diff options
| author | Stephen Suryaputra <ssuryaextr@gmail.com> | 2019-07-03 20:30:52 -0400 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2019-07-04 14:29:08 +0200 |
| commit | 226a0e072d5c1edeb53cb61b959b011168c5c29a (patch) | |
| tree | 07e43268efe15dc8b64b8ca9baca71e02239213f /doc/payload-expression.txt | |
| parent | 1694c01c30fba06461ca82ede070bf6a9cd9a4db (diff) | |
exthdr: add support for matching IPv4 options
Add capability to have rules matching IPv4 options. This is developed
mainly to support dropping of IP packets with loose and/or strict source
route route options.
Signed-off-by: Stephen Suryaputra <ssuryaextr@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc/payload-expression.txt')
| -rw-r--r-- | doc/payload-expression.txt | 29 |
1 files changed, 27 insertions, 2 deletions
diff --git a/doc/payload-expression.txt b/doc/payload-expression.txt index ebbffe50..b98a6077 100644 --- a/doc/payload-expression.txt +++ b/doc/payload-expression.txt @@ -506,9 +506,9 @@ input meta iifname enp2s0 arp ptype 0x0800 arp htype 1 arp hlen 6 arp plen 4 @nh EXTENSION HEADER EXPRESSIONS ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -Extension header expressions refer to data from variable-sized protocol headers, such as IPv6 extension headers and TCP options. +Extension header expressions refer to data from variable-sized protocol headers, such as IPv6 extension headers, TCP options and IPv4 options. -nftables currently supports matching (finding) a given ipv6 extension header or TCP option. +nftables currently supports matching (finding) a given ipv6 extension header, TCP option or IPv4 option. [verse] *hbh* {*nexthdr* | *hdrlength*} *frag* {*nexthdr* | *frag-off* | *more-fragments* | *id*} @@ -517,11 +517,13 @@ nftables currently supports matching (finding) a given ipv6 extension header or *mh* {*nexthdr* | *hdrlength* | *checksum* | *type*} *srh* {*flags* | *tag* | *sid* | *seg-left*} *tcp option* {*eol* | *noop* | *maxseg* | *window* | *sack-permitted* | *sack* | *sack0* | *sack1* | *sack2* | *sack3* | *timestamp*} 'tcp_option_field' +*ip option* { lsrr | ra | rr | ssrr } 'ip_option_field' The following syntaxes are valid only in a relational expression with boolean type on right-hand side for checking header existence only: [verse] *exthdr* {*hbh* | *frag* | *rt* | *dst* | *mh*} *tcp option* {*eol* | *noop* | *maxseg* | *window* | *sack-permitted* | *sack* | *sack0* | *sack1* | *sack2* | *sack3* | *timestamp*} +*ip option* { lsrr | ra | rr | ssrr } .IPv6 extension headers [options="header"] @@ -580,6 +582,24 @@ TCP Timestamps | kind, length, tsval, tsecr |============================ +.IP Options +[options="header"] +|================== +|Keyword| Description | IP option fields +|lsrr| +Loose Source Route | +type, length, ptr, addr +|ra| +Router Alert | +type, length, value +|rr| +Record Route | +type, length, ptr, addr +|ssrr| +Strict Source Route | +type, length, ptr, addr +|============================ + .finding TCP options -------------------- filter input tcp option sack-permitted kind 1 counter @@ -590,6 +610,11 @@ filter input tcp option sack-permitted kind 1 counter ip6 filter input frag more-fragments 1 counter --------------------------------------- +.finding IP option +------------------ +filter input ip option lsrr exists counter +--------------------------------------- + CONNTRACK EXPRESSIONS ~~~~~~~~~~~~~~~~~~~~~ Conntrack expressions refer to meta data of the connection tracking entry associated with a packet. + |