History

netfilter: add nftables

This patch adds nftables which is the intended successor of iptables. This packet filtering framework reuses the existing netfilter hooks, the connection tracking system, the NAT subsystem, the transparent proxying engine, the logging infrastructure and the userspace packet queueing facilities. In a nutshell, nftables provides a pseudo-state machine with 4 general purpose registers of 128 bits and 1 specific purpose register to store verdicts. This pseudo-machine comes with an extensible instruction set, a.k.a. "expressions" in the nftables jargon. The expressions included in this patch provide the basic functionality, they are: * bitwise: to perform bitwise operations. * byteorder: to change from host/network endianess. * cmp: to compare data with the content of the registers. * counter: to enable counters on rules. * ct: to store conntrack keys into register. * exthdr: to match IPv6 extension headers. * immediate: to load data into registers. * limit: to limit matching based on packet rate. * log: to log packets. * meta: to match metainformation that usually comes with the skbuff. * nat: to perform Network Address Translation. * payload: to fetch data from the packet payload and store it into registers. * reject (IPv4 only): to explicitly close connection, eg. TCP RST. Using this instruction-set, the userspace utility 'nft' can transform the rules expressed in human-readable text representation (using a new syntax, inspired by tcpdump) to nftables bytecode. nftables also inherits the table, chain and rule objects from iptables, but in a more configurable way, and it also includes the original datatype-agnostic set infrastructure with mapping support. This set infrastructure is enhanced in the follow up patch (netfilter: nf_tables: add netlink set API). This patch includes the following components: * the netlink API: net/netfilter/nf_tables_api.c and include/uapi/netfilter/nf_tables.h * the packet filter core: net/netfilter/nf_tables_core.c * the expressions (described above): net/netfilter/nft_*.c * the filter tables: arp, IPv4, IPv6 and bridge: net/ipv4/netfilter/nf_tables_ipv4.c net/ipv6/netfilter/nf_tables_ipv6.c net/ipv4/netfilter/nf_tables_arp.c net/bridge/netfilter/nf_tables_bridge.c * the NAT table (IPv4 only): net/ipv4/netfilter/nf_table_nat_ipv4.c * the route table (similar to mangle): net/ipv4/netfilter/nf_table_route_ipv4.c net/ipv6/netfilter/nf_table_route_ipv6.c * internal definitions under: include/net/netfilter/nf_tables.h include/net/netfilter/nf_tables_core.h * It also includes an skeleton expression: net/netfilter/nft_expr_template.c and the preliminary implementation of the meta target net/netfilter/nft_meta_target.c It also includes a change in struct nf_hook_ops to add a new pointer to store private data to the hook, that is used to store the rule list per chain. This patch is based on the patch from Patrick McHardy, plus merged accumulated cleanups, fixes and small enhancements to the nftables code that has been done since 2009, which are: From Patrick McHardy: * nf_tables: adjust netlink handler function signatures * nf_tables: only retry table lookup after successful table module load * nf_tables: fix event notification echo and avoid unnecessary messages * nft_ct: add l3proto support * nf_tables: pass expression context to nft_validate_data_load() * nf_tables: remove redundant definition * nft_ct: fix maxattr initialization * nf_tables: fix invalid event type in nf_tables_getrule() * nf_tables: simplify nft_data_init() usage * nf_tables: build in more core modules * nf_tables: fix double lookup expression unregistation * nf_tables: move expression initialization to nf_tables_core.c * nf_tables: build in payload module * nf_tables: use NFPROTO constants * nf_tables: rename pid variables to portid * nf_tables: save 48 bits per rule * nf_tables: introduce chain rename * nf_tables: check for duplicate names on chain rename * nf_tables: remove ability to specify handles for new rules * nf_tables: return error for rule change request * nf_tables: return error for NLM_F_REPLACE without rule handle * nf_tables: include NLM_F_APPEND/NLM_F_REPLACE flags in rule notification * nf_tables: fix NLM_F_MULTI usage in netlink notifications * nf_tables: include NLM_F_APPEND in rule dumps From Pablo Neira Ayuso: * nf_tables: fix stack overflow in nf_tables_newrule * nf_tables: nft_ct: fix compilation warning * nf_tables: nft_ct: fix crash with invalid packets * nft_log: group and qthreshold are 2^16 * nf_tables: nft_meta: fix socket uid,gid handling * nft_counter: allow to restore counters * nf_tables: fix module autoload * nf_tables: allow to remove all rules placed in one chain * nf_tables: use 64-bits rule handle instead of 16-bits * nf_tables: fix chain after rule deletion * nf_tables: improve deletion performance * nf_tables: add missing code in route chain type * nf_tables: rise maximum number of expressions from 12 to 128 * nf_tables: don't delete table if in use * nf_tables: fix basechain release From Tomasz Bursztyka: * nf_tables: Add support for changing users chain's name * nf_tables: Change chain's name to be fixed sized * nf_tables: Add support for replacing a rule by another one * nf_tables: Update uapi nftables netlink header documentation From Florian Westphal: * nft_log: group is u16, snaplen u32 From Phil Oester: * nf_tables: operational limit match

Patrick McHardy committed 13 years ago

Commit 96518511 parent f59cb0439 files · +6393 −6Browse files

Showing the changes to include/uapi/linux (4 of 39 files). Show all

Unified · Split

4 files
  1. include/uapi/linux/netfilter/Kbuild +1 −0
  2. include/uapi/linux/netfilter/nf_conntrack_common.h +4 −0
  3. include/uapi/linux/netfilter/nf_tables.h +582 −0
  4. include/uapi/linux/netfilter/nfnetlink.h +4 −1
include/uapi/linux/netfilter/Kbuild+1−0
@@ -5,6 +5,7 @@ header-y += nf_conntrack_ftp.h · 4 unmodified lines
5header-y += nf_conntrack_sctp.h5header-y += nf_conntrack_sctp.h
6header-y += nf_conntrack_tcp.h6header-y += nf_conntrack_tcp.h
7header-y += nf_conntrack_tuple_common.h7header-y += nf_conntrack_tuple_common.h
8header-y += nf_tables.h
8header-y += nf_nat.h9header-y += nf_nat.h
9header-y += nfnetlink.h10header-y += nfnetlink.h
10header-y += nfnetlink_acct.h11header-y += nfnetlink_acct.h
include/uapi/linux/netfilter/nf_conntrack_common.h+4−0
@@ -25,6 +25,10 @@ enum ip_conntrack_info { · 24 unmodified lines
25 IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 125 IP_CT_NUMBER = IP_CT_IS_REPLY * 2 - 1
26};26};
27 27
28#define NF_CT_STATE_INVALID_BIT (1 << 0)
29#define NF_CT_STATE_BIT(ctinfo) (1 << ((ctinfo) % IP_CT_IS_REPLY + 1))
30#define NF_CT_STATE_UNTRACKED_BIT (1 << (IP_CT_NUMBER + 1))
31
28/* Bitset representing status of connection. */32/* Bitset representing status of connection. */
29enum ip_conntrack_status {33enum ip_conntrack_status {
30 /* It's an expected connection: bit 0 set. This bit never changed */34 /* It's an expected connection: bit 0 set. This bit never changed */
include/uapi/linux/netfilter/nf_tables.h+582−0
@@ -0,0 +1,582 @@
1#ifndef _LINUX_NF_TABLES_H
2#define _LINUX_NF_TABLES_H
3
4#define NFT_CHAIN_MAXNAMELEN 32
5
6enum nft_registers {
7 NFT_REG_VERDICT,
8 NFT_REG_1,
9 NFT_REG_2,
10 NFT_REG_3,
11 NFT_REG_4,
12 __NFT_REG_MAX
13};
14#define NFT_REG_MAX (__NFT_REG_MAX - 1)
15
16/**
17 * enum nft_verdicts - nf_tables internal verdicts
18 *
19 * @NFT_CONTINUE: continue evaluation of the current rule
20 * @NFT_BREAK: terminate evaluation of the current rule
21 * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
22 * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
23 * @NFT_RETURN: return to the topmost chain on the jump stack
24 *
25 * The nf_tables verdicts share their numeric space with the netfilter verdicts.
