summaryrefslogtreecommitdiffstats
path: root/doc/nft.xml
Commit message (Collapse)AuthorAgeFilesLines
* src: add TCP option matchingManuel Messner2017-02-121-5/+173
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch enables nft to match against TCP options. Currently these TCP options are supported: * End of Option List (eol) * No-Operation (noop) * Maximum Segment Size (maxseg) * Window Scale (window) * SACK Permitted (sack_permitted) * SACK (sack) * Timestamps (timestamp) Syntax: tcp options $option_name [$offset] $field_name Example: # count all incoming packets with a specific maximum segment size `x` # nft add rule filter input tcp option maxseg size x counter # count all incoming packets with a SACK TCP option where the third # (counted from zero) left field is greater `x`. # nft add rule filter input tcp option sack 2 left \> x counter If the offset (the `2` in the example above) is zero, it can optionally be omitted. For all non-SACK TCP options it is always zero, thus can be left out. Option names and field names are parsed from templates, similar to meta and ct options rather than via keywords to prevent adding more keywords than necessary. Signed-off-by: Manuel Messner <mm@skelett.io> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: Document setsElise Lennion2017-02-121-0/+124
| | | | | | | This patch adds the missing documentation for sets. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Document stateful objectsElise Lennion2017-02-121-1/+135
| | | | | | | | This patch adds documentation for stateful objects and updates tables description to mention them. Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Include stateless optionElise Lennion2017-01-181-0/+11
| | | | | Signed-off-by: Elise Lennion <elise.lennion@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* ct: add average bytes per packet counter supportLiping Zhang2017-01-161-3/+10
| | | | | | | | | | | | | | | | | Similar to connbytes extension in iptables, now you can use it to match average bytes per packet a connection has transferred so far. For example, match avgpkt in "BOTH" diretion: # nft add rule x y ct avgpkt \> 100 Match avgpkt in reply direction: # nft add rule x y ct reply avgpkt \< 900 Or match avgpkt in original direction: # nft add rule x y ct original avgpkt \> 200 Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add log flags syntax supportLiping Zhang2016-11-241-0/+56
| | | | | | | | | | | | | | | | | | | | | Now NF_LOG_XXX is exposed to the userspace, we can set it explicitly. Like iptables LOG target, we can log TCP sequence numbers, TCP options, IP options, UID owning local socket and decode MAC header. Note the log flags are mutually exclusive with group. Some examples are listed below: # nft add rule t c log flags tcp sequence,options # nft add rule t c log flags ip options # nft add rule t c log flags skuid # nft add rule t c log flags ether # nft add rule t c log flags all # nft add rule t c log flags all group 1 <cmdline>:1:14-16: Error: flags and group are mutually exclusive add rule t c log flags all group 1 ^^^ Signed-off-by: Liping Zhang <zlpnobody@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix synopsis for ct expressionAnders K. Pedersen2016-10-311-10/+15
| | | | | | | | | | | | | | | | | | | The nft man page command synopsis for the ct expression is currently: ct {state | direction | status | mark | expiration | helper | label | bytes | packets} {original | reply | {l3proto | protocol | saddr | daddr | proto-src | proto-dst | bytes | packets}} which is not correct for the arguments that should be prefixed with "original" or "reply". Change this to ct {state | direction | status | mark | expiration | helper | label | l3proto | protocol | bytes | packets} ct {original | reply} {l3proto | protocol | saddr | daddr | proto-src | proto-dst | bytes | packets} Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Correct description of -n/--numeric optionJon Jensen2016-10-291-7/+5
| | | | | | | | | | | | "When used twice" was used twice in the manpage. :) And as Florian Westphal pointed out, it was also incorrect for the -nn case. Update the manpage and built-in help in main.c to match actual behavior. Signed-off-by: Jon Jensen <jon@endpoint.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* Replace tests/files/expr-rt with Python based tests, and replace ether typeAnders K. Pedersen2016-10-291-3/+3
| | | | | | | with meta nfproto, which generates a bit fewer instructions. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* src: add fib expressionFlorian Westphal2016-10-281-0/+75
