mirror of
https://github.com/torvalds/linux.git
synced 2026-04-18 06:44:00 -04:00
568b370f12
Filled out operation attributes: - newtable - gettable - deltable - destroytable - newchain - getchain - delchain - destroychain - newrule - getrule - getrule-reset - delrule - destroyrule - newset - getset - delset - destroyset - newsetelem - getsetelem - getsetelem-reset - delsetelem - destroysetelem - getgen - newobj - getobj - delobj - destroyobj - newflowtable - getflowtable - delflowtable - destroyflowtable Signed-off-by: Remy D. Farley <one-d-wide@protonmail.com> Link: https://patch.msgid.link/20260303195638.381642-6-one-d-wide@protonmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2124 lines
44 KiB
YAML
2124 lines
44 KiB
YAML
# SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)
|
|
---
|
|
name: nftables
|
|
protocol: netlink-raw
|
|
protonum: 12
|
|
|
|
doc: >-
|
|
Netfilter nftables configuration over netlink.
|
|
|
|
definitions:
|
|
-
|
|
name: nfgenmsg
|
|
type: struct
|
|
members:
|
|
-
|
|
name: nfgen-family
|
|
type: u8
|
|
-
|
|
name: version
|
|
type: u8
|
|
-
|
|
name: res-id
|
|
byte-order: big-endian
|
|
type: u16
|
|
-
|
|
name: meta-keys
|
|
type: enum
|
|
entries:
|
|
- len
|
|
- protocol
|
|
- priority
|
|
- mark
|
|
- iif
|
|
- oif
|
|
- iifname
|
|
- oifname
|
|
- iftype
|
|
- oiftype
|
|
- skuid
|
|
- skgid
|
|
- nftrace
|
|
- rtclassid
|
|
- secmark
|
|
- nfproto
|
|
- l4-proto
|
|
- bri-iifname
|
|
- bri-oifname
|
|
- pkttype
|
|
- cpu
|
|
- iifgroup
|
|
- oifgroup
|
|
- cgroup
|
|
- prandom
|
|
- secpath
|
|
- iifkind
|
|
- oifkind
|
|
- bri-iifpvid
|
|
- bri-iifvproto
|
|
- time-ns
|
|
- time-day
|
|
- time-hour
|
|
- sdif
|
|
- sdifname
|
|
- bri-broute
|
|
-
|
|
name: bitwise-ops
|
|
type: enum
|
|
entries:
|
|
-
|
|
name: mask-xor # aka bool (old name)
|
|
doc: >-
|
|
mask-and-xor operation used to implement NOT, AND, OR and XOR boolean
|
|
operations
|
|
-
|
|
name: lshift
|
|
-
|
|
name: rshift
|
|
-
|
|
name: and
|
|
-
|
|
name: or
|
|
-
|
|
name: xor
|
|
-
|
|
name: cmp-ops
|
|
type: enum
|
|
entries:
|
|
- eq
|
|
- neq
|
|
- lt
|
|
- lte
|
|
- gt
|
|
- gte
|
|
-
|
|
name: object-type
|
|
type: enum
|
|
entries:
|
|
- unspec
|
|
- counter
|
|
- quota
|
|
- ct-helper
|
|
- limit
|
|
- connlimit
|
|
- tunnel
|
|
- ct-timeout
|
|
- secmark
|
|
- ct-expect
|
|
- synproxy
|
|
-
|
|
name: nat-range-flags
|
|
type: flags
|
|
entries:
|
|
- map-ips
|
|
- proto-specified
|
|
- proto-random
|
|
- persistent
|
|
- proto-random-fully
|
|
- proto-offset
|
|
- netmap
|
|
-
|
|
name: table-flags
|
|
type: flags
|
|
entries:
|
|
- dormant
|
|
- owner
|
|
- persist
|
|
-
|
|
name: chain-flags
|
|
type: flags
|
|
entries:
|
|
- base
|
|
- hw-offload
|
|
- binding
|
|
-
|
|
name: set-flags
|
|
type: flags
|
|
entries:
|
|
- anonymous
|
|
- constant
|
|
- interval
|
|
- map
|
|
- timeout
|
|
- eval
|
|
- object
|
|
- concat
|
|
- expr
|
|
-
|
|
name: set-elem-flags
|
|
type: flags
|
|
entries:
|
|
- interval-end
|
|
- catchall
|
|
-
|
|
name: lookup-flags
|
|
type: flags
|
|
entries:
|
|
- invert
|
|
-
|
|
name: ct-keys
|
|
type: enum
|
|
entries:
|
|
- state
|
|
- direction
|
|
- status
|
|
- mark
|
|
- secmark
|
|
- expiration
|
|
- helper
|
|
- l3protocol
|
|
- src
|
|
- dst
|
|
- protocol
|
|
- proto-src
|
|
- proto-dst
|
|
- labels
|
|
- pkts
|
|
- bytes
|
|
- avgpkt
|
|
- zone
|
|
- eventmask
|
|
- src-ip
|
|
- dst-ip
|
|
- src-ip6
|
|
- dst-ip6
|
|
- ct-id
|
|
-
|
|
name: ct-direction
|
|
type: enum
|
|
entries:
|
|
- original
|
|
- reply
|
|
-
|
|
name: quota-flags
|
|
type: flags
|
|
entries:
|
|
- invert
|
|
- depleted
|
|
-
|
|
name: verdict-code
|
|
type: enum
|
|
entries:
|
|
- name: continue
|
|
value: 0xffffffff
|
|
- name: break
|
|
value: 0xfffffffe
|
|
- name: jump
|
|
value: 0xfffffffd
|
|
- name: goto
|
|
value: 0xfffffffc
|
|
- name: return
|
|
value: 0xfffffffb
|
|
- name: drop
|
|
value: 0
|
|
- name: accept
|
|
value: 1
|
|
- name: stolen
|
|
value: 2
|
|
- name: queue
|
|
value: 3
|
|
- name: repeat
|
|
value: 4
|
|
-
|
|
name: fib-result
|
|
type: enum
|
|
entries:
|
|
- oif
|
|
- oifname
|
|
- addrtype
|
|
-
|
|
name: fib-flags
|
|
type: flags
|
|
entries:
|
|
- saddr
|
|
- daddr
|
|
- mark
|
|
- iif
|
|
- oif
|
|
- present
|
|
-
|
|
name: reject-types
|
|
type: enum
|
|
entries:
|
|
- icmp-unreach
|
|
- tcp-rst
|
|
- icmpx-unreach
|
|
-
|
|
name: reject-inet-code
|
|
doc: These codes are mapped to real ICMP and ICMPv6 codes.
