summaryrefslogtreecommitdiffstats
path: root/doc
Commit message (Collapse)AuthorAgeFilesLines
* doc: Basic documentation of anonymous chainsHEADmasterPhil Sutter17 hours2-4/+18
| | | | | | | Joint work with Folsk Pratima. Signed-off-by: Folsk Pratima <folsk0pratima@cock.li> Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: Fix typo in nat statement 'prefix' descriptionPhil Sutter2025-05-131-1/+1
| | | | | | | No point in repeating 'to map' here. Fixes: 19d73ccdd39fa ("doc: add nat examples") Signed-off-by: Phil Sutter <phil@nwl.cc>
* parser_json: Introduce parse_flags_array()Phil Sutter2025-05-131-2/+3
| | | | | | | | | | | | | | | | Various objects support a 'flags' property with value usually being an array of strings. There is a special case, when merely a single flag is set: The value may be a string representing this flag. Introduce a function assisting in parsing this polymorphic value. Have callers pass a parser callback translating a single flag name into a corresponding value. Luckily, these single flag parsers are very common already. As a side-effect, enable the single flag spec for set flags as well and update the documentation accordingly. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: add mptcp to tcp option matching listFlorian Westphal2025-03-071-2/+7
| | | | | Suggested-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* fib: Change data type of fib oifname to "ifname"Xiao Liang2025-02-251-2/+2
| | | | | | | | | | | | | | | Change data type of fib oifname from "string" to "ifname", so that it can be matched against a set of ifnames: set x { type ifname } chain y { fib saddr oifname @x drop } Signed-off-by: Xiao Liang <shaw.leon@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: compact and simplify list and reset syntaxFlorian Westphal2025-02-211-10/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Works: list sets list sets inet list sets table inet foo Doesn't work: list sets inet foo Same for "list counters", "list quotas", etc. "reset" keyword however supports this: reset counters inet foo and aliased this to reset counters table inet foo This is inconsistent and not inuitive. Moreover, unlike "list sets", "list maps" only supported "list maps" and "list maps inet", without the ability to only list maps of a given table. Compact this to unify the syntax so it becomes possible to omit the "table" keyword for either reset or list mode. flowtables, secmarks and synproxys keywords are updated too. "flow table" and "meters" are NOT changed since both of these are deprecated in favor of standard nft sets. Reported-by: Slavko <linux@slavino.sk> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser_bison: turn redundant ip option type field match into booleanPablo Neira Ayuso2025-02-071-4/+4
| | | | | | | | | | | | | | | | | | The ip option expression allows for non-sense matching like: ip option lsrr type 1 because 'lsrr' already provides the type field, this never results in a matching. Turn this expression into: ip option lsrr exists And update documentation to hide this redundant type field. Fixes: 226a0e072d5c ("exthdr: add support for matching IPv4 options") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* json: Support typeof in set and map typesPhil Sutter2024-11-061-3/+4
| | | | | | | | | | | | | | | | Implement this as a special "type" property value which is an object with sole property "typeof". The latter's value is the JSON representation of the expression in set->key, so for concatenated typeofs it is a concat expression. All this is a bit clumsy right now but it works and it should be possible to tear it down a bit for more user-friendliness in a compatible way by either replacing the concat expression by the array it contains or even the whole "typeof" object - the parser would just assume any object (or objects in an array) in the "type" property value are expressions to extract a type from. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: extend description of fib expressionFlorian Westphal2024-10-301-14/+63
| | | | | | | | | | | | | | Describe the input keys and the result types. Mention which input keys are mandatory and which keys are mutually exclusive. Describe which hooks can be used with the various lookup modifiers and extend the examples with more information on fib expression capabilities. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1663 Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>
* libnftables-json: fix raw payload expression documentationEric Long2024-10-171-1/+1
| | | | | | | | Raw payload expression accesses payload data in bits, not bytes. Fixes: 872f373dc50f7 ("doc: Add JSON schema documentation") Signed-off-by: Eric Long <i@hack3r.moe> Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: tproxy is non-terminal in nftablesPablo Neira Ayuso2024-09-171-7/+38
| | | | | | | | | iptables TPROXY issues NF_ACCEPT while nftables tproxy allows for post-processing. Update examples. For more info, see: https://lore.kernel.org/netfilter-devel/ZuSh_Io3Yt8LkyUh@orbyte.nwl.cc/T/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: mnl: always dump all netdev hooks if no interface name was givenFlorian Westphal2024-08-211-4/+4
| | | | | | | | | Instead of not returning any results for nft list hooks netdev Iterate all interfaces and then query all of them. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: update outdated route and pkttype info谢致邦 (XIE Zhibang)2024-08-202-2/+2
