summaryrefslogtreecommitdiffstats
path: root/doc
diff options
context:
space:
mode:
authorPhil Sutter <phil@nwl.cc>2017-03-16 13:43:21 +0100
committerPablo Neira Ayuso <pablo@netfilter.org>2017-03-20 11:17:23 +0100
commitfb04310517f96741003a971eaf9cb799f52b62a2 (patch)
treeafffa1ec7f824471c340ac8a100a78f96c7336fc /doc
parent9ade8fb75f8963375b45b3f2973b8bb7aa66ad76 (diff)
doc: Describe ICMP(v6) expression and types
This adds a description of the icmp and icmpv6 expressions (to match various ICMP header fields) as well as the icmp and icmpv6 type types (yay) which are used for ICMP(v6) type field. Signed-off-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'doc')
-rw-r--r--doc/nft.xml380
1 files changed, 380 insertions, 0 deletions
diff --git a/doc/nft.xml b/doc/nft.xml
index b3e3d9e7..d4121846 100644
--- a/doc/nft.xml
+++ b/doc/nft.xml
@@ -1504,6 +1504,254 @@ filter input tcp option timestamp exists
</programlisting>
</example>
</refsect2>
+ <refsect2>
+ <title>ICMP Type type</title>
+ <para>
+ <table frame="all">
+ <tgroup cols="4" align="left" colsep="1" rowsep="1">
+ <colspec colname="c1"/>
+ <colspec colname="c2"/>
+ <colspec colname="c3"/>
+ <colspec colname="c4"/>
+ <thead>
+ <row>
+ <entry>Name</entry>
+ <entry>Keyword</entry>
+ <entry>Size</entry>
+ <entry>Base type</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>ICMP Type</entry>
+ <entry>icmp_type</entry>
+ <entry>8 bit</entry>
+ <entry>integer</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ <para>
+ The ICMP Type type is used to conveniently specify the ICMP header's type field.
+ </para>
+ <para>
+ The following keywords may be used when specifying the ICMP type:
+ <table frame="all">
+ <tgroup cols="2" align="left" colsep="1" rowsep="1">
+ <colspec colname="c1"/>
+ <colspec colname="c2"/>
+ <thead>
+ <row>
+ <entry>Keyword</entry>
+ <entry>Value</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>echo-reply</entry>
+ <entry>0</entry>
+ </row>
+ <row>
+ <entry>destination-unreachable</entry>
+ <entry>3</entry>
+ </row>
+ <row>
+ <entry>source-quench</entry>
+ <entry>4</entry>
+ </row>
+ <row>
+ <entry>redirect</entry>
+ <entry>5</entry>
+ </row>
+ <row>
+ <entry>echo-request</entry>
+ <entry>8</entry>
+ </row>
+ <row>
+ <entry>router-advertisement</entry>
+ <entry>9</entry>
+ </row>
+ <row>
+ <entry>router-solicitation</entry>
+ <entry>10</entry>
+ </row>
+ <row>
+ <entry>time-exceeded</entry>
+ <entry>11</entry>
+ </row>
+ <row>
+ <entry>parameter-problem</entry>
+ <entry>12</entry>
+ </row>
+ <row>
+ <entry>timestamp-request</entry>
+ <entry>13</entry>
+ </row>
+ <row>
+ <entry>timestamp-reply</entry>
+ <entry>14</entry>
+ </row>
+ <row>
+ <entry>info-request</entry>
+ <entry>15</entry>
+ </row>
+ <row>
+ <entry>info-reply</entry>
+ <entry>16</entry>
+ </row>
+ <row>
+ <entry>address-mask-request</entry>
+ <entry>17</entry>
+ </row>
+ <row>
+ <entry>address-mask-reply</entry>
+ <entry>18</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ <example>
+ <title>ICMP Type specification</title>
+ <programlisting>
+# match ping packets
+filter output icmp type { echo-request, echo-reply }
+ </programlisting>
+ </example>
+ </refsect2>
+ <refsect2>
+ <title>ICMPv6 Type type</title>
+ <para>
+ <table frame="all">
+ <tgroup cols="4" align="left" colsep="1" rowsep="1">
+ <colspec colname="c1"/>
+ <colspec colname="c2"/>
+ <colspec colname="c3"/>
+ <colspec colname="c4"/>
+ <thead>
+ <row>
+ <entry>Name</entry>
+ <entry>Keyword</entry>
+ <entry>Size</entry>
+ <entry>Base type</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>ICMPv6 Type</entry>
+ <entry>icmpv6_type</entry>
+ <entry>8 bit</entry>
+ <entry>integer</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ <para>
+ The ICMPv6 Type type is used to conveniently specify the ICMPv6 header's type field.