|
|
type: enum
|
|
entries:
|
|
- icmpx-no-route
|
|
- icmpx-port-unreach
|
|
- icmpx-host-unreach
|
|
- icmpx-admin-prohibited
|
|
-
|
|
name: payload-base
|
|
type: enum
|
|
entries:
|
|
- link-layer-header
|
|
- network-header
|
|
- transport-header
|
|
- inner-header
|
|
- tun-header
|
|
-
|
|
name: range-ops
|
|
doc: Range operator
|
|
type: enum
|
|
entries:
|
|
- eq
|
|
- neq
|
|
-
|
|
name: registers
|
|
doc: |
|
|
nf_tables registers.
|
|
nf_tables used to have five registers: a verdict register and four data
|
|
registers of size 16. The data registers have been changed to 16 registers
|
|
of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
|
|
map to areas of size 16, the 4 byte registers are addressed using
|
|
NFT_REG32_00 - NFT_REG32_15.
|
|
type: enum
|
|
entries:
|
|
-
|
|
name: reg-verdict
|
|
-
|
|
name: reg-1
|
|
-
|
|
name: reg-2
|
|
-
|
|
name: reg-3
|
|
-
|
|
name: reg-4
|
|
-
|
|
name: reg32-00
|
|
value: 8
|
|
-
|
|
name: reg32-01
|
|
-
|
|
name: reg32-02
|
|
-
|
|
name: reg32-03
|
|
-
|
|
name: reg32-04
|
|
-
|
|
name: reg32-05
|
|
-
|
|
name: reg32-06
|
|
-
|
|
name: reg32-07
|
|
-
|
|
name: reg32-08
|
|
-
|
|
name: reg32-09
|
|
-
|
|
name: reg32-10
|
|
-
|
|
name: reg32-11
|
|
-
|
|
name: reg32-12
|
|
-
|
|
name: reg32-13
|
|
-
|
|
name: reg32-14
|
|
-
|
|
name: reg32-15
|
|
-
|
|
name: numgen-types
|
|
type: enum
|
|
entries:
|
|
- incremental
|
|
- random
|
|
-
|
|
name: log-level
|
|
doc: nf_tables log levels
|
|
type: enum
|
|
entries:
|
|
-
|
|
name: emerg
|
|
doc: system is unusable
|
|
-
|
|
name: alert
|
|
doc: action must be taken immediately
|
|
-
|
|
name: crit
|
|
doc: critical conditions
|
|
-
|
|
name: err
|
|
doc: error conditions
|
|
-
|
|
name: warning
|
|
doc: warning conditions
|
|
-
|
|
name: notice
|
|
doc: normal but significant condition
|
|
-
|
|
name: info
|
|
doc: informational
|
|
-
|
|
name: debug
|
|
doc: debug-level messages
|
|
-
|
|
name: audit
|
|
doc: enabling audit logging
|
|
-
|
|
name: log-flags
|
|
doc: nf_tables log flags
|
|
header: linux/netfilter/nf_log.h
|
|
type: flags
|
|
entries:
|
|
-
|
|
name: tcpseq
|
|
doc: Log TCP sequence numbers
|
|
-
|
|
name: tcpopt
|
|
doc: Log TCP options
|
|
-
|
|
name: ipopt
|
|
doc: Log IP options
|
|
-
|
|
name: uid
|
|
doc: Log UID owning local socket
|
|
-
|
|
name: nflog
|
|
doc: Unsupported, don't reuse
|
|
-
|
|
name: macdecode
|
|
doc: Decode MAC header
|
|
|
|
attribute-sets:
|
|
-
|
|
name: log-attrs
|
|
doc: log expression netlink attributes
|
|
attributes:
|
|
# Mentioned in nft_log_init()
|
|
-
|
|
name: group
|
|
doc: netlink group to send messages to
|
|
type: u16
|
|
byte-order: big-endian
|
|
-
|
|
name: prefix
|
|
doc: prefix to prepend to log messages
|
|
type: string
|
|
-
|
|
name: snaplen
|
|
doc: length of payload to include in netlink message
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: qthreshold
|
|
doc: queue threshold
|
|
type: u16
|
|
byte-order: big-endian
|
|
-
|
|
name: level
|
|
doc: log level
|
|
type: u32
|
|
enum: log-level
|
|
byte-order: big-endian
|
|
-
|
|
name: flags
|
|
doc: logging flags
|
|
type: u32
|
|
enum: log-flags
|
|
byte-order: big-endian
|
|
-
|
|
name: numgen-attrs
|
|
doc: nf_tables number generator expression netlink attributes
|
|
attributes:
|
|
-
|
|
name: dreg
|
|
doc: destination register
|
|
type: u32
|
|
enum: registers
|
|
-
|
|
name: modulus
|
|
doc: maximum counter value
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: type
|
|
doc: operation type
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: numgen-types
|
|
-
|
|
name: offset
|
|
doc: offset to be added to the counter
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: range-attrs
|
|
attributes:
|
|
# Mentioned in net/netfilter/nft_range.c
|
|
-
|
|
name: sreg
|
|
doc: source register of data to compare
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: registers
|
|
-
|
|
name: op
|
|
doc: cmp operation
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: range-ops
|
|
checks:
|
|
max: 255
|
|
-
|
|
name: from-data
|
|
doc: data range from
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: to-data
|
|
doc: data range to
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: batch-attrs
|
|
attributes:
|
|
-
|
|
name: genid
|
|
doc: generation ID for this changeset
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: table-attrs
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
doc: name of the table
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: bitmask of flags
|
|
enum: table-flags
|
|
enum-as-flags: true
|
|
-
|
|
name: use
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: number of chains in this table
|
|
-
|
|
name: handle
