| # SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) |
| --- |
| name: nftables |
| protocol: netlink-raw |
| protonum: 12 |
| |
| doc: >- |
| Netfilter nftables configuration over netlink. |
| |
| definitions: |
| - |
| name: nfgenmsg |
| type: struct |
| members: |
| - |
| name: nfgen-family |
| type: u8 |
| - |
| name: version |
| type: u8 |
| - |
| name: res-id |
| byte-order: big-endian |
| type: u16 |
| - |
| name: meta-keys |
| type: enum |
| entries: |
| - len |
| - protocol |
| - priority |
| - mark |
| - iif |
| - oif |
| - iifname |
| - oifname |
| - iftype |
| - oiftype |
| - skuid |
| - skgid |
| - nftrace |
| - rtclassid |
| - secmark |
| - nfproto |
| - l4-proto |
| - bri-iifname |
| - bri-oifname |
| - pkttype |
| - cpu |
| - iifgroup |
| - oifgroup |
| - cgroup |
| - prandom |
| - secpath |
| - iifkind |
| - oifkind |
| - bri-iifpvid |
| - bri-iifvproto |
| - time-ns |
| - time-day |
| - time-hour |
| - sdif |
| - sdifname |
| - bri-broute |
| - |
| name: bitwise-ops |
| type: enum |
| entries: |
| - |
| name: mask-xor # aka bool (old name) |
| doc: >- |
| mask-and-xor operation used to implement NOT, AND, OR and XOR boolean |
| operations |
| - |
| name: lshift |
| - |
| name: rshift |
| - |
| name: and |
| - |
| name: or |
| - |
| name: xor |
| - |
| name: cmp-ops |
| type: enum |
| entries: |
| - eq |
| - neq |
| - lt |
| - lte |
| - gt |
| - gte |
| - |
| name: object-type |
| type: enum |
| entries: |
| - unspec |
| - counter |
| - quota |
| - ct-helper |
| - limit |
| - connlimit |
| - tunnel |
| - ct-timeout |
| - secmark |
| - ct-expect |
| - synproxy |
| - |
| name: nat-range-flags |
| type: flags |
| entries: |
| - map-ips |
| - proto-specified |
| - proto-random |
| - persistent |
| - proto-random-fully |
| - proto-offset |
| - netmap |
| - |
| name: table-flags |
| type: flags |
| entries: |
| - dormant |
| - owner |
| - persist |
| - |
| name: chain-flags |
| type: flags |
| entries: |
| - base |
| - hw-offload |
| - binding |
| - |
| name: set-flags |
| type: flags |
| entries: |
| - anonymous |
| - constant |
| - interval |
| - map |
| - timeout |
| - eval |
| - object |
| - concat |
| - expr |
| - |
| name: set-elem-flags |
| type: flags |
| entries: |
| - interval-end |
| - catchall |
| - |
| name: lookup-flags |
| type: flags |
| entries: |
| - invert |
| - |
| name: ct-keys |
| type: enum |
| entries: |
| - state |
| - direction |
| - status |
| - mark |
| - secmark |
| - expiration |
| - helper |
| - l3protocol |
| - src |
| - dst |
| - protocol |
| - proto-src |
| - proto-dst |
| - labels |
| - pkts |
| - bytes |
| - avgpkt |
| - zone |
| - eventmask |
| - src-ip |
| - dst-ip |
| - src-ip6 |
| - dst-ip6 |
| - ct-id |
| - |
| name: ct-direction |
| type: enum |
| entries: |
| - original |
| - reply |
| - |
| name: quota-flags |
| type: flags |
| entries: |
| - invert |
| - depleted |
| - |
| name: verdict-code |
| type: enum |
| entries: |
| - name: continue |
| value: 0xffffffff |
| - name: break |
| value: 0xfffffffe |
| - name: jump |
| value: 0xfffffffd |
| - name: goto |
| value: 0xfffffffc |
| - name: return |
| value: 0xfffffffb |
| - name: drop |
| value: 0 |
| - name: accept |
| value: 1 |
| - name: stolen |
| value: 2 |
| - name: queue |
| value: 3 |
| - name: repeat |
| value: 4 |
| - |
| name: fib-result |
| type: enum |
| entries: |
| - oif |
| - oifname |
| - addrtype |
| - |
| name: fib-flags |
| type: flags |
| entries: |
| - saddr |
| - daddr |
| - mark |
| - iif |
| - oif |
| - present |
| - |
| name: reject-types |
| type: enum |
| entries: |
| - icmp-unreach |
| - tcp-rst |
| - icmpx-unreach |
| - |
| name: reject-inet-code |
| doc: These codes are mapped to real ICMP and ICMPv6 codes. |
| type: enum |
| entries: |
| - icmpx-no-route |
| - icmpx-port-unreach |
| - icmpx-host-unreach |
| - icmpx-admin-prohibited |
| - |
| name: payload-base |
| type: enum |
| entries: |
| - link-layer-header |
| - network-header |
| - transport-header |
| - inner-header |
| - tun-header |
| - |
| name: range-ops |
| doc: Range operator |
| type: enum |
| entries: |
| - eq |
| - neq |
| - |
| name: registers |
| doc: | |
| nf_tables registers. |
| nf_tables used to have five registers: a verdict register and four data |
| registers of size 16. The data registers have been changed to 16 registers |
| of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still |
| map to areas of size 16, the 4 byte registers are addressed using |
| NFT_REG32_00 - NFT_REG32_15. |
| type: enum |
| entries: |
| - |
| name: reg-verdict |
| - |
| name: reg-1 |
| - |
| name: reg-2 |
| - |
| name: reg-3 |
| - |
| name: reg-4 |
| - |
| name: reg32-00 |
| value: 8 |
| - |
