From 8969206a63db5710a4889e6fe56523830c84633f Mon Sep 17 00:00:00 2001 From: Phil Sutter Date: Thu, 10 Aug 2017 19:29:16 +0200 Subject: nft.8: Describe conntrack types Signed-off-by: Phil Sutter Signed-off-by: Pablo Neira Ayuso --- doc/nft.xml | 230 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 230 insertions(+) (limited to 'doc') diff --git a/doc/nft.xml b/doc/nft.xml index de8c2cb9..05790ba6 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -1931,6 +1931,232 @@ filter output icmpv6 type { echo-request, echo-reply } + + Conntrack types + + This is an overview of types used in ct + expression and statement: + + + + + + + + + Name + Keyword + Size + Base type + + + + + conntrack state + ct_state + 4 byte + bitmask + + + conntrack direction + ct_dir + 8 bit + integer + + + conntrack status + ct_status + 4 byte + bitmask + + + conntrack event bits + ct_event + 4 byte + bitmask + + + conntrack label + ct_label + 128 bit + bitmask + + + +
+ + + For each of the types above, keywords are available for convenience: + + conntrack state (ct_state) + + + + + + Keyword + Value + + + + + invalid + 1 + + + established + 2 + + + related + 4 + + + new + 8 + + + untracked + 64 + + + +
+ + + conntrack direction (ct_dir) + + + + + + Keyword + Value + + + + + original + 0 + + + reply + 1 + + + +
+ + + conntrack status (ct_status) + + + + + + Keyword + Value + + + + + expected + 1 + + + seen-reply + 2 + + + assured + 4 + + + confirmed + 8 + + + snat + 16 + + + dnat + 32 + + + dying + 512 + + + +
+ + + conntrack event bits (ct_event) + + + + + + Keyword + Value + + + + + new + 1 + + + related + 2 + + + destroy + 4 + + + reply + 8 + + + assured + 16 + + + protoinfo + 32 + + + helper + 64 + + + mark + 128 + + + seqadj + 256 + + + secmark + 512 + + + label + 1024 + + + +
+ + Possible keywords for conntrack label type + (ct_label) are read at runtime from + /etc/connlabel.conf. + + + @@ -3587,6 +3813,10 @@ ip6 filter input frag more-fragments 1 counter + + A description of conntrack-specific types listed above can be + found sub-section CONNTRACK TYPES above. + -- cgit v1.2.3