# meta protocol { ip, arp, ip6, vlan } [ { "match": { "left": { "meta": { "key": "protocol" } }, "op": "==", "right": { "set": [ "ip", "arp", "8021q", "ip6" ] } } } ] # meta protocol != {ip, arp, ip6, 8021q} [ { "match": { "left": { "meta": { "key": "protocol" } }, "op": "!=", "right": { "set": [ "ip", "arp", "8021q", "ip6" ] } } } ] # meta priority 0x87654321 [ { "match": { "left": { "meta": { "key": "priority" } }, "op": "==", "right": "8765:4321" } } ] # meta priority 2271560481 [ { "match": { "left": { "meta": { "key": "priority" } }, "op": "==", "right": "8765:4321" } } ] # meta priority {bcad:dada, bcad:dadc, aaaa:bbbb} [ { "match": { "left": { "meta": { "key": "priority" } }, "op": "==", "right": { "set": [ "aaaa:bbbb", "bcad:dada", "bcad:dadc" ] } } } ] # meta mark 0x4 [ { "match": { "left": { "meta": { "key": "mark" } }, "op": "==", "right": 4 } } ] # meta mark 0x32 [ { "match": { "left": { "meta": { "key": "mark" } }, "op": "==", "right": 50 } } ] # meta mark and 0x03 == 0x01 [ { "match": { "left": { "&": [ { "meta": { "key": "mark" } }, 3 ] }, "op": "==", "right": 1 } } ] # meta mark and 0x03 != 0x01 [ { "match": { "left": { "&": [ { "meta": { "key": "mark" } }, 3 ] }, "op": "!=", "right": 1 } } ] # meta mark 0x10 [ { "match": { "left": { "meta": { "key": "mark" } }, "op": "==", "right": 16 } } ] # meta mark != 0x10 [ { "match": { "left": { "meta": { "key": "mark" } }, "op": "!=", "right": 16 } } ] # meta mark or 0x03 == 0x01 [ { "match": { "left": { "|": [ { "meta": { "key": "mark" } }, 3 ] }, "op": "==", "right": 1 } } ] # meta mark or 0x03 != 0x01 [ { "match": { "left": { "|": [ { "meta": { "key": "mark" } }, 3 ] }, "op": "!=", "right": 1 } } ] # meta mark xor 0x03 == 0x01 [ { "match": { "left": { "meta": { "key": "mark" } }, "op": "==", "right": 2 } } ] # meta mark xor 0x03 != 0x01 [ { "match": { "left": { "meta": { "key": "mark" } }, "op": "!=", "right": 2 } } ] # meta iifname {"dummy0", "lo"} [ { "match": { "left": { "meta": { "key": "iifname" } }, "op": "==", "right": { "set": [ "lo", "dummy0" ] } } } ] # meta iifname != {"dummy0", "lo"} [ { "match": { "left": { "meta": { "key": "iifname" } }, "op": "!=", "right": { "set": [ "lo", "dummy0" ] } } } ] # meta oifname { "dummy0", "lo"} [ { "match": { "left": { "meta": { "key": "oifname" } }, "op": "==", "right": { "set": [ "lo", "dummy0" ] } } } ] # meta skuid {"bin", "root", "daemon"} accept [ { "match": { "left": { "meta": { "key": "skuid" } }, "op": "==", "right": { "set": [ 0, 1, 2 ] } } }, { "accept": null } ] # meta skuid != {"bin", "root", "daemon"} accept [ { "match": { "left": { "meta": { "key": "skuid" } }, "op": "!=", "right": { "set": [ 0, 1, 2 ] } } }, { "accept": null } ] # meta skuid "root" [ { "match": { "left": { "meta": { "key": "skuid" } }, "op": "==", "right": 0 } } ] # meta skuid != "root" [ { "match": { "left": { "meta": { "key": "skuid" } }, "op": "!=", "right": 0 } } ] # meta skgid {"bin", "root", "daemon"} accept [ { "match": { "left": { "meta": { "key": "skgid" } }, "op": "==", "right": { "set": [ 0, 1, 2 ] } } }, { "accept": null } ] # meta skgid != {"bin", "root", "daemon"} accept [ { "match": { "left": { "meta": { "key": "skgid" } }, "op": "!=", "right": { "set": [ 0, 1, 2 ] } } }, { "accept": null } ] # meta skgid "root" [ { "match": { "left": { "meta": { "key": "skgid" } }, "op": "==", "right": 0 } } ] # meta skgid != "root" [ { "match": { "left": { "meta": { "key": "skgid" } }, "op": "!