| name: reg32-01 |
| - |
| name: reg32-02 |
| - |
| name: reg32-03 |
| - |
| name: reg32-04 |
| - |
| name: reg32-05 |
| - |
| name: reg32-06 |
| - |
| name: reg32-07 |
| - |
| name: reg32-08 |
| - |
| name: reg32-09 |
| - |
| name: reg32-10 |
| - |
| name: reg32-11 |
| - |
| name: reg32-12 |
| - |
| name: reg32-13 |
| - |
| name: reg32-14 |
| - |
| name: reg32-15 |
| - |
| name: numgen-types |
| type: enum |
| entries: |
| - incremental |
| - random |
| - |
| name: log-level |
| doc: nf_tables log levels |
| type: enum |
| entries: |
| - |
| name: emerg |
| doc: system is unusable |
| - |
| name: alert |
| doc: action must be taken immediately |
| - |
| name: crit |
| doc: critical conditions |
| - |
| name: err |
| doc: error conditions |
| - |
| name: warning |
| doc: warning conditions |
| - |
| name: notice |
| doc: normal but significant condition |
| - |
| name: info |
| doc: informational |
| - |
| name: debug |
| doc: debug-level messages |
| - |
| name: audit |
| doc: enabling audit logging |
| - |
| name: log-flags |
| doc: nf_tables log flags |
| header: linux/netfilter/nf_log.h |
| type: flags |
| entries: |
| - |
| name: tcpseq |
| doc: Log TCP sequence numbers |
| - |
| name: tcpopt |
| doc: Log TCP options |
| - |
| name: ipopt |
| doc: Log IP options |
| - |
| name: uid |
| doc: Log UID owning local socket |
| - |
| name: nflog |
| doc: Unsupported, don't reuse |
| - |
| name: macdecode |
| doc: Decode MAC header |
| |
| attribute-sets: |
| - |
| name: log-attrs |
| doc: log expression netlink attributes |
| attributes: |
| # Mentioned in nft_log_init() |
| - |
| name: group |
| doc: netlink group to send messages to |
| type: u16 |
| byte-order: big-endian |
| - |
| name: prefix |
| doc: prefix to prepend to log messages |
| type: string |
| - |
| name: snaplen |
| doc: length of payload to include in netlink message |
| type: u32 |
| byte-order: big-endian |
| - |
| name: qthreshold |
| doc: queue threshold |
| type: u16 |
| byte-order: big-endian |
| - |
| name: level |
| doc: log level |
| type: u32 |
| enum: log-level |
| byte-order: big-endian |
| - |
| name: flags |
| doc: logging flags |
| type: u32 |
| enum: log-flags |
| byte-order: big-endian |
| - |
| name: numgen-attrs |
| doc: nf_tables number generator expression netlink attributes |
| attributes: |
| - |
| name: dreg |
| doc: destination register |
| type: u32 |
| enum: registers |
| - |
| name: modulus |
| doc: maximum counter value |
| type: u32 |
| byte-order: big-endian |
| - |
| name: type |
| doc: operation type |
| type: u32 |
| byte-order: big-endian |
| enum: numgen-types |
| - |
| name: offset |
| doc: offset to be added to the counter |
| type: u32 |
| byte-order: big-endian |
| - |
| name: range-attrs |
| attributes: |
| # Mentioned in net/netfilter/nft_range.c |
| - |
| name: sreg |
| doc: source register of data to compare |
| type: u32 |
| byte-order: big-endian |
| enum: registers |
| - |
| name: op |
| doc: cmp operation |
| type: u32 |
| byte-order: big-endian |
| enum: range-ops |
| checks: |
| max: 255 |
| - |
| name: from-data |
| doc: data range from |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: to-data |
| doc: data range to |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: batch-attrs |
| attributes: |
| - |
| name: genid |
| doc: generation ID for this changeset |
| type: u32 |
| byte-order: big-endian |
| - |
| name: table-attrs |
| attributes: |
| - |
| name: name |
| type: string |
| doc: name of the table |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| doc: bitmask of flags |
| enum: table-flags |
| enum-as-flags: true |
| - |
| name: use |
| type: u32 |
| byte-order: big-endian |
| doc: number of chains in this table |
| - |
| name: handle |
| type: u64 |
| byte-order: big-endian |
| doc: numeric handle of the table |
| - |
| name: pad |
| type: pad |
| - |
| name: userdata |
| type: binary |
| doc: user data |
| - |
| name: owner |
| type: u32 |
| byte-order: big-endian |
| doc: owner of this table through netlink portID |
| - |
| name: chain-attrs |
| attributes: |
| - |
| name: table |
| type: string |
| doc: name of the table containing the chain |
| - |
| name: handle |
| type: u64 |
| byte-order: big-endian |
| doc: numeric handle of the chain |
| - |
| name: name |
| type: string |
| doc: name of the chain |
| - |
| name: hook |
| type: nest |
| nested-attributes: nft-hook-attrs |
| doc: hook specification for basechains |
| - |
| name: policy |
| type: u32 |
| byte-order: big-endian |
| doc: numeric policy of the chain |
| - |
| name: use |
| type: u32 |
| byte-order: big-endian |
| doc: number of references to this chain |
| - |
| name: type |
| type: string |
