diff options
author | Florian Westphal <fw@strlen.de> | 2013-05-06 21:07:38 +0200 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2013-05-06 21:07:38 +0200 |
commit | ccbf6b6448a4210432b76fd4660798705b05f8c4 (patch) | |
tree | f41c1d1b789dd50d77c4570b841db4cfc3506fd3 /extensions/libxt_connlabel.man | |
parent | ca376fcbe51b9a102a490545957d5fee69e253e1 (diff) |
extensions: add connlabel match
allows to "tag" connections with up to 128 label names.
Labels are defined in /etc/xtables/connlabel.conf, example:
0 from eth0
1 via eth0
Labels can then be attached to flows, e.g.
-A PREROUTING -i eth0 -m connlabel --label "from eth0" --set
Signed-off-by: Florian Westphal <fw@strlen.de>
Diffstat (limited to 'extensions/libxt_connlabel.man')
-rw-r--r-- | extensions/libxt_connlabel.man | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/extensions/libxt_connlabel.man b/extensions/libxt_connlabel.man new file mode 100644 index 00000000..9fd2043d --- /dev/null +++ b/extensions/libxt_connlabel.man @@ -0,0 +1,32 @@ +Module matches or adds connlabels to a connection. +connlabels are similar to connmarks, except labels are bit-based; i.e. +all labels may be attached to a flow at the same time. +Up to 128 unique labels are currently supported. +.TP +[\fB!\fP] \fB\-\-label\fP \fBname\fP +matches if label \fBname\fP has been set on a connection. +Instead of a name (which will be translated to a number, see EXAMPLE below), +a number may be used instead. Using a number always overrides connlabel.conf. +.TP +\fB\-\-set\fP +if the label has not been set on the connection, set it. +Note that setting a label can fail. This is because the kernel allocates the +conntrack label storage area when the connection is created, and it only +reserves the amount of memory required by the ruleset that exists at +the time the connection is created. +In this case, the match will fail (or succeed, in case \fB\-\-label\fP +option was negated). +.PP +Label translation is done via the \fB/etc/xtables/connlabel.conf\fP configuration file. +.PP +Example: +.IP +.nf +0 eth0-in +1 eth0-out +2 ppp-in +3 ppp-out +4 bulk-traffic +5 interactive +.fi +.PP |