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: numeric handle of the table
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: userdata
|
|
type: binary
|
|
doc: user data
|
|
-
|
|
name: owner
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: owner of this table through netlink portID
|
|
-
|
|
name: chain-attrs
|
|
attributes:
|
|
-
|
|
name: table
|
|
type: string
|
|
doc: name of the table containing the chain
|
|
-
|
|
name: handle
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: numeric handle of the chain
|
|
-
|
|
name: name
|
|
type: string
|
|
doc: name of the chain
|
|
-
|
|
name: hook
|
|
type: nest
|
|
nested-attributes: nft-hook-attrs
|
|
doc: hook specification for basechains
|
|
-
|
|
name: policy
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: numeric policy of the chain
|
|
-
|
|
name: use
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: number of references to this chain
|
|
-
|
|
name: type
|
|
type: string
|
|
doc: type name of the chain
|
|
-
|
|
name: counters
|
|
type: nest
|
|
nested-attributes: nft-counter-attrs
|
|
doc: counter specification of the chain
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: chain flags
|
|
enum: chain-flags
|
|
enum-as-flags: true
|
|
-
|
|
name: id
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: uniquely identifies a chain in a transaction
|
|
-
|
|
name: userdata
|
|
type: binary
|
|
doc: user data
|
|
-
|
|
name: counter-attrs
|
|
attributes:
|
|
-
|
|
name: bytes
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: packets
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: nft-hook-attrs
|
|
attributes:
|
|
-
|
|
name: num
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: priority
|
|
type: s32
|
|
byte-order: big-endian
|
|
-
|
|
name: dev
|
|
type: string
|
|
doc: net device name
|
|
-
|
|
name: devs
|
|
type: nest
|
|
nested-attributes: hook-dev-attrs
|
|
doc: list of net devices
|
|
-
|
|
name: hook-dev-attrs
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
multi-attr: true
|
|
-
|
|
name: nft-counter-attrs
|
|
attributes:
|
|
-
|
|
name: bytes
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: packets
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: rule-attrs
|
|
attributes:
|
|
-
|
|
name: table
|
|
type: string
|
|
doc: name of the table containing the rule
|
|
-
|
|
name: chain
|
|
type: string
|
|
doc: name of the chain containing the rule
|
|
-
|
|
name: handle
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: numeric handle of the rule
|
|
-
|
|
name: expressions
|
|
type: nest
|
|
nested-attributes: expr-list-attrs
|
|
doc: list of expressions
|
|
-
|
|
name: compat
|
|
type: nest
|
|
nested-attributes: rule-compat-attrs
|
|
doc: compatibility specifications of the rule
|
|
-
|
|
name: position
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: numeric handle of the previous rule
|
|
-
|
|
name: userdata
|
|
type: binary
|
|
doc: user data
|
|
-
|
|
name: id
|
|
type: u32
|
|
doc: uniquely identifies a rule in a transaction
|
|
-
|
|
name: position-id
|
|
type: u32
|
|
doc: transaction unique identifier of the previous rule
|
|
-
|
|
name: chain-id
|
|
type: u32
|
|
doc: add the rule to chain by ID, alternative to chain name
|
|
-
|
|
name: expr-list-attrs
|
|
attributes:
|
|
-
|
|
name: elem
|
|
type: nest
|
|
nested-attributes: expr-attrs
|
|
multi-attr: true
|
|
-
|
|
name: expr-attrs
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
doc: name of the expression type
|
|
-
|
|
name: data
|
|
type: sub-message
|
|
sub-message: expr-ops
|
|
selector: name
|
|
doc: type specific data
|
|
-
|
|
# Mentioned in nft_parse_compat() in net/netfilter/nft_compat.c
|
|
name: rule-compat-attrs
|
|
attributes:
|
|
-
|
|
name: proto
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: numeric value of the handled protocol
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: bitmask of flags
|
|
-
|
|
name: set-attrs
|
|
attributes:
|
|
-
|
|
name: table
|
|
type: string
|
|
doc: table name
|
|
-
|
|
name: name
|
|
type: string
|
|
doc: set name
|
|
-
|
|
name: flags
|
|
type: u32
|
|
enum: set-flags
|
|
byte-order: big-endian
|
|
doc: bitmask of enum nft_set_flags
|
|
-
|
|
name: key-type
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: key data type, informational purpose only
|
|
-
|
|
name: key-len
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: key data length
|
|
-
|
|
name: data-type
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: mapping data type
|
|
-
|
|
name: data-len
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: mapping data length
|
|
-
|
|
name: policy
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: selection policy