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adds the 'fib' expression which can be used to obtain the output interface from the route table based on either source or destination address of a packet. This can be used to e.g. add reverse path filtering: # drop if not coming from the same interface packet # arrived on # nft add rule x prerouting fib saddr . iif oif eq 0 drop # accept only if from eth0 # nft add rule x prerouting fib saddr . iif oif eq "eth0" accept # accept if from any valid interface # nft add rule x prerouting fib saddr oif accept Querying of address type is also supported. This can be used to e.g. only accept packets to addresses configured in the same interface: # fib daddr . iif type local Its also possible to use mark and verdict map, e.g.: # nft add rule x prerouting meta mark set 0xdead fib daddr . mark type vmap { blackhole : drop, prohibit : drop, unicast : accept } Signed-off-by: Florian Westphal <fw@strlen.de>
* rt: introduce routing expressionAnders K. Pedersen2016-10-281-0/+84
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce rt expression for routing related data with support for nexthop (i.e. the directly connected IP address that an outgoing packet is sent to), which can be used either for matching or accounting, eg. # nft add rule filter postrouting \ ip daddr 192.168.1.0/24 rt nexthop != 192.168.0.1 drop This will drop any traffic to 192.168.1.0/24 that is not routed via 192.168.0.1. # nft add rule filter postrouting \ flow table acct { rt nexthop timeout 600s counter } # nft add rule ip6 filter postrouting \ flow table acct { rt nexthop timeout 600s counter } These rules count outgoing traffic per nexthop. Note that the timeout releases an entry if no traffic is seen for this nexthop within 10 minutes. # nft add rule inet filter postrouting \ ether type ip \ flow table acct { rt nexthop timeout 600s counter } # nft add rule inet filter postrouting \ ether type ip6 \ flow table acct { rt nexthop timeout 600s counter } Same as above, but via the inet family, where the ether type must be specified explicitly. "rt classid" is also implemented identical to "meta rtclassid", since it is more logical to have this match in the routing expression going forward. Signed-off-by: Anders K. Pedersen <akp@cohaesio.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: payload and conntrack statementFlorian Westphal2016-09-091-1/+81
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update meta expressionFlorian Westphal2016-09-091-0/+6
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: document log, reject, counter, meta, limit, nat and queue statementsPablo Neira Ayuso2016-09-081-3/+457
| | | | | | | | | This patch adds the missing documentation for the aforementioned statements. This is based on original work from Shivani Bhardwaj. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: add my copyright statement to the manpagePablo Neira Ayuso2016-09-081-4/+17
| | | | | | | Update the manpage to include my copyright statement and credit me as author of this software. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: Update datatypesLaura Garcia Liebana2016-06-061-26/+16
| | | | | | | | | Fix references to obsolete datatypes in the manpage. We renamed them at some point in the development but we forgot to update this documentation. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix old parameters and update datatypesv0.6Laura Garcia Liebana2016-06-021-8/+8
| | | | | | | | Fix old identifiers like 'ipcomp' and 'op' with 'comp' and 'operation' instead. Update some FIXME datatypes. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix compression parameter indexLaura Garcia Liebana2016-06-011-1/+1
| | | | | | | Fix the compression parameter index 'cpi' instead of 'cfi'. Signed-off-by: Laura Garcia Liebana <nevola@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add ecn supportPablo Neira Ayuso2016-05-111-0/+10
| | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule ip filter forward ip ecn ce counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000003 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000003 ] [ counter pkts 0 bytes 0 ] For IPv6: # nft --debug=netlink add rule ip6 filter forward ip6 ecn ce counter ip6 filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x00000030 ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000030 ] [ counter pkts 0 bytes 0 ] Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add dscp supportPablo Neira Ayuso2016-05-111-3/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This supports both IPv4: # nft --debug=netlink add rule filter forward ip dscp cs1 counter ip filter forward [ payload load 1b @ network header + 1 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x000000fc ) ^ 0x00000000 ] [ cmp neq reg 1 0x00000080 ] [ counter pkts 0 bytes 0 ] And also IPv6, note that in this case we take two bytes from the payload: # nft --debug=netlink add rule ip6 filter input ip6 dscp cs4 counter ip6 filter input [ payload load 2b @ network header + 0 => reg 1 ] [ bitwise reg 1 = (reg=1 & 0x0000c00f ) ^ 0x00000000 ] [ cmp eq reg 1 0x00000008 ] [ counter pkts 0 bytes 0 ] Given the DSCP is split in two bytes, the less significant nibble of the first byte and the two most significant 2 bits of the second byte. The 8 bit traffic class in RFC2460 after the version field are used for DSCP (6 bit) and ECN (2 bit). Support for ECN comes in a follow up patch. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* proto: update IPv6 flowlabel offset and length according to RFC2460Pablo Neira Ayuso2016-05-111-1/+1
