diff options
author | Florian Westphal <fw@strlen.de> | 2017-03-14 17:22:03 +0100 |
---|---|---|
committer | Florian Westphal <fw@strlen.de> | 2017-03-16 10:10:07 +0100 |
commit | 5f7aa332ff4d8cdf91a43c04688dfd74e048b1e5 (patch) | |
tree | 6004d3cbd33fa5cf26d408cea40946ca9efa228f /doc/nft.xml | |
parent | 8d9e663e64be13edc6192e8b2d756c391709d4ca (diff) |
doc: ct helper objects and helper set support
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc/nft.xml')
-rw-r--r-- | doc/nft.xml | 76 |
1 files changed, 76 insertions, 0 deletions
diff --git a/doc/nft.xml b/doc/nft.xml index 506a1cc7..b3e3d9e7 100644 --- a/doc/nft.xml +++ b/doc/nft.xml @@ -950,6 +950,77 @@ filter input iif $int_ifs accept </variablelist> <refsect2> + <title>Ct</title> + <para> + <cmdsynopsis> + <command>ct</command> + <arg choice="req">helper</arg> + <arg choice="req">type</arg> + <arg choice="req"><replaceable>type</replaceable></arg> + <arg choice="req">protocol</arg> + <arg choice="req"><replaceable>protocol</replaceable></arg> + <arg choice="opt">l3proto</arg> + <arg choice="opt"><replaceable>family</replaceable></arg> + </cmdsynopsis> + </para> + <para> + Ct helper is used to define connection tracking helpers that can then be used in combination with the <literal>"ct helper set"</literal> statement. + type and protocol are mandatory, l3proto is derived from the table family by default, i.e. in the inet table the kernel will + try to load both the ipv4 and ipv6 helper backends, if they are supported by the kernel. + </para> + <table frame="all"> + <title>conntrack helper specifications</title> + <tgroup cols='3' align='left' colsep='1' rowsep='1'> + <colspec colname='c1'/> + <colspec colname='c2'/> + <colspec colname='c3'/> + <thead> + <row> + <entry>Keyword</entry> + <entry>Description</entry> + <entry>Type</entry> + </row> + </thead> + <tbody> + <row> + <entry>type</entry> + <entry>name of helper type</entry> + <entry>quoted string (e.g. "ftp")</entry> + </row> + <row> + <entry>protocol</entry> + <entry>layer 4 protocol of the helper</entry> + <entry>string (e.g. tcp)</entry> + </row> + <row> + <entry>l3proto</entry> + <entry>layer 3 protocol of the helper</entry> + <entry>address family (e.g. ip)</entry> + </row> + </tbody> + </tgroup> + </table> + <example> + <title>defining and assigning ftp helper</title> + <para> + Unlike iptables, helper assignment needs to be performed after the conntrack lookup has completed, for example + with the default 0 hook priority. + </para> + <programlisting> +table inet myhelpers { + ct helper ftp-standard { + type "ftp" protocol tcp + } + chain prerouting { + type filter hook prerouting priority 0; + tcp dport 21 ct helper set "ftp-standard" + } +} + </programlisting> + </example> + </refsect2> + + <refsect2> <title>Counter</title> <para> <cmdsynopsis> @@ -3376,6 +3447,11 @@ ip6 filter output log flags all </thead> <tbody> <row> + <entry>helper</entry> + <entry>name of ct helper object to assign to the connection</entry> + <entry>quoted string</entry> + </row> + <row> <entry>mark</entry> <entry>Connection tracking mark</entry> <entry>mark</entry> |