|
|
-
|
|
name: desc
|
|
type: nest
|
|
nested-attributes: set-desc-attrs
|
|
doc: set description
|
|
-
|
|
name: id
|
|
type: u32
|
|
doc: uniquely identifies a set in a transaction
|
|
-
|
|
name: timeout
|
|
type: u64
|
|
doc: default timeout value
|
|
-
|
|
name: gc-interval
|
|
type: u32
|
|
doc: garbage collection interval
|
|
-
|
|
name: userdata
|
|
type: binary
|
|
doc: user data
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: obj-type
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: stateful object type
|
|
-
|
|
name: handle
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: set handle
|
|
-
|
|
name: expr
|
|
type: nest
|
|
nested-attributes: expr-attrs
|
|
doc: set expression
|
|
multi-attr: true
|
|
-
|
|
name: expressions
|
|
type: nest
|
|
nested-attributes: set-list-attrs
|
|
doc: list of expressions
|
|
-
|
|
name: type
|
|
type: string
|
|
doc: set backend type
|
|
-
|
|
name: count
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: number of set elements
|
|
-
|
|
name: set-desc-attrs
|
|
attributes:
|
|
-
|
|
name: size
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: number of elements in set
|
|
-
|
|
name: concat
|
|
type: nest
|
|
nested-attributes: set-desc-concat-attrs
|
|
doc: description of field concatenation
|
|
multi-attr: true
|
|
-
|
|
name: set-desc-concat-attrs
|
|
attributes:
|
|
-
|
|
name: elem
|
|
type: nest
|
|
nested-attributes: set-field-attrs
|
|
-
|
|
name: set-field-attrs
|
|
attributes:
|
|
-
|
|
name: len
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: set-list-attrs
|
|
attributes:
|
|
-
|
|
name: elem
|
|
type: nest
|
|
nested-attributes: expr-attrs
|
|
multi-attr: true
|
|
-
|
|
name: setelem-attrs
|
|
attributes:
|
|
-
|
|
name: key
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
doc: key value
|
|
-
|
|
name: data
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
doc: data value of mapping
|
|
-
|
|
name: flags
|
|
type: binary
|
|
doc: bitmask of nft_set_elem_flags
|
|
-
|
|
name: timeout
|
|
type: u64
|
|
doc: timeout value
|
|
-
|
|
name: expiration
|
|
type: u64
|
|
doc: expiration time
|
|
-
|
|
name: userdata
|
|
type: binary
|
|
doc: user data
|
|
-
|
|
name: expr
|
|
type: nest
|
|
nested-attributes: expr-attrs
|
|
doc: expression
|
|
-
|
|
name: objref
|
|
type: string
|
|
doc: stateful object reference
|
|
-
|
|
name: key-end
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
doc: closing key value
|
|
-
|
|
name: expressions
|
|
type: nest
|
|
nested-attributes: expr-list-attrs
|
|
doc: list of expressions
|
|
-
|
|
name: setelem-list-elem-attrs
|
|
attributes:
|
|
-
|
|
name: elem
|
|
type: nest
|
|
nested-attributes: setelem-attrs
|
|
multi-attr: true
|
|
-
|
|
name: setelem-list-attrs
|
|
attributes:
|
|
-
|
|
name: table
|
|
type: string
|
|
-
|
|
name: set
|
|
type: string
|
|
-
|
|
name: elements
|
|
type: nest
|
|
nested-attributes: setelem-list-elem-attrs
|
|
-
|
|
name: set-id
|
|
type: u32
|
|
-
|
|
name: gen-attrs
|
|
attributes:
|
|
-
|
|
name: id
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: ruleset generation id
|
|
-
|
|
name: proc-pid
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: proc-name
|
|
type: string
|
|
-
|
|
name: obj-attrs
|
|
attributes:
|
|
-
|
|
name: table
|
|
type: string
|
|
doc: name of the table containing the expression
|
|
-
|
|
name: name
|
|
type: string
|
|
doc: name of this expression type
|
|
-
|
|
name: type
|
|
type: u32
|
|
enum: object-type
|
|
byte-order: big-endian
|
|
doc: stateful object type
|
|
-
|
|
name: data
|
|
type: sub-message
|
|
sub-message: obj-data
|
|
selector: type
|
|
doc: stateful object data
|
|
-
|
|
name: use
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: number of references to this expression
|
|
-
|
|
name: handle
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: object handle
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: userdata
|
|
type: binary
|
|
doc: user data
|
|
-
|
|
name: quota-attrs
|
|
attributes:
|
|
-
|
|
name: bytes
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: quota-flags
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: consumed
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: flowtable-attrs
|
|
attributes:
|
|
-
|
|
name: table
|
|
type: string
|
|
-
|
|
name: name
|
|
type: string
|
|
-
|
|
name: hook
|
|
type: nest
|
|
nested-attributes: flowtable-hook-attrs
|
|
-
|
|
name: use
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: handle
|
|
type: u64
|
|
byte-order: big-endian
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: flowtable-hook-attrs
|
|
attributes:
|
|
-
|
|
name: num
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: priority