| doc: type name of the chain |
| - |
| name: counters |
| type: nest |
| nested-attributes: nft-counter-attrs |
| doc: counter specification of the chain |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| doc: chain flags |
| enum: chain-flags |
| enum-as-flags: true |
| - |
| name: id |
| type: u32 |
| byte-order: big-endian |
| doc: uniquely identifies a chain in a transaction |
| - |
| name: userdata |
| type: binary |
| doc: user data |
| - |
| name: counter-attrs |
| attributes: |
| - |
| name: bytes |
| type: u64 |
| byte-order: big-endian |
| - |
| name: packets |
| type: u64 |
| byte-order: big-endian |
| - |
| name: pad |
| type: pad |
| - |
| name: nft-hook-attrs |
| attributes: |
| - |
| name: num |
| type: u32 |
| byte-order: big-endian |
| - |
| name: priority |
| type: s32 |
| byte-order: big-endian |
| - |
| name: dev |
| type: string |
| doc: net device name |
| - |
| name: devs |
| type: nest |
| nested-attributes: hook-dev-attrs |
| doc: list of net devices |
| - |
| name: hook-dev-attrs |
| attributes: |
| - |
| name: name |
| type: string |
| multi-attr: true |
| - |
| name: nft-counter-attrs |
| attributes: |
| - |
| name: bytes |
| type: u64 |
| byte-order: big-endian |
| - |
| name: packets |
| type: u64 |
| byte-order: big-endian |
| - |
| name: rule-attrs |
| attributes: |
| - |
| name: table |
| type: string |
| doc: name of the table containing the rule |
| - |
| name: chain |
| type: string |
| doc: name of the chain containing the rule |
| - |
| name: handle |
| type: u64 |
| byte-order: big-endian |
| doc: numeric handle of the rule |
| - |
| name: expressions |
| type: nest |
| nested-attributes: expr-list-attrs |
| doc: list of expressions |
| - |
| name: compat |
| type: nest |
| nested-attributes: rule-compat-attrs |
| doc: compatibility specifications of the rule |
| - |
| name: position |
| type: u64 |
| byte-order: big-endian |
| doc: numeric handle of the previous rule |
| - |
| name: userdata |
| type: binary |
| doc: user data |
| - |
| name: id |
| type: u32 |
| doc: uniquely identifies a rule in a transaction |
| - |
| name: position-id |
| type: u32 |
| doc: transaction unique identifier of the previous rule |
| - |
| name: chain-id |
| type: u32 |
| doc: add the rule to chain by ID, alternative to chain name |
| - |
| name: expr-list-attrs |
| attributes: |
| - |
| name: elem |
| type: nest |
| nested-attributes: expr-attrs |
| multi-attr: true |
| - |
| name: expr-attrs |
| attributes: |
| - |
| name: name |
| type: string |
| doc: name of the expression type |
| - |
| name: data |
| type: sub-message |
| sub-message: expr-ops |
| selector: name |
| doc: type specific data |
| - |
| # Mentioned in nft_parse_compat() in net/netfilter/nft_compat.c |
| name: rule-compat-attrs |
| attributes: |
| - |
| name: proto |
| type: u32 |
| byte-order: big-endian |
| doc: numeric value of the handled protocol |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| doc: bitmask of flags |
| - |
| name: set-attrs |
| attributes: |
| - |
| name: table |
| type: string |
| doc: table name |
| - |
| name: name |
| type: string |
| doc: set name |
| - |
| name: flags |
| type: u32 |
| enum: set-flags |
| byte-order: big-endian |
| doc: bitmask of enum nft_set_flags |
| - |
| name: key-type |
| type: u32 |
| byte-order: big-endian |
| doc: key data type, informational purpose only |
| - |
| name: key-len |
| type: u32 |
| byte-order: big-endian |
| doc: key data length |
| - |
| name: data-type |
| type: u32 |
| byte-order: big-endian |
| doc: mapping data type |
| - |
| name: data-len |
| type: u32 |
| byte-order: big-endian |
| doc: mapping data length |
| - |
| name: policy |
| type: u32 |
| byte-order: big-endian |
| doc: selection policy |
| - |
| name: desc |
| type: nest |
| nested-attributes: set-desc-attrs |
| doc: set description |
| - |
| name: id |
| type: u32 |
| doc: uniquely identifies a set in a transaction |
| - |
| name: timeout |
| type: u64 |
| doc: default timeout value |
| - |
| name: gc-interval |
| type: u32 |
| doc: garbage collection interval |
| - |
| name: userdata |
| type: binary |
| doc: user data |
| - |
| name: pad |
| type: pad |
| - |
| name: obj-type |
| type: u32 |
| byte-order: big-endian |
| doc: stateful object type |
| - |
| name: handle |
| type: u64 |
| byte-order: big-endian |
| doc: set handle |
| - |
| name: expr |
| type: nest |
| nested-attributes: expr-attrs |
| doc: set expression |
| multi-attr: true |
| - |
| name: expressions |
| type: nest |
| nested-attributes: set-list-attrs |
| doc: list of expressions |
| - |
| name: type |
| type: string |
| doc: set backend type |
| - |
| name: count |
| type: u32 |