| | | | | | | | inet family supports route type. unicast pkttype changed to host pkttype. Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: add documentation about list hooks featureFlorian Westphal2024-08-192-62/+117
| | | | | | | | | | | | | | Add a brief segment about 'nft list hooks' and a summary of the output format. As nft.txt is quite large, split the additonal commands into their own file. The existing listing section is removed; list subcommand is already mentioned in the relevant statement sections. Reported-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Florian Westphal <fw@strlen.de>
* libnftables: add base directory of -f/--filename to include pathPablo Neira Ayuso2024-06-251-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | This patch adds an include path relative to the current (the including) file's directory. Users of -f/--filename have to explicitly specify -I with a redundant path to find included files in the main file, eg. # nft -I /path/to/files -f /path/to/files/ruleset.nft Assuming: # cat /path/to/files/ruleset.nft include "file1.nft" include "file2.nft" include "file3.nft" The follow up patch ("libnftables: search for default include path last") is also required according to what it is described in the manpage update coming with this patch. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1661 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: drop duplicate ARP HEADER EXPRESSION谢致邦 (XIE Zhibang)2024-05-281-38/+0
| | | | | Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: nft.8: Highlight "hook" in flowtable descriptionPhil Sutter2024-04-241-2/+2
| | | | | | | | Lacking an explicit description of possible hook values, emphasising the word in the description text should draw readers' attention in the right direction. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: nft.8: Fix markup in ct expectation synopsisPhil Sutter2024-04-241-1/+1
| | | | | | | Just a missing asterisk somewhere. Fixes: 1dd08fcfa07a4 ("src: add ct expectations support") Signed-off-by: Phil Sutter <phil@nwl.cc>
* Add support for table's persist flagPhil Sutter2024-04-192-1/+19
| | | | | | | | | Bison parser lacked support for passing multiple flags, JSON parser did not support table flags at all. Document also 'owner' flag (and describe their relationship in nft.8. Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Accept more than two operands in binary expressionsPhil Sutter2024-04-121-8/+10
| | | | | | | | | | | | | | The most common use case is ORing flags like | syn | ack | rst but nft seems to be fine with less intuitive stuff like | meta mark set ip dscp << 2 << 3 so support all of them. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: nft.8: Two minor synopsis fixupsPhil Sutter2024-04-111-2/+2
| | | | | | | | | | | | The curly braces in 'add table' are to be put literally, so need to be bold. Also, they are optional unless either one (or both) of 'comment' and 'flags' are specified. The 'add chain' synopsis contained a stray tick, messing up the following markup. Fixes: 7fd67ce121f86 ("doc: fix synopsis of named counter, quota and ct {helper,timeout,expect}") Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: disentangle ICMP code typesPablo Neira Ayuso2024-04-042-85/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, ICMP{v4,v6,inet} code datatypes only describe those that are supported by the reject statement, but they can also be used for icmp code matching. Moreover, ICMP code types go hand-to-hand with ICMP types, that is, ICMP code symbols depend on the ICMP type. Thus, the output of: nft describe icmp_code look confusing because that only displays the values that are supported by the reject statement. Disentangle this by adding internal datatypes for the reject statement to handle the ICMP code symbol conversion to value as well as ruleset listing. The existing icmp_code, icmpv6_code and icmpx_code remain in place. For backward compatibility, a parser function is defined in case an existing ruleset relies on these symbols. As for the manpage, move existing ICMP code tables from the DATA TYPES section to the REJECT STATEMENT section, where this really belongs to. But the icmp_code and icmpv6_code table stubs remain in the DATA TYPES section because that describe that this is an 8-bit integer field. After this patch: # nft describe icmp_code datatype icmp_code (icmp code) (basetype integer), 8 bits # nft describe icmpv6_code datatype icmpv6_code (icmpv6 code) (basetype integer), 8 bits # nft describe icmpx_code datatype icmpx_code (icmpx code) (basetype integer), 8 bits do not display the symbol table of the reject statement anymore. icmpx_code_type is not used anymore, but keep it in place for backward compatibility reasons. And update tests/shell accordingly. Fixes: 5fdd0b6a0600 ("nft: complete reject support") Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* netlink_delinearize: reverse cross-day meta hour rangePablo Neira Ayuso2024-03-201-3/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | f8f32deda31d ("meta: Introduce new conditions 'time', 'day' and 'hour'") reverses the hour range in case that a cross-day range is used, eg. meta hour "03:00"-"14:00" counter accept which results in (Sidney, Australia AEDT time): meta hour != "14:00"-"03:00" counter accept kernel handles time in UTC, therefore, cross-day range may not be obvious according to local time. The ruleset listing above is not very intuitive to the reader depending on their timezone, therefore, complete netlink delinearize path to reverse the cross-day meta range. Update manpage to recommend to use a range expression when matching meta hour range. Recommend range expression for meta time and meta day too. Extend testcases/listing/meta_time to cover for this scenario. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1737 Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: libnftables-json: Drop invalid ops from match expressionPhil Sutter2024-03-201-5/+0