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: devs
|
|
type: nest
|
|
nested-attributes: hook-dev-attrs
|
|
-
|
|
name: expr-bitwise-attrs
|
|
doc: |
|
|
The bitwise expression supports boolean and shift operations. It
|
|
implements the boolean operations by performing the following
|
|
operation::
|
|
|
|
dreg = (sreg & mask) ^ xor
|
|
|
|
with these mask and xor values:
|
|
|
|
op mask xor
|
|
---- ---- ---
|
|
NOT: 1 1
|
|
OR: ~x x
|
|
XOR: 1 x
|
|
AND: x 0
|
|
|
|
attributes:
|
|
-
|
|
name: sreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: dreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: len
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: mask
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: xor
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: op
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: bitwise-ops
|
|
checks:
|
|
max: 255
|
|
-
|
|
name: data
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: expr-cmp-attrs
|
|
attributes:
|
|
-
|
|
name: sreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: op
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: cmp-ops
|
|
-
|
|
name: data
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: data-attrs
|
|
attributes:
|
|
-
|
|
name: value
|
|
type: binary
|
|
# sub-type: u8
|
|
-
|
|
name: verdict
|
|
type: nest
|
|
nested-attributes: verdict-attrs
|
|
-
|
|
name: verdict-attrs
|
|
attributes:
|
|
-
|
|
name: code
|
|
doc: nf_tables verdict
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: verdict-code
|
|
-
|
|
name: chain
|
|
doc: jump target chain name
|
|
type: string
|
|
-
|
|
name: chain-id
|
|
doc: jump target chain ID
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: expr-counter-attrs
|
|
attributes:
|
|
-
|
|
name: bytes
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: Number of bytes
|
|
-
|
|
name: packets
|
|
type: u64
|
|
byte-order: big-endian
|
|
doc: Number of packets
|
|
-
|
|
name: pad
|
|
type: pad
|
|
-
|
|
name: expr-fib-attrs
|
|
attributes:
|
|
-
|
|
name: dreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: result
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: fib-result
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: fib-flags
|
|
-
|
|
name: expr-ct-attrs
|
|
attributes:
|
|
-
|
|
name: dreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: key
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: ct-keys
|
|
-
|
|
name: direction
|
|
type: u8
|
|
enum: ct-direction
|
|
-
|
|
name: sreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: expr-flow-offload-attrs
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
doc: Flow offload table name
|
|
-
|
|
name: expr-immediate-attrs
|
|
attributes:
|
|
-
|
|
name: dreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: data
|
|
type: nest
|
|
nested-attributes: data-attrs
|
|
-
|
|
name: expr-lookup-attrs
|
|
attributes:
|
|
-
|
|
name: set
|
|
type: string
|
|
doc: Name of set to use
|
|
-
|
|
name: set-id
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: ID of set to use
|
|
-
|
|
name: sreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: dreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: lookup-flags
|
|
-
|
|
name: expr-masq-attrs
|
|
attributes:
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: nat-range-flags
|
|
enum-as-flags: true
|
|
-
|
|
name: reg-proto-min
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: registers
|
|
-
|
|
name: reg-proto-max
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: registers
|
|
-
|
|
name: expr-meta-attrs
|
|
attributes:
|
|
-
|
|
name: dreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: key
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: meta-keys
|
|
-
|
|
name: sreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: expr-nat-attrs
|
|
attributes:
|
|
-
|
|
name: type
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: family
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: reg-addr-min
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: reg-addr-max
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: reg-proto-min
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: reg-proto-max
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: nat-range-flags
|
|
enum-as-flags: true
|
|
-
|
|
name: expr-payload-attrs
|
|
doc: nf_tables payload expression netlink attributes
|
|
attributes:
|
|
-
|
|
name: dreg
|
|
doc: destination register to load data into
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: registers
|
|
-
|
|
name: base
|
|
doc: payload base
|
|
type: u32
|
|
enum: payload-base
|
|
byte-order: big-endian
|
|
-
|
|
name: offset
|
|