| byte-order: big-endian |
| doc: number of set elements |
| - |
| name: set-desc-attrs |
| attributes: |
| - |
| name: size |
| type: u32 |
| byte-order: big-endian |
| doc: number of elements in set |
| - |
| name: concat |
| type: nest |
| nested-attributes: set-desc-concat-attrs |
| doc: description of field concatenation |
| multi-attr: true |
| - |
| name: set-desc-concat-attrs |
| attributes: |
| - |
| name: elem |
| type: nest |
| nested-attributes: set-field-attrs |
| - |
| name: set-field-attrs |
| attributes: |
| - |
| name: len |
| type: u32 |
| byte-order: big-endian |
| - |
| name: set-list-attrs |
| attributes: |
| - |
| name: elem |
| type: nest |
| nested-attributes: expr-attrs |
| multi-attr: true |
| - |
| name: setelem-attrs |
| attributes: |
| - |
| name: key |
| type: nest |
| nested-attributes: data-attrs |
| doc: key value |
| - |
| name: data |
| type: nest |
| nested-attributes: data-attrs |
| doc: data value of mapping |
| - |
| name: flags |
| type: binary |
| doc: bitmask of nft_set_elem_flags |
| - |
| name: timeout |
| type: u64 |
| doc: timeout value |
| - |
| name: expiration |
| type: u64 |
| doc: expiration time |
| - |
| name: userdata |
| type: binary |
| doc: user data |
| - |
| name: expr |
| type: nest |
| nested-attributes: expr-attrs |
| doc: expression |
| - |
| name: objref |
| type: string |
| doc: stateful object reference |
| - |
| name: key-end |
| type: nest |
| nested-attributes: data-attrs |
| doc: closing key value |
| - |
| name: expressions |
| type: nest |
| nested-attributes: expr-list-attrs |
| doc: list of expressions |
| - |
| name: setelem-list-elem-attrs |
| attributes: |
| - |
| name: elem |
| type: nest |
| nested-attributes: setelem-attrs |
| multi-attr: true |
| - |
| name: setelem-list-attrs |
| attributes: |
| - |
| name: table |
| type: string |
| - |
| name: set |
| type: string |
| - |
| name: elements |
| type: nest |
| nested-attributes: setelem-list-elem-attrs |
| - |
| name: set-id |
| type: u32 |
| - |
| name: gen-attrs |
| attributes: |
| - |
| name: id |
| type: u32 |
| byte-order: big-endian |
| doc: ruleset generation id |
| - |
| name: proc-pid |
| type: u32 |
| byte-order: big-endian |
| - |
| name: proc-name |
| type: string |
| - |
| name: obj-attrs |
| attributes: |
| - |
| name: table |
| type: string |
| doc: name of the table containing the expression |
| - |
| name: name |
| type: string |
| doc: name of this expression type |
| - |
| name: type |
| type: u32 |
| enum: object-type |
| byte-order: big-endian |
| doc: stateful object type |
| - |
| name: data |
| type: sub-message |
| sub-message: obj-data |
| selector: type |
| doc: stateful object data |
| - |
| name: use |
| type: u32 |
| byte-order: big-endian |
| doc: number of references to this expression |
| - |
| name: handle |
| type: u64 |
| byte-order: big-endian |
| doc: object handle |
| - |
| name: pad |
| type: pad |
| - |
| name: userdata |
| type: binary |
| doc: user data |
| - |
| name: quota-attrs |
| attributes: |
| - |
| name: bytes |
| type: u64 |
| byte-order: big-endian |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| enum: quota-flags |
| - |
| name: pad |
| type: pad |
| - |
| name: consumed |
| type: u64 |
| byte-order: big-endian |
| - |
| name: flowtable-attrs |
| attributes: |
| - |
| name: table |
| type: string |
| - |
| name: name |
| type: string |
| - |
| name: hook |
| type: nest |
| nested-attributes: flowtable-hook-attrs |
| - |
| name: use |
| type: u32 |
| byte-order: big-endian |
| - |
| name: handle |
| type: u64 |
| byte-order: big-endian |
| - |
| name: pad |
| type: pad |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| - |
| name: flowtable-hook-attrs |
| attributes: |
| - |
| name: num |
| type: u32 |
| byte-order: big-endian |
| - |
| name: priority |
| type: u32 |
| byte-order: big-endian |
| - |
| name: devs |
| type: nest |
| nested-attributes: hook-dev-attrs |
| - |
| name: expr-bitwise-attrs |
| doc: | |
| The bitwise expression supports boolean and shift operations. It |
| implements the boolean operations by performing the following |
| operation:: |
| |
| dreg = (sreg & mask) ^ xor |
| |
| with these mask and xor values: |
| |
| op mask xor |
| ---- ---- --- |
| NOT: 1 1 |
| OR: ~x x |
| XOR: 1 x |
| AND: x 0 |
| |
| attributes: |
| - |
| name: sreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: dreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: len |
| type: u32 |
| byte-order: big-endian |
| - |
| name: mask |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: xor |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: op |
| type: u32 |
| byte-order: big-endian |
| enum: bitwise-ops |