+ </para>
+ <para>
+ The following keywords may be used when specifying the ICMPv6 type:
+ <table frame="all">
+ <tgroup cols="2" align="left" colsep="1" rowsep="1">
+ <colspec colname="c1"/>
+ <colspec colname="c2"/>
+ <thead>
+ <row>
+ <entry>Keyword</entry>
+ <entry>Value</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>destination-unreachable</entry>
+ <entry>1</entry>
+ </row>
+ <row>
+ <entry>packet-too-big</entry>
+ <entry>2</entry>
+ </row>
+ <row>
+ <entry>time-exceeded</entry>
+ <entry>3</entry>
+ </row>
+ <row>
+ <entry>parameter-problem</entry>
+ <entry>4</entry>
+ </row>
+ <row>
+ <entry>echo-request</entry>
+ <entry>128</entry>
+ </row>
+ <row>
+ <entry>echo-reply</entry>
+ <entry>129</entry>
+ </row>
+ <row>
+ <entry>mld-listener-query</entry>
+ <entry>130</entry>
+ </row>
+ <row>
+ <entry>mld-listener-report</entry>
+ <entry>131</entry>
+ </row>
+ <row>
+ <entry>mld-listener-done</entry>
+ <entry>132</entry>
+ </row>
+ <row>
+ <entry>mld-listener-reduction</entry>
+ <entry>132</entry>
+ </row>
+ <row>
+ <entry>nd-router-solicit</entry>
+ <entry>133</entry>
+ </row>
+ <row>
+ <entry>nd-router-advert</entry>
+ <entry>134</entry>
+ </row>
+ <row>
+ <entry>nd-neighbor-solicit</entry>
+ <entry>135</entry>
+ </row>
+ <row>
+ <entry>nd-neighbor-advert</entry>
+ <entry>136</entry>
+ </row>
+ <row>
+ <entry>nd-redirect</entry>
+ <entry>137</entry>
+ </row>
+ <row>
+ <entry>router-renumbering</entry>
+ <entry>138</entry>
+ </row>
+ <row>
+ <entry>ind-neighbor-solicit</entry>
+ <entry>141</entry>
+ </row>
+ <row>
+ <entry>ind-neighbor-advert</entry>
+ <entry>142</entry>
+ </row>
+ <row>
+ <entry>mld2-listener-report</entry>
+ <entry>143</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ <example>
+ <title>ICMPv6 Type specification</title>
+ <programlisting>
+# match ICMPv6 ping packets
+filter output icmpv6 type { echo-request, echo-reply }
+ </programlisting>
+ </example>
+ </refsect2>
</refsect1>
<refsect1>
@@ -2171,6 +2419,70 @@ inet filter meta nfproto ipv6 output rt nexthop fd00::1
</refsect2>
<refsect2>
+ <title>ICMP header expression</title>
+ <para>
+ <cmdsynopsis>
+ <command>icmp</command>
+ <arg opt="req"><replaceable>ICMP header field</replaceable></arg>
+ </cmdsynopsis>
+ </para>
+ <para>
+ <table frame="all">
+ <title>ICMP header expression</title>
+ <tgroup cols="3" align="left" colsep="1" rowsep="1">
+ <colspec colname="c1"/>
+ <colspec colname="c2"/>
+ <colspec colname="c3"/>
+ <thead>
+ <row>
+ <entry>Keyword</entry>
+ <entry>Description</entry>
+ <entry>Type</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>type</entry>
+ <entry>ICMP type field</entry>
+ <entry>icmp_type</entry>
+ </row>
+ <row>
+ <entry>code</entry>
+ <entry>ICMP code field</entry>
+ <entry>integer (8 bit)</entry>
+ </row>
+ <row>
+ <entry>checksum</entry>
+ <entry>ICMP checksum field</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ <row>
+ <entry>id</entry>
+ <entry>ID of echo request/response</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ <row>
+ <entry>sequence</entry>
+ <entry>sequence number of echo request/response</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ <row>
+ <entry>gateway</entry>
+ <entry>gateway of redirects</entry>
+ <entry>integer (32 bit)</entry>
+ </row>
+ <row>
+ <entry>mtu</entry>
+ <entry>MTU of path MTU discovery</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ </refsect2>
+
+ <refsect2>
<title>IPv6 header expression</title>
<para>
<cmdsynopsis>
@@ -2245,6 +2557,74 @@ inet filter meta nfproto ipv6 output rt nexthop fd00::1
</refsect2>
<refsect2>
+ <title>ICMPv6 header expression</title>
+ <para>
+ <cmdsynopsis>
+ <command>icmpv6</command>
+ <arg opt="req"><replaceable>ICMPv6 header field</replaceable></arg>
+ </cmdsynopsis>
+ </para>
+ <para>
+ <table frame="all">
+ <title>ICMPv6 header expression</title>
+ <tgroup cols="3" align="left" colsep="1" rowsep="1">
+ <colspec colname="c1"/>
+ <colspec colname="c2"/>
+ <colspec colname="c3"/>
+ <thead>
+ <row>
+ <entry>Keyword</entry>
+ <entry>Description</entry>
+ <entry>Type</entry>
+ </row>
+ </thead>
+ <tbody>
+ <row>
+ <entry>type</entry>
+ <entry>ICMPv6 type field</entry>
+ <entry>icmpv6_type</entry>
+ </row>
+ <row>
+ <entry>code</entry>
+ <entry>ICMPv6 code field</entry>
+ <entry>integer (8 bit)</entry>
+ </row>
+ <row>
+ <entry>checksum</entry>
+ <entry>ICMPv6 checksum field</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ <row>
+ <entry>parameter-problem</entry>
+ <entry>pointer to problem</entry>
+ <entry>integer (32 bit)</entry>
+ </row>
+ <row>
+ <entry>packet-too-big</entry>
+ <entry>oversized MTU</entry>
+ <entry>integer (32 bit)</entry>
+ </row>
+ <row>
+ <entry>id</entry>
+ <entry>ID of echo request/response</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ <row>
+ <entry>sequence</entry>
+ <entry>sequence number of echo request/response</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ <row>
+ <entry>max-delay</entry>
+ <entry>maximum response delay of MLD queries</entry>
+ <entry>integer (16 bit)</entry>
+ </row>
+ </tbody>
+ </tgroup>
+ </table>
+ </para>
+ </refsect2>
+ <refsect2>
<title>TCP header expression</title>
<para>
<cmdsynopsis>