| | | | | | This is a 20 bit field according to Section 3. IPv6 Header Format. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: Fixed a typo and added/changed punctuationPiyush Pangtey2016-03-091-16/+16
| | | | | | | | | | | In nft's man page , instead of using '/' between shortopt and longopt in the "SYNOPSIS" and "OPTIONS" section , use '|' and ',' respectively. (just like the man pages of iptables, etc.) Fixed a typo and added missing ',' . Signed-off-by: Piyush Pangtey <gokuvsvegita@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update ct expressionFlorian Westphal2016-01-151-9/+36
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update meta and ct expression keyword listsFlorian Westphal2016-01-041-0/+62
| | | | | Signed-off-by: Florian Westphal <fw@strlen.de> Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add netdev family supportPablo Neira Ayuso2015-06-161-0/+42
| | | | | | | | | | | | | | | | | | | | | This patch adds support for the new 'netdev' table. So far, this table allows you to create filter chains from ingress. The following example shows a very simple base configuration with one table that contains a basechain that is attached to the 'eth0': # nft list table netdev filter table netdev filter { chain eth0-ingress { type filter hook ingress device eth0 priority 0; policy accept; } } You can test that this works by adding a simple rule with counters: # nft add rule netdev filter eth0-ingress counter Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: allow to specify the default policy for base chainsPablo Neira Ayuso2015-03-171-0/+1
| | | | | | | | | | | | | | | | | | The new syntax is: nft add chain filter input { hook input type filter priority 0\; policy accept\; } but the previous syntax is still allowed: nft add chain filter input { hook input type filter priority 0\; } this assumes default policy to accept. If the base chain already exists, you can update the policy via: nft add chain filter input { policy drop\; } Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add a reference to the wiki page in the man pageArturo Borrero2015-01-071-0/+3
| | | | | | | | Let's add a pointer in the man page to the wiki page. Requested-by: Dan Jacobson <jidanni@jidanni.org> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* nft: don't resolve hostnames by defaultArturo Borrero2014-11-061-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | This patch changes the default behaviour of nft to not translate IP addresses to hostnames when printing rules if no options are passed. The options regarding translations after this patch are: <no -n/-N> show IP addresses numerically (default behaviour) -n show IP addresses numerically -nn show Internet services and uid/gid numerically -nnn show protocols numerically -N (--reversedns) translate IP addresses to names The idea is to avoid breaking existing scripts that most likely rely on '-n' to save the ruleset, so we reduce the impact of this patch and provide a default behaviour that doesn't generate network traffic when listing / saving the ruleset. Joint work with Pablo. Suggested-by: Patrick McHardy <kaber@trash.net> Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft: Fix trivial error in man page where flush should be renameKevin Fenzi2014-08-241-1/+1
| | | | | | | | Trivial fix, but someone filed a bug on it, and it should be fixed. ;) https://bugzilla.redhat.com/show_bug.cgi?id=1132917 Signed-off-by: Kevin Fenzi <kevin@scrye.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: update documentation with 'monitor' and 'export'Arturo Borrero2014-08-081-3/+67
| | | | | | | | | | Let's add info about 'monitor' and 'export'. While at it, fix other minors things, like the no-netlink return code and indentations of the document. Signed-off-by: Arturo Borrero Gonzalez <arturo.borrero.glez@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: fix make install problemsPatrick McHardy2014-04-141-0/+2168
-e INSTALL doc /usr/bin/install: cannot stat 'doc/nftables.8': No such file or directory make[1]: *** [install] Error 1 make: *** [doc] Error 2 Rename everything to nft.* to fix this up. Reported-by: Ana Rey <anarey@gmail.com> Signed-off-by: Patrick McHardy <kaber@trash.net>
generated by cgit v1.2.3 (git 2.25.0) at 2024-11-16 16:56:50 +0000