| checks: |
| max: 255 |
| - |
| name: data |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: expr-cmp-attrs |
| attributes: |
| - |
| name: sreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: op |
| type: u32 |
| byte-order: big-endian |
| enum: cmp-ops |
| - |
| name: data |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: data-attrs |
| attributes: |
| - |
| name: value |
| type: binary |
| # sub-type: u8 |
| - |
| name: verdict |
| type: nest |
| nested-attributes: verdict-attrs |
| - |
| name: verdict-attrs |
| attributes: |
| - |
| name: code |
| doc: nf_tables verdict |
| type: u32 |
| byte-order: big-endian |
| enum: verdict-code |
| - |
| name: chain |
| doc: jump target chain name |
| type: string |
| - |
| name: chain-id |
| doc: jump target chain ID |
| type: u32 |
| byte-order: big-endian |
| - |
| name: expr-counter-attrs |
| attributes: |
| - |
| name: bytes |
| type: u64 |
| byte-order: big-endian |
| doc: Number of bytes |
| - |
| name: packets |
| type: u64 |
| byte-order: big-endian |
| doc: Number of packets |
| - |
| name: pad |
| type: pad |
| - |
| name: expr-fib-attrs |
| attributes: |
| - |
| name: dreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: result |
| type: u32 |
| byte-order: big-endian |
| enum: fib-result |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| enum: fib-flags |
| - |
| name: expr-ct-attrs |
| attributes: |
| - |
| name: dreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: key |
| type: u32 |
| byte-order: big-endian |
| enum: ct-keys |
| - |
| name: direction |
| type: u8 |
| enum: ct-direction |
| - |
| name: sreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: expr-flow-offload-attrs |
| attributes: |
| - |
| name: name |
| type: string |
| doc: Flow offload table name |
| - |
| name: expr-immediate-attrs |
| attributes: |
| - |
| name: dreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: data |
| type: nest |
| nested-attributes: data-attrs |
| - |
| name: expr-lookup-attrs |
| attributes: |
| - |
| name: set |
| type: string |
| doc: Name of set to use |
| - |
| name: set-id |
| type: u32 |
| byte-order: big-endian |
| doc: ID of set to use |
| - |
| name: sreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: dreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| enum: lookup-flags |
| - |
| name: expr-masq-attrs |
| attributes: |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| enum: nat-range-flags |
| enum-as-flags: true |
| - |
| name: reg-proto-min |
| type: u32 |
| byte-order: big-endian |
| enum: registers |
| - |
| name: reg-proto-max |
| type: u32 |
| byte-order: big-endian |
| enum: registers |
| - |
| name: expr-meta-attrs |
| attributes: |
| - |
| name: dreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: key |
| type: u32 |
| byte-order: big-endian |
| enum: meta-keys |
| - |
| name: sreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: expr-nat-attrs |
| attributes: |
| - |
| name: type |
| type: u32 |
| byte-order: big-endian |
| - |
| name: family |
| type: u32 |
| byte-order: big-endian |
| - |
| name: reg-addr-min |
| type: u32 |
| byte-order: big-endian |
| - |
| name: reg-addr-max |
| type: u32 |
| byte-order: big-endian |
| - |
| name: reg-proto-min |
| type: u32 |
| byte-order: big-endian |
| - |
| name: reg-proto-max |
| type: u32 |
| byte-order: big-endian |
| - |
| name: flags |
| type: u32 |
| byte-order: big-endian |
| enum: nat-range-flags |
| enum-as-flags: true |
| - |
| name: expr-payload-attrs |
| doc: nf_tables payload expression netlink attributes |
| attributes: |
| - |
| name: dreg |
| doc: destination register to load data into |
| type: u32 |
| byte-order: big-endian |
| enum: registers |
| - |
| name: base |
| doc: payload base |
| type: u32 |
| enum: payload-base |
| byte-order: big-endian |
| - |
| name: offset |
| doc: payload offset relative to base |
| type: u32 |
| byte-order: big-endian |
| - |
| name: len |
| doc: payload length |
| type: u32 |
| byte-order: big-endian |
| - |
| name: sreg |
| doc: source register to load data from |
| type: u32 |
| byte-order: big-endian |
| enum: registers |
| - |
| name: csum-type |
| doc: checksum type |
| type: u32 |
| byte-order: big-endian |
| - |
| name: csum-offset |
| doc: checksum offset relative to base |
| type: u32 |
| byte-order: big-endian |
| - |
| name: csum-flags |
| doc: checksum flags |
| type: u32 |
| byte-order: big-endian |
| - |
| name: expr-reject-attrs |
| attributes: |
| - |
| name: type |
| type: u32 |
| byte-order: big-endian |
| enum: reject-types |
| - |
| name: icmp-code |
| type: u8 |
| - |
| name: expr-target-attrs |
| attributes: |
| - |
| name: name |
