diff options
author | Balazs Scheidler <bazsi77@gmail.com> | 2020-08-29 09:04:03 +0200 |
---|---|---|
committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2020-08-29 13:16:57 +0200 |
commit | de8d3f35148899343a7e75dce5bbdaeceaf765ab (patch) | |
tree | 558ea0bc9c14325ce55564db51233b32a8285a42 /doc | |
parent | 8da21149a9f55973ab6e5a9567edfac277e3d6b2 (diff) |
doc: added documentation on "socket wildcard"
Signed-off-by: Balazs Scheidler <bazsi77@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc')
-rw-r--r-- | doc/primary-expression.txt | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/doc/primary-expression.txt b/doc/primary-expression.txt index a9c39cbb..e87e8cc2 100644 --- a/doc/primary-expression.txt +++ b/doc/primary-expression.txt @@ -195,7 +195,7 @@ raw prerouting meta ipsec exists accept SOCKET EXPRESSION ~~~~~~~~~~~~~~~~~ [verse] -*socket* {*transparent* | *mark*} +*socket* {*transparent* | *mark* | *wildcard*} Socket expression can be used to search for an existing open TCP/UDP socket and its attributes that can be associated with a packet. It looks for an established @@ -209,15 +209,20 @@ or non-zero bound listening socket (possibly with a non-local address). Value of the IP_TRANSPARENT socket option in the found socket. It can be 0 or 1.| boolean (1 bit) |mark| Value of the socket mark (SOL_SOCKET, SO_MARK). | mark +|wildcard| +Indicates whether the socket is wildcard-bound (e.g. 0.0.0.0 or ::0). | +boolean (1 bit) |================== .Using socket expression ------------------------ -# Mark packets that correspond to a transparent socket +# Mark packets that correspond to a transparent socket. "socket wildcard 0" +# means that zero-bound listener sockets are NOT matched (which is usually +# exactly what you want). table inet x { chain y { type filter hook prerouting priority -150; policy accept; - socket transparent 1 mark set 0x00000001 accept + socket transparent 1 socket wildcard 0 mark set 0x00000001 accept } } |