=", "right": 0 } } ] # meta mark set 0xffffffc8 xor 0x16 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 4294967262 } } ] # meta mark set 0x16 and 0x16 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 22 } } ] # meta mark set 0xffffffe9 or 0x16 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 4294967295 } } ] # meta mark set 0xffffffde and 0x16 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 22 } } ] # meta mark set 0xf045ffde or 0x10 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 4031119326 } } ] # meta mark set 0xffffffde or 0x16 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 4294967262 } } ] # meta mark set 0x32 or 0xfffff [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 1048575 } } ] # meta mark set 0xfffe xor 0x16 [ { "mangle": { "key": { "meta": { "key": "mark" } }, "value": 65512 } } ] # meta iifgroup 0 [ { "match": { "left": { "meta": { "key": "iifgroup" } }, "op": "==", "right": "default" } } ] # meta iifgroup != 0 [ { "match": { "left": { "meta": { "key": "iifgroup" } }, "op": "!=", "right": "default" } } ] # meta oifgroup 0 [ { "match": { "left": { "meta": { "key": "oifgroup" } }, "op": "==", "right": "default" } } ] # meta oifgroup != 0 [ { "match": { "left": { "meta": { "key": "oifgroup" } }, "op": "!=", "right": "default" } } ] # meta iif . meta oif . meta mark { "lo" . "lo" . 0x0000000a } [ { "match": { "left": { "concat": [ { "meta": { "key": "iif" } }, { "meta": { "key": "oif" } }, { "meta": { "key": "mark" } } ] }, "op": "==", "right": { "set": [ { "concat": [ "lo", "lo", 10 ] } ] } } } ] # meta time "1970-05-23 21:07:14" drop [ { "match": { "left": { "meta": { "key": "time" } }, "op": "==", "right": "1970-05-23 21:07:14" } }, { "drop": null } ] # meta time 12341234 drop [ { "match": { "left": { "meta": { "key": "time" } }, "op": "==", "right": "1970-05-23 22:07:14" } }, { "drop": null } ] # meta time "2019-06-21 17:00:00" drop [ { "match": { "left": { "meta": { "key": "time" } }, "op": "==", "right": "2019-06-21 17:00:00" } }, { "drop": null } ] # meta time "2019-07-01 00:00:00" drop [ { "match": { "left": { "meta": { "key": "time" } }, "op": "==", "right": "2019-07-01 00:00:00" } }, { "drop": null } ] # meta time "2019-07-01 00:01:00" drop [ { "match": { "left": { "meta": { "key": "time" } }, "op": "==", "right": "2019-07-01 00:01:00" } }, { "drop": null } ] # meta time "2019-07-01 00:00:01" drop [ { "match": { "left": { "meta": { "key": "time" } }, "op": "==", "right": "2019-07-01 00:00:01" } }, { "drop": null } ] # meta day "Saturday" drop [ { "match": { "left": { "meta": { "key": "day" } }, "op": "==", "right": "Saturday" } }, { "drop": null } ] # meta day 6 drop [ { "match": { "left": { "meta": { "key": "day" } }, "op": "==", "right": "Saturday" } }, { "drop": null } ] # meta hour "17:00" drop [ { "match": { "left": { "meta": { "key": "hour" } }, "op": "==", "right": "17:00" } }, { "drop": null } ] # meta hour "17:00:00" drop [ { "match": { "left": { "meta": { "key": "hour" } }, "op": "==", "right": "17:00" } }, { "drop": null } ] # meta hour "17:00:01" drop [ { "match": { "left": { "meta": { "key": "hour" } }, "op": "==", "right": "17:00:01" } }, { "drop": null } ] # meta hour "00:00" drop [ { "match": { "left": { "meta": { "key": "hour" } }, "op": "==", "right": "00:00" } }, { "drop": null } ] # meta hour "00:01" drop [ { "match": { "left": { "meta": { "key": "hour" } }, "op": "==", "right": "00:01" } }, { "drop": null } ]