| type: string |
| - |
| name: rev |
| type: u32 |
| byte-order: big-endian |
| - |
| name: info |
| type: binary |
| - |
| name: expr-tproxy-attrs |
| attributes: |
| - |
| name: family |
| type: u32 |
| byte-order: big-endian |
| - |
| name: reg-addr |
| type: u32 |
| byte-order: big-endian |
| - |
| name: reg-port |
| type: u32 |
| byte-order: big-endian |
| - |
| name: expr-objref-attrs |
| attributes: |
| - |
| name: imm-type |
| type: u32 |
| byte-order: big-endian |
| - |
| name: imm-name |
| type: string |
| doc: object name |
| - |
| name: set-sreg |
| type: u32 |
| byte-order: big-endian |
| - |
| name: set-name |
| type: string |
| doc: name of object map |
| - |
| name: set-id |
| type: u32 |
| byte-order: big-endian |
| doc: id of object map |
| - |
| name: compat-target-attrs |
| header: linux/netfilter/nf_tables_compat.h |
| attributes: |
| - |
| name: name |
| type: string |
| checks: |
| max-len: 32 |
| - |
| name: rev |
| type: u32 |
| byte-order: big-endian |
| checks: |
| max: 255 |
| - |
| name: info |
| type: binary |
| - |
| name: compat-match-attrs |
| header: linux/netfilter/nf_tables_compat.h |
| attributes: |
| - |
| name: name |
| type: string |
| checks: |
| max-len: 32 |
| - |
| name: rev |
| type: u32 |
| byte-order: big-endian |
| checks: |
| max: 255 |
| - |
| name: info |
| type: binary |
| - |
| name: compat-attrs |
| header: linux/netfilter/nf_tables_compat.h |
| attributes: |
| - |
| name: name |
| type: string |
| checks: |
| max-len: 32 |
| - |
| name: rev |
| type: u32 |
| byte-order: big-endian |
| checks: |
| max: 255 |
| - |
| name: type |
| type: u32 |
| byte-order: big-endian |
| |
| sub-messages: |
| - |
| name: expr-ops |
| formats: |
| - |
| value: bitwise |
| attribute-set: expr-bitwise-attrs |
| - |
| value: cmp |
| attribute-set: expr-cmp-attrs |
| - |
| value: counter |
| attribute-set: expr-counter-attrs |
| - |
| value: ct |
| attribute-set: expr-ct-attrs |
| - |
| value: fib |
| attribute-set: expr-fib-attrs |
| - |
| value: flow_offload |
| attribute-set: expr-flow-offload-attrs |
| - |
| value: immediate |
| attribute-set: expr-immediate-attrs |
| - |
| value: log |
| attribute-set: log-attrs |
| - |
| value: lookup |
| attribute-set: expr-lookup-attrs |
| - |
| value: match |
| attribute-set: compat-match-attrs |
| - |
| value: meta |
| attribute-set: expr-meta-attrs |
| - |
| value: nat |
| attribute-set: expr-nat-attrs |
| - |
| value: numgen |
| attribute-set: numgen-attrs |
| - |
| value: objref |
| attribute-set: expr-objref-attrs |
| - |
| value: payload |
| attribute-set: expr-payload-attrs |
| - |
| value: quota |
| attribute-set: quota-attrs |
| - |
| value: range |
| attribute-set: range-attrs |
| - |
| value: reject |
| attribute-set: expr-reject-attrs |
| - |
| value: target |
| attribute-set: expr-target-attrs |
| - |
| value: tproxy |
| attribute-set: expr-tproxy-attrs |
| # There're more sub-messages to go: |
| # grep -A10 nft_expr_type |
| # and look for .name\s*=\s*"..." |
| - |
| name: obj-data |
| formats: |
| - |
| value: counter |
| attribute-set: counter-attrs |
| - |
| value: quota |
| attribute-set: quota-attrs |
| |
| operations: |
| enum-model: directional |
| list: |
| - |
| name: batch-begin |
| doc: Start a batch of operations |
| attribute-set: batch-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0x10 |
| attributes: |
| - genid |
| reply: |
| value: 0x10 |
| attributes: |
| - genid |
| - |
| name: batch-end |
| doc: Finish a batch of operations |
| attribute-set: batch-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0x11 |
| attributes: |
| - genid |
| - |
| name: newtable |
| doc: Create a new table. |
| attribute-set: table-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa00 |
| attributes: |
| # Mentioned in nf_tables_newtable() |
| - name |
| - flags |
| - userdata |
| - |
| name: gettable |
| doc: Get / dump tables. |
| attribute-set: table-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa01 |
| attributes: |
| # Mentioned in nf_tables_gettable() |
| - name |
| reply: |
| value: 0xa00 |
| attributes: &get-table |
| # Mentioned in nf_tables_fill_table_info() |
| - name |
| - use |
| - handle |
| - flags |
| - owner |
| - userdata |
| dump: |
| reply: |
| attributes: *get-table |
| - |
| name: deltable |
| doc: Delete an existing table. |
| attribute-set: table-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa02 |
| attributes: &del-table |
| # Mentioned in nf_tables_deltable() |
| - name |
| - handle |
| - |
| name: destroytable |
| doc: | |
| Delete an existing table with destroy semantics (ignoring ENOENT |
| errors). |
| attribute-set: table-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa1a |
