allow system administrators to interact with the Connection Tracking entries and tables. The package includes the conntrackd daemon and the command line interface conntrack. The userspace daemon conntrackd can be used to enable high availability cluster based stateful firewalls and collect statistics of the stateful firewall use. The command line interface conntrack provides a more flexible interface to the connection tracking system than the obsolete /proc/net/nf conntrack.

Unlike other extensions such as Connection Tracking, ipset is more related to iptables than it is to the core Netfilter code. ipset does not make use of Netfilter hooks for instance, but actually provides an iptables module to match and do minimal modifications (set/clear) to IP sets. The user space tool called ipset is used to set up, maintain and inspect so called "IP sets" in the Linux kernel. An IP set usually contains a set of IP addresses, but can also contain sets of other network numbers, depending on its "type". These sets are much more lookup efficient than bare iptables rules, but of course may come with a greater memory footprint. Different storage algorithms (for the data structures in memory) are provided in ipset for the user to select an optimum solution. Any entry in one set can be bound to another set, allowing for sophisticated matching operations. A set can only be removed (destroyed) if there are no iptables rules or other sets referring to it.

SYNPROXY target makes handling of large SYN floods possible without the large performance penalties imposed by the connection tracking in such cases. By redirecting initial SYN requests to the SYNPROXY target, connections are not registered within the connection tracking until they reach a validated final ACK state, freeing up connection tracking from accounting large numbers of potentially invalid connections. This way, huge SYN floods can be handled in an effective way. On 3 November 2013, SYN proxy functionality was merged into the Netfilter, with the release of version 3.12 of the Linux kernel mainline.

ulogd is a user space daemon to receive and log packets and event notifications from the Netfilter subsystems. ip tables can deliver packets via the userspace queueing mechanism to it, and connection tracking can interact with ulogd to exchange further information about packets or events (such as connection teardown, NAT setup).

The Netfilter project organizes an annual meeting for developers, which is used to discuss ongoing research and development efforts. The 2018 Netfilter workshop took place in Berlin, Germany, in June 2018.