| | | | | | | These make no sense there and are listed again in BINARY OPERATION. Fixes: 872f373dc50f7 ("doc: Add JSON schema documentation") Signed-off-by: Phil Sutter <phil@nwl.cc>
* json: Support sets' auto-merge optionPhil Sutter2024-01-311-2/+6
| | | | | | | | If enabled, list the option as additional attribute with boolean value. Fixes: e70354f53e9f6 ("libnftables: Implement JSON output support") Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1734 Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: clarify reject is supported at prerouting stageQuan Tian2024-01-101-1/+1
| | | | | | | | | It's supported since kernel commit f53b9b0bdc59 ("netfilter: introduce support for reject at prerouting stage"). Reported-by: Dan Winship <danwinship@redhat.com> Signed-off-by: Quan Tian <tianquan23@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: incorrect datatype description for icmpv6_type and icmpvx_codePablo Neira Ayuso2024-01-101-2/+2
| | | | | | | | | Fix incorrect description in manpage: ICMPV6 TYPE TYPE is icmpv6_type ICMPVX CODE TYPE is icmpx_code Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* build: no recursive make for "doc/Makefile.am"Thomas Haller2023-11-021-30/+0
| | | | | | | | Merge the Makefile.am under "doc/" into the toplevel Makefile.am. This is a step in the effort of dropping recursive make. Signed-off-by: Thomas Haller <thaller@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: remove references to timeout in reset commandPablo Neira Ayuso2023-10-101-5/+5
| | | | | | | | | | After Linux kernel's patch ("netfilter: nf_tables: do not refresh timeout when resetting element") timers are not reset anymore, update documentation to keep this in sync. Fixes: 83e0f4402fb7 ("Implement 'reset {set,map,element}' commands") Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* icmpv6: Allow matching target address in NS/NA, redirect and MLDNicolas Cavallari2023-10-061-1/+7
| | | | | | | | | | | | | | | It was currently not possible to match the target address of a neighbor solicitation or neighbor advertisement against a dynamic set, unlike in IPv4. Since they are many ICMPv6 messages with an address at the same offset, allow filtering on the target address for all icmp types that have one. While at it, also allow matching the destination address of an ICMPv6 redirect. Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: describe behaviour of {ip,ip6} lengthPablo Neira Ayuso2023-09-031-0/+16
| | | | | | | | This field exposes internal kernel GRO/GSO packet aggregation implementation details to userspace, provide a hint to the user to understand better when matching on this field. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add input flag NFT_CTX_INPUT_JSON to enable JSON parsingThomas Haller2023-08-241-1/+8
| | | | | | | | | | | | | | By default, the input is parsed using the nftables grammar. When setting NFT_CTX_OUTPUT_JSON flag, nftables will first try to parse the input as JSON before falling back to the nftables grammar. But NFT_CTX_OUTPUT_JSON flag also turns on JSON for the output. Add a flag NFT_CTX_INPUT_JSON which allows to treat only the input as JSON, but keep the output mode unchanged. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add input flag NFT_CTX_INPUT_NO_DNS to avoid blockingThomas Haller2023-08-241-1/+9
| | | | | | | | | | | | | | | | | | | getaddrinfo() blocks while trying to resolve the name. Blocking the caller of the library is in many cases undesirable. Also, while reconfiguring the firewall, it's not clear that resolving names via the network will work or makes sense. Add a new input flag NFT_CTX_INPUT_NO_DNS to opt-out from getaddrinfo() and only accept plain IP addresses. We could also use AI_NUMERICHOST with getaddrinfo() instead of inet_pton(). By parsing via inet_pton(), we are better aware of what we expect and can generate a better error message in case of failure. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* src: add input flags for nft_ctxThomas Haller2023-08-241-0/+13
| | | | | | | | | | | | Similar to the existing output flags, add input flags. No flags are yet implemented, that will follow. One difference to nft_ctx_output_set_flags(), is that the setter for input flags returns the previously set flags. Signed-off-by: Thomas Haller <thaller@redhat.com> Reviewed-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: move man-pages to `MAINTAINERCLEANFILES`Jeremy Sowden2023-08-101-1/+1
| | | | | | | | Since the man-pages are built and included in the distribution tar-balls, the appropriate clean target is `maintainer-clean`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: move man-pages to `dist_man_MANS`Jeremy Sowden2023-08-101-3/+3