| attributes: *del-table |
| - |
| name: newchain |
| doc: Create a new chain. |
| attribute-set: chain-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa03 |
| attributes: |
| # Mentioned in nf_tables_newchain() |
| - table |
| - handle |
| - policy |
| - flags |
| # Mentioned in nf_tables_updchain() |
| - hook |
| - name |
| - counters |
| # Mentioned in nf_tables_addchain() |
| - userdata |
| # Mentioned in nft_chain_parse_hook() |
| - type |
| - |
| name: getchain |
| doc: Get / dump chains. |
| attribute-set: chain-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa04 |
| attributes: |
| # Mentioned in nf_tables_getchain() |
| - table |
| - name |
| reply: |
| value: 0xa03 |
| attributes: &get-chain |
| # Mentioned in nf_tables_fill_chain_info() |
| - table |
| - name |
| - handle |
| - hook |
| - policy |
| - type |
| - flags |
| - counters |
| - id |
| - use |
| - userdata |
| dump: |
| reply: |
| attributes: *get-chain |
| - |
| name: delchain |
| doc: Delete an existing chain. |
| attribute-set: chain-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa05 |
| attributes: &del-chain |
| # Mentioned in nf_tables_delchain() |
| - table |
| - handle |
| - name |
| - hook |
| - |
| name: destroychain |
| doc: | |
| Delete an existing chain with destroy semantics (ignoring ENOENT |
| errors). |
| attribute-set: chain-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa1b |
| attributes: *del-chain |
| - |
| name: newrule |
| doc: Create a new rule. |
| attribute-set: rule-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa06 |
| attributes: |
| # Mentioned in nf_tables_newrule() |
| - table |
| - chain |
| - chain-id |
| - handle |
| - position |
| - position-id |
| - expressions |
| - userdata |
| - compat |
| - |
| name: getrule |
| doc: Get / dump rules. |
| attribute-set: rule-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa07 |
| attributes: &get-rule-request |
| # Mentioned in nf_tables_getrule_single() |
| - table |
| - chain |
| - handle |
| reply: |
| value: 0xa06 |
| attributes: &get-rule |
| # Mentioned in nf_tables_fill_rule_info() |
| - table |
| - chain |
| - handle |
| - position |
| - expressions |
| - userdata |
| dump: |
| request: |
| attributes: |
| # Mentioned in nf_tables_dump_rules_start() |
| - table |
| - chain |
| reply: |
| attributes: *get-rule |
| |
| - |
| name: getrule-reset |
| doc: Get / dump rules and reset stateful expressions. |
| attribute-set: rule-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa19 |
| attributes: *get-rule-request |
| reply: |
| value: 0xa06 |
| attributes: *get-rule |
| dump: |
| request: |
| attributes: *get-rule-request |
| reply: |
| attributes: *get-rule |
| - |
| name: delrule |
| doc: Delete an existing rule. |
| attribute-set: rule-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa08 |
| attributes: &del-rule |
| - table |
| - chain |
| - handle |
| - id |
| - |
| name: destroyrule |
| doc: | |
| Delete an existing rule with destroy semantics (ignoring ENOENT errors). |
| attribute-set: rule-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa1c |
| attributes: *del-rule |
| - |
| name: newset |
| doc: Create a new set. |
| attribute-set: set-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa09 |
| attributes: |
| # Mentioned in nf_tables_newset() |
| - table |
| - name |
| - key-len |
| - id |
| - key-type |
| - flags |
| - data-type |
| - data-len |
| - obj-type |
| - timeout |
| - gc-interval |
| - policy |
| - desc |
| - userdata |
| - |
| name: getset |
| doc: Get / dump sets. |
| attribute-set: set-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa0a |
| attributes: |
| # Mentioned in nf_tables_getset() |
| - table |
| - name |
| reply: |
| value: 0xa09 |
| attributes: &get-set |
| # Mentioned in nf_tables_fill_set() |
| - table |
| - name |
| - handle |
| - flags |
| - key-len |
| - key-type |
| - data-type |
| - data-len |
| - obj-type |
| - gc-interval |
| - policy |
| - userdata |
| - desc |
| - expr |
| - expressions |
| dump: |
| request: |
| attributes: |
| # Mentioned in nf_tables_getset() |
| - table |
| reply: |
| attributes: *get-set |
| - |
| name: delset |
| doc: Delete an existing set. |
| attribute-set: set-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa0b |
| attributes: &del-set |
| # Mentioned in nf_tables_delset() |
| - table |
| - handle |
| - name |
| - |
| name: destroyset |
| doc: | |
| Delete an existing set with destroy semantics (ignoring ENOENT errors). |
| attribute-set: set-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa1d |
| attributes: *del-set |
| - |
| name: newsetelem |
| doc: Create a new set element. |