26 */
27enum nft_verdicts {
28 NFT_CONTINUE = -1,
29 NFT_BREAK = -2,
30 NFT_JUMP = -3,
31 NFT_GOTO = -4,
32 NFT_RETURN = -5,
33};
34
35/**
36 * enum nf_tables_msg_types - nf_tables netlink message types
37 *
38 * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
39 * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
40 * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
41 * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
42 * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
43 * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
44 * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
45 * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
46 * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
47 */
48enum nf_tables_msg_types {
49 NFT_MSG_NEWTABLE,
50 NFT_MSG_GETTABLE,
51 NFT_MSG_DELTABLE,
52 NFT_MSG_NEWCHAIN,
53 NFT_MSG_GETCHAIN,
54 NFT_MSG_DELCHAIN,
55 NFT_MSG_NEWRULE,
56 NFT_MSG_GETRULE,
57 NFT_MSG_DELRULE,
58 NFT_MSG_MAX,
59};
60
61enum nft_list_attributes {
62 NFTA_LIST_UNPEC,
63 NFTA_LIST_ELEM,
64 __NFTA_LIST_MAX
65};
66#define NFTA_LIST_MAX (__NFTA_LIST_MAX - 1)
67
68/**
69 * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
70 *
71 * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
72 * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
73 */
74enum nft_hook_attributes {
75 NFTA_HOOK_UNSPEC,
76 NFTA_HOOK_HOOKNUM,
77 NFTA_HOOK_PRIORITY,
78 __NFTA_HOOK_MAX
79};
80#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
81
82/**
83 * enum nft_table_attributes - nf_tables table netlink attributes
84 *
85 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
86 */
87enum nft_table_attributes {
88 NFTA_TABLE_UNSPEC,
89 NFTA_TABLE_NAME,
90 __NFTA_TABLE_MAX
91};
92#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
93
94/**
95 * enum nft_chain_attributes - nf_tables chain netlink attributes
96 *
97 * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
98 * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
99 * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
100 * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
101 */
102enum nft_chain_attributes {
103 NFTA_CHAIN_UNSPEC,
104 NFTA_CHAIN_TABLE,
105 NFTA_CHAIN_HANDLE,
106 NFTA_CHAIN_NAME,
107 NFTA_CHAIN_HOOK,
108 __NFTA_CHAIN_MAX
109};
110#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
111
112/**
113 * enum nft_rule_attributes - nf_tables rule netlink attributes
114 *
115 * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
116 * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
117 * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
118 * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
119 */
120enum nft_rule_attributes {
121 NFTA_RULE_UNSPEC,
122 NFTA_RULE_TABLE,
123 NFTA_RULE_CHAIN,
124 NFTA_RULE_HANDLE,
125 NFTA_RULE_EXPRESSIONS,
126 __NFTA_RULE_MAX
127};
128#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
129
130enum nft_data_attributes {
131 NFTA_DATA_UNSPEC,
132 NFTA_DATA_VALUE,
133 NFTA_DATA_VERDICT,
134 __NFTA_DATA_MAX
135};
136#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
137
138/**
139 * enum nft_verdict_attributes - nf_tables verdict netlink attributes
140 *
141 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
142 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
143 */
144enum nft_verdict_attributes {
145 NFTA_VERDICT_UNSPEC,
146 NFTA_VERDICT_CODE,
147 NFTA_VERDICT_CHAIN,
148 __NFTA_VERDICT_MAX
149};
150#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
151
152/**
153 * enum nft_expr_attributes - nf_tables expression netlink attributes
154 *
155 * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
156 * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
157 */
158enum nft_expr_attributes {
159 NFTA_EXPR_UNSPEC,
160 NFTA_EXPR_NAME,
161 NFTA_EXPR_DATA,
162 __NFTA_EXPR_MAX
163};
164#define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1)
165
166/**
167 * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
168 *
169 * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
170 * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
171 */
172enum nft_immediate_attributes {
173 NFTA_IMMEDIATE_UNSPEC,
174 NFTA_IMMEDIATE_DREG,
175 NFTA_IMMEDIATE_DATA,
176 __NFTA_IMMEDIATE_MAX
177};