doc: payload offset relative to base
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: len
|
|
doc: payload length
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: sreg
|
|
doc: source register to load data from
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: registers
|
|
-
|
|
name: csum-type
|
|
doc: checksum type
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: csum-offset
|
|
doc: checksum offset relative to base
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: csum-flags
|
|
doc: checksum flags
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: expr-reject-attrs
|
|
attributes:
|
|
-
|
|
name: type
|
|
type: u32
|
|
byte-order: big-endian
|
|
enum: reject-types
|
|
-
|
|
name: icmp-code
|
|
type: u8
|
|
-
|
|
name: expr-target-attrs
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
-
|
|
name: rev
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: info
|
|
type: binary
|
|
-
|
|
name: expr-tproxy-attrs
|
|
attributes:
|
|
-
|
|
name: family
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: reg-addr
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: reg-port
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: expr-objref-attrs
|
|
attributes:
|
|
-
|
|
name: imm-type
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: imm-name
|
|
type: string
|
|
doc: object name
|
|
-
|
|
name: set-sreg
|
|
type: u32
|
|
byte-order: big-endian
|
|
-
|
|
name: set-name
|
|
type: string
|
|
doc: name of object map
|
|
-
|
|
name: set-id
|
|
type: u32
|
|
byte-order: big-endian
|
|
doc: id of object map
|
|
-
|
|
name: compat-target-attrs
|
|
header: linux/netfilter/nf_tables_compat.h
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
checks:
|
|
max-len: 32
|
|
-
|
|
name: rev
|
|
type: u32
|
|
byte-order: big-endian
|
|
checks:
|
|
max: 255
|
|
-
|
|
name: info
|
|
type: binary
|
|
-
|
|
name: compat-match-attrs
|
|
header: linux/netfilter/nf_tables_compat.h
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
checks:
|
|
max-len: 32
|
|
-
|
|
name: rev
|
|
type: u32
|
|
byte-order: big-endian
|
|
checks:
|
|
max: 255
|
|
-
|
|
name: info
|
|
type: binary
|
|
-
|
|
name: compat-attrs
|
|
header: linux/netfilter/nf_tables_compat.h
|
|
attributes:
|
|
-
|
|
name: name
|
|
type: string
|
|
checks:
|
|
max-len: 32
|
|
-
|
|
name: rev
|
|
type: u32
|
|
byte-order: big-endian
|
|
checks:
|
|
max: 255
|
|
-
|
|
name: type
|
|
type: u32
|
|
byte-order: big-endian
|
|
|
|
sub-messages:
|
|
-
|
|
name: expr-ops
|
|
formats:
|
|
-
|
|
value: bitwise
|
|
attribute-set: expr-bitwise-attrs
|
|
-
|
|
value: cmp
|
|
attribute-set: expr-cmp-attrs
|
|
-
|
|
value: counter
|
|
attribute-set: expr-counter-attrs
|
|
-
|
|
value: ct
|
|
attribute-set: expr-ct-attrs
|
|
-
|
|
value: fib
|
|
attribute-set: expr-fib-attrs
|
|
-
|
|
value: flow_offload
|
|
attribute-set: expr-flow-offload-attrs
|
|
-
|
|
value: immediate
|
|
attribute-set: expr-immediate-attrs
|
|
-
|
|
value: log
|
|
attribute-set: log-attrs
|
|
-
|
|
value: lookup
|
|
attribute-set: expr-lookup-attrs
|
|
-
|
|
value: match
|
|
attribute-set: compat-match-attrs
|
|
-
|
|
value: meta
|
|
attribute-set: expr-meta-attrs
|
|
-
|
|
value: nat
|
|
attribute-set: expr-nat-attrs
|
|
-
|
|
value: numgen
|
|
attribute-set: numgen-attrs
|
|
-
|
|
value: objref
|
|
attribute-set: expr-objref-attrs
|
|
-
|
|
value: payload
|
|
attribute-set: expr-payload-attrs
|
|
-
|
|
value: quota
|
|
attribute-set: quota-attrs
|
|
-
|
|
value: range
|
|
attribute-set: range-attrs
|
|
-
|
|
value: reject
|
|
attribute-set: expr-reject-attrs
|
|
-
|
|
value: target
|
|
attribute-set: expr-target-attrs
|
|
-
|
|
value: tproxy
|
|
attribute-set: expr-tproxy-attrs
|
|
# There're more sub-messages to go:
|
|
# grep -A10 nft_expr_type
|
|
# and look for .name\s*=\s*"..."
|
|
-
|
|
name: obj-data
|
|
formats:
|
|
-
|
|
value: counter
|
|
attribute-set: counter-attrs
|
|
-
|
|
value: quota
|
|
attribute-set: quota-attrs
|
|
|
|
operations:
|
|
enum-model: directional
|
|
list:
|
|
-
|
|
name: batch-begin
|
|
doc: Start a batch of operations
|
|
attribute-set: batch-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0x10
|
|
attributes:
|
|
- genid
|
|
reply:
|
|
value: 0x10
|
|
attributes:
|
|
- genid
|
|
-
|
|
name: batch-end
|
|
doc: Finish a batch of operations
|
|
attribute-set: batch-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0x11
|
|
attributes:
|
|
- genid
|
|
-
|
|
name: newtable
|
|
doc: Create a new table.
|
|
attribute-set: table-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa00
|
|
attributes:
|
|
# Mentioned in nf_tables_newtable()
|
|
- name
|
|
- flags
|
|
- userdata
|
|
-
|
|
name: gettable
|
|
doc: Get / dump tables.