| attribute-set: setelem-list-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa0c |
| attributes: |
| # Mentioned in nf_tables_newsetelem() |
| - table |
| - set |
| - set-id |
| - elements |
| - |
| name: getsetelem |
| doc: Get / dump set elements. |
| attribute-set: setelem-list-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa0d |
| attributes: |
| # Mentioned in nf_tables_getsetelem() |
| - table |
| - set |
| - elements |
| reply: |
| value: 0xa0c |
| attributes: |
| # Mentioned in nf_tables_fill_setelem_info() |
| - elements |
| dump: |
| request: |
| attributes: &dump-set-request |
| # Mentioned in nft_set_dump_ctx_init() |
| - table |
| - set |
| reply: |
| attributes: &dump-set |
| # Mentioned in nf_tables_dump_set() |
| - table |
| - set |
| - elements |
| - |
| name: getsetelem-reset |
| doc: Get / dump set elements and reset stateful expressions. |
| attribute-set: setelem-list-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa21 |
| attributes: |
| # Mentioned in nf_tables_getsetelem_reset() |
| - elements |
| reply: |
| value: 0xa0c |
| attributes: |
| # Mentioned in nf_tables_dumpreset_set() |
| - table |
| - set |
| - elements |
| dump: |
| request: |
| attributes: *dump-set-request |
| reply: |
| attributes: *dump-set |
| - |
| name: delsetelem |
| doc: Delete an existing set element. |
| attribute-set: setelem-list-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa0e |
| attributes: &del-setelem |
| # Mentioned in nf_tables_delsetelem() |
| - table |
| - set |
| - elements |
| - |
| name: destroysetelem |
| doc: Delete an existing set element with destroy semantics. |
| attribute-set: setelem-list-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa1e |
| attributes: *del-setelem |
| - |
| name: getgen |
| doc: Get / dump rule-set generation. |
| attribute-set: gen-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa10 |
| reply: |
| value: 0xa0f |
| attributes: &get-gen |
| # Mentioned in nf_tables_fill_gen_info() |
| - id |
| - proc-pid |
| - proc-name |
| dump: |
| reply: |
| attributes: *get-gen |
| - |
| name: newobj |
| doc: Create a new stateful object. |
| attribute-set: obj-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa12 |
| attributes: |
| # Mentioned in nf_tables_newobj() |
| - type |
| - name |
| - data |
| - table |
| - userdata |
| - |
| name: getobj |
| doc: Get / dump stateful objects. |
| attribute-set: obj-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa13 |
| attributes: |
| # Mentioned in nf_tables_getobj_single() |
| - name |
| - type |
| - table |
| reply: |
| value: 0xa12 |
| attributes: &obj-info |
| # Mentioned in nf_tables_fill_obj_info() |
| - table |
| - name |
| - type |
| - handle |
| - use |
| - data |
| - userdata |
| dump: |
| request: |
| attributes: |
| # Mentioned in nf_tables_dump_obj_start() |
| - table |
| - type |
| reply: |
| attributes: *obj-info |
| - |
| name: delobj |
| doc: Delete an existing stateful object. |
| attribute-set: obj-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa14 |
| attributes: |
| # Mentioned in nf_tables_delobj() |
| - table |
| - name |
| - type |
| - handle |
| - |
| name: destroyobj |
| doc: Delete an existing stateful object with destroy semantics. |
| attribute-set: obj-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa1f |
| attributes: |
| # Mentioned in nf_tables_delobj() |
| - table |
| - name |
| - type |
| - handle |
| - |
| name: newflowtable |
| doc: Create a new flow table. |
| attribute-set: flowtable-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa16 |
| attributes: |
| # Mentioned in nf_tables_newflowtable() |
| - table |
| - name |
| - hook |
| - flags |
| - |
| name: getflowtable |
| doc: Get / dump flow tables. |
| attribute-set: flowtable-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa17 |
| attributes: |
| # Mentioned in nf_tables_getflowtable() |
| - name |
| - table |
| reply: |
| value: 0xa16 |
| attributes: &flowtable-info |
| # Mentioned in nf_tables_fill_flowtable_info() |
| - table |
| - name |
| - handle |
| - use |
| - flags |
| - hook |
| dump: |
| reply: |
| attributes: *flowtable-info |
| - |
| name: delflowtable |
| doc: Delete an existing flow table. |
| attribute-set: flowtable-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa18 |
| attributes: &del-flowtable |
| # Mentioned in nf_tables_delflowtable() |
| - table |
| - name |
| - handle |
| - hook |
| - |
| name: destroyflowtable |
| doc: Delete an existing flow table with destroy semantics. |
| attribute-set: flowtable-attrs |
| fixed-header: nfgenmsg |
| do: |
| request: |
| value: 0xa20 |
| attributes: *del-flowtable |
| |
| mcast-groups: |
| list: |
| - |
| name: mgmt |