178#define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1)
179
180/**
181 * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
182 *
183 * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
184 * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
185 * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
186 * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
187 * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
188 *
189 * The bitwise expression performs the following operation:
190 *
191 * dreg = (sreg & mask) ^ xor
192 *
193 * which allow to express all bitwise operations:
194 *
195 * mask xor
196 * NOT: 1 1
197 * OR: 0 x
198 * XOR: 1 x
199 * AND: x 0
200 */
201enum nft_bitwise_attributes {
202 NFTA_BITWISE_UNSPEC,
203 NFTA_BITWISE_SREG,
204 NFTA_BITWISE_DREG,
205 NFTA_BITWISE_LEN,
206 NFTA_BITWISE_MASK,
207 NFTA_BITWISE_XOR,
208 __NFTA_BITWISE_MAX
209};
210#define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1)
211
212/**
213 * enum nft_byteorder_ops - nf_tables byteorder operators
214 *
215 * @NFT_BYTEORDER_NTOH: network to host operator
216 * @NFT_BYTEORDER_HTON: host to network opertaor
217 */
218enum nft_byteorder_ops {
219 NFT_BYTEORDER_NTOH,
220 NFT_BYTEORDER_HTON,
221};
222
223/**
224 * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
225 *
226 * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
227 * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
228 * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
229 * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
230 * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
231 */
232enum nft_byteorder_attributes {
233 NFTA_BYTEORDER_UNSPEC,
234 NFTA_BYTEORDER_SREG,
235 NFTA_BYTEORDER_DREG,
236 NFTA_BYTEORDER_OP,
237 NFTA_BYTEORDER_LEN,
238 NFTA_BYTEORDER_SIZE,
239 __NFTA_BYTEORDER_MAX
240};
241#define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1)
242
243/**
244 * enum nft_cmp_ops - nf_tables relational operator
245 *
246 * @NFT_CMP_EQ: equal
247 * @NFT_CMP_NEQ: not equal
248 * @NFT_CMP_LT: less than
249 * @NFT_CMP_LTE: less than or equal to
250 * @NFT_CMP_GT: greater than
251 * @NFT_CMP_GTE: greater than or equal to
252 */
253enum nft_cmp_ops {
254 NFT_CMP_EQ,
255 NFT_CMP_NEQ,
256 NFT_CMP_LT,
257 NFT_CMP_LTE,
258 NFT_CMP_GT,
259 NFT_CMP_GTE,
260};
261
262/**
263 * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
264 *
265 * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
266 * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
267 * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
268 */
269enum nft_cmp_attributes {
270 NFTA_CMP_UNSPEC,
271 NFTA_CMP_SREG,
272 NFTA_CMP_OP,
273 NFTA_CMP_DATA,
274 __NFTA_CMP_MAX
275};
276#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
277
278enum nft_set_elem_flags {
279 NFT_SE_INTERVAL_END = 0x1,
280};
281
282enum nft_set_elem_attributes {
283 NFTA_SE_UNSPEC,
284 NFTA_SE_KEY,
285 NFTA_SE_DATA,
286 NFTA_SE_FLAGS,
287 __NFTA_SE_MAX
288};
289#define NFTA_SE_MAX (__NFTA_SE_MAX - 1)
290
291enum nft_set_flags {
292 NFT_SET_INTERVAL = 0x1,
293 NFT_SET_MAP = 0x2,
294};
295
296enum nft_set_attributes {
297 NFTA_SET_UNSPEC,
298 NFTA_SET_FLAGS,
299 NFTA_SET_SREG,
300 NFTA_SET_DREG,
301 NFTA_SET_KLEN,
302 NFTA_SET_DLEN,
303 NFTA_SET_ELEMENTS,
304 __NFTA_SET_MAX
305};
306#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
307
308enum nft_hash_flags {
309 NFT_HASH_MAP = 0x1,
310};
311
312enum nft_hash_elem_attributes {
313 NFTA_HE_UNSPEC,
314 NFTA_HE_KEY,
315 NFTA_HE_DATA,
316 __NFTA_HE_MAX
317};
318#define NFTA_HE_MAX (__NFTA_HE_MAX - 1)
319
320enum nft_hash_attributes {
321 NFTA_HASH_UNSPEC,
322 NFTA_HASH_FLAGS,
323 NFTA_HASH_SREG,
324 NFTA_HASH_DREG,
325 NFTA_HASH_KLEN,
326 NFTA_HASH_ELEMENTS,
327 __NFTA_HASH_MAX
328};
329#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
330
331/**
332 * enum nft_payload_bases - nf_tables payload expression offset bases
333 *
334 * @NFT_PAYLOAD_LL_HEADER: link layer header
335 * @NFT_PAYLOAD_NETWORK_HEADER: network header
336 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
337 */
338enum nft_payload_bases {
339 NFT_PAYLOAD_LL_HEADER,
340 NFT_PAYLOAD_NETWORK_HEADER,
341 NFT_PAYLOAD_TRANSPORT_HEADER,
342};
343
344/**
345 * enum nft_payload_attributes - nf_tables payload expression netlink attributes
