Hi!
I'm honored to present
nftlb 0.4
nftlb stands for nftables load balancer, a user space tool
that builds a complete load balancer and traffic distributor
using the nft infrastructure.
nftlb is a nftables rules manager that creates virtual services
for load balancing at layer 2, layer 3 and layer 4, minimizing
the number of rules and using structures to match efficiently the
packets. It comes with an easy JSON API service to control,
to monitor and to automate the configuration.
Most important changes in this version are:
* Security Policies per virtual service including:
- White and blacklisting
- Queuing packets to user space
- TCP flow validation
- Maximum of established connections
- TCP resets per second allowed
- Limit of new connections per service
* Configurable hashing parameters based on source/destination ip
address, source/destination port, source/destination MAC address, or
combinations of them.
* Configurable persistence for client-backend affinity with a timeout
based on source/destination ip address, source/destination port,
source/destination MAC address, or combinations of them.
For further details, please refer to the official repository:
https://github.com/zevenet/nftlb
You can download this tool from:
https://github.com/zevenet/nftlb/releases/tag/v0.4
Happy load balancing!
--
Detailed changelog:
New features
- farms: add persistence between client and backend during a timeout
- policies: support of security policies per virtual service
- farms: support of queuing packets to user space per service
- farms: support of tcp flow validation per service
- farms: support of max established connections per virtual service
per source address
- farms: support of tcp resets per second allowed per virtual service
per source address
- farms: support of new connections limit per second per virtual
service and optional burst
- farms: add configurable hashing parameters
- src: support of delete all farms at once
Improvements
- nft: refactor farm rules generation code
- server: add long body support
- config: parsing json values hardening
- nft: fix helpers rules according to protocol
- readme: update the new parameter tcp-strict to avoid bogus tcp attacks
- farms: enable mac discovery for stateless dnat
- main: hide the key parameter when the process is running for security reasons
- nft: separate services by interface name for ingress modes
- farms: force the network data reload when changing the virtual ip
- farm: set masquerade if source addr is empty
- nft: add prerouting filter chain for marking and helpers
- buffer: remove debug messages
- farm: set default scheduler parameter for hash algorithm only
- config: use string keys as much as possible
- readme: add stateless nat mode option
- tests: allow launch of one single test without service
- buffer: fix code identation
- backends: only actionable if the backend is available
- backends: declare actionable functions
- buffer: support of scalable buffer
- backends: enable restart of backends after configuration
- nft: apply reset action per farm and backends
- nft: generalize actions for add or deletion postrouting elements
- farms: rename farm source-addr attribute instead of src-addr
- config: print marks in hex format
- tests: support to launch tests through web api
- build: move -lev to LDADD
- build: move preprocessor flags to CPPFLAGS
Bugfixes
- config: return error when an object has not been selected
- backends: avoid go to config_error after setting dnat ip addresses
- nft: fix stateless dnat rules when the input and output interfaces
are different
- nft: fix service name for stateless nat
- backend: fix backend validation during automated mac address request
- network: protect double free in handle
- server: fix double free segfault
- backends: fix backend validation when applying dsr mode
- farms: strim virtual interfaces for ingress chains
- nft: fix add element filter rules in reload
- nft: fix stateless dnat rules actions
- nft: avoid the use of filter chain and backend marks for ingress
- nft: avoid empty rules in filter chain when there is no backends
- backends: apply reload if changing the state of a backend
- nft: fix skb mark insertion from ct mark in filter chain
- nft: fix flush and delete chain filter
- nft: fix delete filter service and chain
- nft: fix delete elements from filter chain
- nft: avoid rules generation if there is no backend available
- backends: fix backend availability for ingress modes
- logs: fix set log level at startup
- objects: avoid buffer copy overlap
- buffer: fix typo in error message
- backends: fix backend going down
- Remove config.h file from .gitignore
- src: fix string copy sizes
- src: add a cleanup parsing structures to avoid null objects references
- config: fix farm mark json dump
- server: fix parse input body that produces buffer parsing error