| | | | | | | Removes the need to add them to `EXTRA_DIST`. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* parser: allow ct timeouts to use time_spec valuesFlorian Westphal2023-08-031-1/+1
| | | | | | | | | | | | | | | For some reason the parser only allows raw numbers (seconds) for ct timeouts, e.g. ct timeout ttcp { protocol tcp; policy = { syn_sent : 3, ... Also permit time_spec, e.g. "established : 5d". Print the nicer time formats on output, but retain raw numbers support on input for compatibility. Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: document add chain device parameterBrennan Paciorek2023-08-031-0/+5
| | | | | | | | | | | nft add chain lacked documentation of its optional device parameter, specifically what values the parameter accepted, what it did and when to use it. Closes: https://bugzilla.netfilter.org/show_bug.cgi?id=1093 Suggested-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Brennan Paciorek <bpaciore@redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement 'reset {set,map,element}' commandsPhil Sutter2023-07-132-6/+9
| | | | | | | | | | | All these are used to reset state in set/map elements, i.e. reset the timeout or zero quota and counter values. While 'reset element' expects a (list of) elements to be specified which should be reset, 'reset set/map' will reset all elements in the given set/map. Signed-off-by: Phil Sutter <phil@nwl.cc>
* exthdr: add boolean DCCP option matchingJeremy Sowden2023-06-012-0/+17
| | | | | | | | | | Iptables supports the matching of DCCP packets based on the presence or absence of DCCP options. Extend exthdr expressions to add this functionality to nftables. Link: https://bugzilla.netfilter.org/show_bug.cgi?id=930 Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add nat examplesFlorian Westphal2023-05-021-2/+51
| | | | | | | | | | | | | | nftables nat is much more capable than what the existing documentation describes. In particular, nftables can fully emulate iptables NETMAP target and can perform n:m address mapping. Add a new example section extracted from commit log messages when those features got added. Cc: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: list set/map flag keywords in a tableFlorian Westphal2023-05-021-3/+18
| | | | | | add descriptions of the set/map flags. Signed-off-by: Florian Westphal <fw@strlen.de>
* meta: introduce meta broute supportSriram Yagnaraman2023-04-291-1/+4
| | | | | | | | | | | Can be used in bridge prerouting hook to divert a packet to the ip stack for routing. This is a replacement for "ebtables -t broute" functionality. Link: https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230224095251.11249-1-sriram.yagnaraman@est.tech/ Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech> Signed-off-by: Florian Westphal <fw@strlen.de>
* doc: correct NAT statement descriptionJeremy Sowden2023-04-291-1/+1
| | | | | | | | Specifying a port specifies that a port, not an address, should be modified. Signed-off-by: Jeremy Sowden <jeremy@azazel.net> Signed-off-by: Florian Westphal <fw@strlen.de>
* parser_bison: simplify reset syntaxPablo Neira Ayuso2023-03-151-5/+3
| | | | | | | | | | | | | | | | | | | | | | | | | Simplify: *reset rules* *chain* ['family'] 'table' ['chain]' to *reset rules* ['family'] 'table' 'chain' *reset rules* *table* ['family'] 'table' to *reset rules* ['family'] 'table' *reset counters* ['family'] *table* 'table' to *reset counters* ['family'] 'table' *reset quotas* ['family'] *table* 'table' to *reset quotas* ['family'] 'table' Previous syntax remains in place for backward compatibility. Acked-by: Phil Sutter <phil@nwl.cc> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: nft.8: Document lower priority limit for nat type chainsPhil Sutter2023-03-101-0/+3
| | | | | | Users can't know the magic limit. Signed-off-by: Phil Sutter <phil@nwl.cc>
* src: add support to command "destroy"Fernando F. Mancera2023-02-061-10/+23
| | | | | | | | | | | | | | | | | | | | | | | | | "destroy" command performs a deletion as "delete" command but does not fail if the object does not exist. As there is no NLM_F_* flag for ignoring such error, it needs to be ignored directly on error handling. Example of use: # nft list ruleset table ip filter { chain output { } } # nft destroy table ip missingtable # echo $? 0 # nft list ruleset table ip filter { chain output { } } Signed-off-by: Fernando Fernandez Mancera <ffmancera@riseup.net> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* Implement 'reset rule' and 'reset rules' commandsPhil Sutter2023-01-182-2/+6
| | | | | | | | Reset rule counters and quotas in kernel, i.e. without having to reload them. Requires respective kernel patch to support NFT_MSG_GETRULE_RESET message type. Signed-off-by: Phil Sutter <phil@nwl.cc>
* doc: add gretap matching expressionPablo Neira Ayuso2023-01-021-0/+20
| | | | | | | | Document new gretap matching expression. This includes support for matching the encapsulated ethernet frame layer 2, 3 and 4 headers within the gre header. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
* doc: add geneve matching expressionPablo Neira Ayuso2023-01-021-0/+33
| | | | | Document new geneve matching expression. This includes support for matching the encapsulated ethernet frame layer 2, 3 and 4 headers.
generated by cgit v1.2.3 (git 2.25.0) at 2025-06-12 08:37:24 +0000