346 *
347 * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
348 * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
349 * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
350 * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
351 */
352enum nft_payload_attributes {
353 NFTA_PAYLOAD_UNSPEC,
354 NFTA_PAYLOAD_DREG,
355 NFTA_PAYLOAD_BASE,
356 NFTA_PAYLOAD_OFFSET,
357 NFTA_PAYLOAD_LEN,
358 __NFTA_PAYLOAD_MAX
359};
360#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
361
362/**
363 * enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
364 *
365 * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
366 * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
367 * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
368 * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
369 */
370enum nft_exthdr_attributes {
371 NFTA_EXTHDR_UNSPEC,
372 NFTA_EXTHDR_DREG,
373 NFTA_EXTHDR_TYPE,
374 NFTA_EXTHDR_OFFSET,
375 NFTA_EXTHDR_LEN,
376 __NFTA_EXTHDR_MAX
377};
378#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
379
380/**
381 * enum nft_meta_keys - nf_tables meta expression keys
382 *
383 * @NFT_META_LEN: packet length (skb->len)
384 * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
385 * @NFT_META_PRIORITY: packet priority (skb->priority)
386 * @NFT_META_MARK: packet mark (skb->mark)
387 * @NFT_META_IIF: packet input interface index (dev->ifindex)
388 * @NFT_META_OIF: packet output interface index (dev->ifindex)
389 * @NFT_META_IIFNAME: packet input interface name (dev->name)
390 * @NFT_META_OIFNAME: packet output interface name (dev->name)
391 * @NFT_META_IIFTYPE: packet input interface type (dev->type)
392 * @NFT_META_OIFTYPE: packet output interface type (dev->type)
393 * @NFT_META_SKUID: originating socket UID (fsuid)
394 * @NFT_META_SKGID: originating socket GID (fsgid)
395 * @NFT_META_NFTRACE: packet nftrace bit
396 * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
397 * @NFT_META_SECMARK: packet secmark (skb->secmark)
398 */
399enum nft_meta_keys {
400 NFT_META_LEN,
401 NFT_META_PROTOCOL,
402 NFT_META_PRIORITY,
403 NFT_META_MARK,
404 NFT_META_IIF,
405 NFT_META_OIF,
406 NFT_META_IIFNAME,
407 NFT_META_OIFNAME,
408 NFT_META_IIFTYPE,
409 NFT_META_OIFTYPE,
410 NFT_META_SKUID,
411 NFT_META_SKGID,
412 NFT_META_NFTRACE,
413 NFT_META_RTCLASSID,
414 NFT_META_SECMARK,
415};
416
417/**
418 * enum nft_meta_attributes - nf_tables meta expression netlink attributes
419 *
420 * @NFTA_META_DREG: destination register (NLA_U32)
421 * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
422 */
423enum nft_meta_attributes {
424 NFTA_META_UNSPEC,
425 NFTA_META_DREG,
426 NFTA_META_KEY,
427 __NFTA_META_MAX
428};
429#define NFTA_META_MAX (__NFTA_META_MAX - 1)
430
431/**
432 * enum nft_ct_keys - nf_tables ct expression keys
433 *
434 * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
435 * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
436 * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
437 * @NFT_CT_MARK: conntrack mark value
438 * @NFT_CT_SECMARK: conntrack secmark value
439 * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
440 * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
441 * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
442 * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
443 * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
444 * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
445 * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
446 * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
447 */
448enum nft_ct_keys {
449 NFT_CT_STATE,
450 NFT_CT_DIRECTION,
451 NFT_CT_STATUS,
452 NFT_CT_MARK,
453 NFT_CT_SECMARK,
454 NFT_CT_EXPIRATION,
455 NFT_CT_HELPER,
456 NFT_CT_L3PROTOCOL,
457 NFT_CT_SRC,
458 NFT_CT_DST,
459 NFT_CT_PROTOCOL,
460 NFT_CT_PROTO_SRC,
461 NFT_CT_PROTO_DST,
462};
463
464/**
465 * enum nft_ct_attributes - nf_tables ct expression netlink attributes
466 *
467 * @NFTA_CT_DREG: destination register (NLA_U32)
468 * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
469 * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
470 */
471enum nft_ct_attributes {
472 NFTA_CT_UNSPEC,
473 NFTA_CT_DREG,
474 NFTA_CT_KEY,
475 NFTA_CT_DIRECTION,
476 __NFTA_CT_MAX