|
|
attribute-set: table-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa01
|
|
attributes:
|
|
# Mentioned in nf_tables_gettable()
|
|
- name
|
|
reply:
|
|
value: 0xa00
|
|
attributes: &get-table
|
|
# Mentioned in nf_tables_fill_table_info()
|
|
- name
|
|
- use
|
|
- handle
|
|
- flags
|
|
- owner
|
|
- userdata
|
|
dump:
|
|
reply:
|
|
attributes: *get-table
|
|
-
|
|
name: deltable
|
|
doc: Delete an existing table.
|
|
attribute-set: table-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa02
|
|
attributes: &del-table
|
|
# Mentioned in nf_tables_deltable()
|
|
- name
|
|
- handle
|
|
-
|
|
name: destroytable
|
|
doc: |
|
|
Delete an existing table with destroy semantics (ignoring ENOENT
|
|
errors).
|
|
attribute-set: table-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa1a
|
|
attributes: *del-table
|
|
-
|
|
name: newchain
|
|
doc: Create a new chain.
|
|
attribute-set: chain-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa03
|
|
attributes:
|
|
# Mentioned in nf_tables_newchain()
|
|
- table
|
|
- handle
|
|
- policy
|
|
- flags
|
|
# Mentioned in nf_tables_updchain()
|
|
- hook
|
|
- name
|
|
- counters
|
|
# Mentioned in nf_tables_addchain()
|
|
- userdata
|
|
# Mentioned in nft_chain_parse_hook()
|
|
- type
|
|
-
|
|
name: getchain
|
|
doc: Get / dump chains.
|
|
attribute-set: chain-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa04
|
|
attributes:
|
|
# Mentioned in nf_tables_getchain()
|
|
- table
|
|
- name
|
|
reply:
|
|
value: 0xa03
|
|
attributes: &get-chain
|
|
# Mentioned in nf_tables_fill_chain_info()
|
|
- table
|
|
- name
|
|
- handle
|
|
- hook
|
|
- policy
|
|
- type
|
|
- flags
|
|
- counters
|
|
- id
|
|
- use
|
|
- userdata
|
|
dump:
|
|
reply:
|
|
attributes: *get-chain
|
|
-
|
|
name: delchain
|
|
doc: Delete an existing chain.
|
|
attribute-set: chain-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa05
|
|
attributes: &del-chain
|
|
# Mentioned in nf_tables_delchain()
|
|
- table
|
|
- handle
|
|
- name
|
|
- hook
|
|
-
|
|
name: destroychain
|
|
doc: |
|
|
Delete an existing chain with destroy semantics (ignoring ENOENT
|
|
errors).
|
|
attribute-set: chain-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa1b
|
|
attributes: *del-chain
|
|
-
|
|
name: newrule
|
|
doc: Create a new rule.
|
|
attribute-set: rule-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa06
|
|
attributes:
|
|
# Mentioned in nf_tables_newrule()
|
|
- table
|
|
- chain
|
|
- chain-id
|
|
- handle
|
|
- position
|
|
- position-id
|
|
- expressions
|
|
- userdata
|
|
- compat
|
|
-
|
|
name: getrule
|
|
doc: Get / dump rules.
|
|
attribute-set: rule-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa07
|
|
attributes: &get-rule-request
|
|
# Mentioned in nf_tables_getrule_single()
|
|
- table
|
|
- chain
|
|
- handle
|
|
reply:
|
|
value: 0xa06
|
|
attributes: &get-rule
|
|
# Mentioned in nf_tables_fill_rule_info()
|
|
- table
|
|
- chain
|
|
- handle
|
|
- position
|
|
- expressions
|
|
- userdata
|
|
dump:
|
|
request:
|
|
attributes:
|
|
# Mentioned in nf_tables_dump_rules_start()
|
|
- table
|
|
- chain
|
|
reply:
|
|
attributes: *get-rule
|
|
|
|
-
|
|
name: getrule-reset
|
|
doc: Get / dump rules and reset stateful expressions.
|
|
attribute-set: rule-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa19
|
|
attributes: *get-rule-request
|
|
reply:
|
|
value: 0xa06
|
|
attributes: *get-rule
|
|
dump:
|
|
request:
|
|
attributes: *get-rule-request
|
|
reply:
|
|
attributes: *get-rule
|
|
-
|
|
name: delrule
|
|
doc: Delete an existing rule.
|
|
attribute-set: rule-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa08
|
|
attributes: &del-rule
|
|
- table
|
|
- chain
|
|
- handle
|
|
- id
|
|
-
|
|
name: destroyrule
|
|
doc: |
|
|
Delete an existing rule with destroy semantics (ignoring ENOENT errors).
|
|
attribute-set: rule-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa1c
|
|
attributes: *del-rule
|
|
-
|
|
name: newset
|
|
doc: Create a new set.
|
|
attribute-set: set-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa09
|
|
attributes:
|
|
# Mentioned in nf_tables_newset()
|
|
- table
|
|
- name
|
|
- key-len
|
|
- id
|
|
- key-type
|
|
- flags
|
|
- data-type
|
|
- data-len
|
|
- obj-type
|
|
- timeout
|
|
- gc-interval
|
|
- policy
|
|
- desc
|
|
- userdata
|
|
-
|
|
name: getset
|
|
doc: Get / dump sets.