477};
478#define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
479
480/**
481 * enum nft_limit_attributes - nf_tables limit expression netlink attributes
482 *
483 * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
484 * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
485 */
486enum nft_limit_attributes {
487 NFTA_LIMIT_UNSPEC,
488 NFTA_LIMIT_RATE,
489 NFTA_LIMIT_UNIT,
490 __NFTA_LIMIT_MAX
491};
492#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
493
494/**
495 * enum nft_counter_attributes - nf_tables counter expression netlink attributes
496 *
497 * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
498 * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
499 */
500enum nft_counter_attributes {
501 NFTA_COUNTER_UNSPEC,
502 NFTA_COUNTER_BYTES,
503 NFTA_COUNTER_PACKETS,
504 __NFTA_COUNTER_MAX
505};
506#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
507
508/**
509 * enum nft_log_attributes - nf_tables log expression netlink attributes
510 *
511 * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
512 * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
513 * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
514 * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
515 */
516enum nft_log_attributes {
517 NFTA_LOG_UNSPEC,
518 NFTA_LOG_GROUP,
519 NFTA_LOG_PREFIX,
520 NFTA_LOG_SNAPLEN,
521 NFTA_LOG_QTHRESHOLD,
522 __NFTA_LOG_MAX
523};
524#define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)
525
526/**
527 * enum nft_reject_types - nf_tables reject expression reject types
528 *
529 * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
530 * @NFT_REJECT_TCP_RST: reject using TCP RST
531 */
532enum nft_reject_types {
533 NFT_REJECT_ICMP_UNREACH,
534 NFT_REJECT_TCP_RST,
535};
536
537/**
538 * enum nft_reject_attributes - nf_tables reject expression netlink attributes
539 *
540 * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
541 * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
542 */
543enum nft_reject_attributes {
544 NFTA_REJECT_UNSPEC,
545 NFTA_REJECT_TYPE,
546 NFTA_REJECT_ICMP_CODE,
547 __NFTA_REJECT_MAX
548};
549#define NFTA_REJECT_MAX (__NFTA_REJECT_MAX - 1)
550
551/**
552 * enum nft_nat_types - nf_tables nat expression NAT types
553 *
554 * @NFT_NAT_SNAT: source NAT
555 * @NFT_NAT_DNAT: destination NAT
556 */
557enum nft_nat_types {
558 NFT_NAT_SNAT,
559 NFT_NAT_DNAT,
560};
561
562/**
563 * enum nft_nat_attributes - nf_tables nat expression netlink attributes
564 *
565 * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
566 * @NFTA_NAT_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
567 * @NFTA_NAT_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
568 * @NFTA_NAT_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
569 * @NFTA_NAT_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
570 */
571enum nft_nat_attributes {
572 NFTA_NAT_UNSPEC,
573 NFTA_NAT_TYPE,
574 NFTA_NAT_ADDR_MIN,
575 NFTA_NAT_ADDR_MAX,
576 NFTA_NAT_PROTO_MIN,
577 NFTA_NAT_PROTO_MAX,
578 __NFTA_NAT_MAX
579};
580#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
581
582#endif /* _LINUX_NF_TABLES_H */
include/uapi/linux/netfilter/nfnetlink.h+4−1
@@ -18,6 +18,8 @@ enum nfnetlink_groups { · 17 unmodified lines
18#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE18#define NFNLGRP_CONNTRACK_EXP_UPDATE NFNLGRP_CONNTRACK_EXP_UPDATE
19 NFNLGRP_CONNTRACK_EXP_DESTROY,19 NFNLGRP_CONNTRACK_EXP_DESTROY,
20#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY20#define NFNLGRP_CONNTRACK_EXP_DESTROY NFNLGRP_CONNTRACK_EXP_DESTROY
21 NFNLGRP_NFTABLES,
22#define NFNLGRP_NFTABLES NFNLGRP_NFTABLES
21 __NFNLGRP_MAX,23 __NFNLGRP_MAX,
22};24};
23#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)25#define NFNLGRP_MAX (__NFNLGRP_MAX - 1)
@@ -51,6 +53,7 @@ struct nfgenmsg { · 27 unmodified lines
51#define NFNL_SUBSYS_ACCT 753#define NFNL_SUBSYS_ACCT 7
52#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 854#define NFNL_SUBSYS_CTNETLINK_TIMEOUT 8
53#define NFNL_SUBSYS_CTHELPER 955#define NFNL_SUBSYS_CTHELPER 9
54#define NFNL_SUBSYS_COUNT 1056#define NFNL_SUBSYS_NFTABLES 10
57#define NFNL_SUBSYS_COUNT 11
55 58
56#endif /* _UAPI_NFNETLINK_H */59#endif /* _UAPI_NFNETLINK_H */

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t