|
|
attribute-set: set-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa0a
|
|
attributes:
|
|
# Mentioned in nf_tables_getset()
|
|
- table
|
|
- name
|
|
reply:
|
|
value: 0xa09
|
|
attributes: &get-set
|
|
# Mentioned in nf_tables_fill_set()
|
|
- table
|
|
- name
|
|
- handle
|
|
- flags
|
|
- key-len
|
|
- key-type
|
|
- data-type
|
|
- data-len
|
|
- obj-type
|
|
- gc-interval
|
|
- policy
|
|
- userdata
|
|
- desc
|
|
- expr
|
|
- expressions
|
|
dump:
|
|
request:
|
|
attributes:
|
|
# Mentioned in nf_tables_getset()
|
|
- table
|
|
reply:
|
|
attributes: *get-set
|
|
-
|
|
name: delset
|
|
doc: Delete an existing set.
|
|
attribute-set: set-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa0b
|
|
attributes: &del-set
|
|
# Mentioned in nf_tables_delset()
|
|
- table
|
|
- handle
|
|
- name
|
|
-
|
|
name: destroyset
|
|
doc: |
|
|
Delete an existing set with destroy semantics (ignoring ENOENT errors).
|
|
attribute-set: set-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa1d
|
|
attributes: *del-set
|
|
-
|
|
name: newsetelem
|
|
doc: Create a new set element.
|
|
attribute-set: setelem-list-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa0c
|
|
attributes:
|
|
# Mentioned in nf_tables_newsetelem()
|
|
- table
|
|
- set
|
|
- set-id
|
|
- elements
|
|
-
|
|
name: getsetelem
|
|
doc: Get / dump set elements.
|
|
attribute-set: setelem-list-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa0d
|
|
attributes:
|
|
# Mentioned in nf_tables_getsetelem()
|
|
- table
|
|
- set
|
|
- elements
|
|
reply:
|
|
value: 0xa0c
|
|
attributes:
|
|
# Mentioned in nf_tables_fill_setelem_info()
|
|
- elements
|
|
dump:
|
|
request:
|
|
attributes: &dump-set-request
|
|
# Mentioned in nft_set_dump_ctx_init()
|
|
- table
|
|
- set
|
|
reply:
|
|
attributes: &dump-set
|
|
# Mentioned in nf_tables_dump_set()
|
|
- table
|
|
- set
|
|
- elements
|
|
-
|
|
name: getsetelem-reset
|
|
doc: Get / dump set elements and reset stateful expressions.
|
|
attribute-set: setelem-list-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa21
|
|
attributes:
|
|
# Mentioned in nf_tables_getsetelem_reset()
|
|
- elements
|
|
reply:
|
|
value: 0xa0c
|
|
attributes:
|
|
# Mentioned in nf_tables_dumpreset_set()
|
|
- table
|
|
- set
|
|
- elements
|
|
dump:
|
|
request:
|
|
attributes: *dump-set-request
|
|
reply:
|
|
attributes: *dump-set
|
|
-
|
|
name: delsetelem
|
|
doc: Delete an existing set element.
|
|
attribute-set: setelem-list-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa0e
|
|
attributes: &del-setelem
|
|
# Mentioned in nf_tables_delsetelem()
|
|
- table
|
|
- set
|
|
- elements
|
|
-
|
|
name: destroysetelem
|
|
doc: Delete an existing set element with destroy semantics.
|
|
attribute-set: setelem-list-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa1e
|
|
attributes: *del-setelem
|
|
-
|
|
name: getgen
|
|
doc: Get / dump rule-set generation.
|
|
attribute-set: gen-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa10
|
|
reply:
|
|
value: 0xa0f
|
|
attributes: &get-gen
|
|
# Mentioned in nf_tables_fill_gen_info()
|
|
- id
|
|
- proc-pid
|
|
- proc-name
|
|
dump:
|
|
reply:
|
|
attributes: *get-gen
|
|
-
|
|
name: newobj
|
|
doc: Create a new stateful object.
|
|
attribute-set: obj-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa12
|
|
attributes:
|
|
# Mentioned in nf_tables_newobj()
|
|
- type
|
|
- name
|
|
- data
|
|
- table
|
|
- userdata
|
|
-
|
|
name: getobj
|
|
doc: Get / dump stateful objects.
|
|
attribute-set: obj-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa13
|
|
attributes:
|
|
# Mentioned in nf_tables_getobj_single()
|
|
- name
|
|
- type
|
|
- table
|
|
reply:
|
|
value: 0xa12
|
|
attributes: &obj-info
|
|
# Mentioned in nf_tables_fill_obj_info()
|
|
- table
|
|
- name
|
|
- type
|
|
- handle
|
|
- use
|
|
- data
|
|
- userdata
|
|
dump:
|
|
request:
|
|
attributes:
|
|
# Mentioned in nf_tables_dump_obj_start()
|
|
- table
|
|
- type
|
|
reply:
|
|
attributes: *obj-info
|
|
-
|
|
name: delobj
|
|
doc: Delete an existing stateful object.
|
|
attribute-set: obj-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa14
|
|
attributes:
|
|
# Mentioned in nf_tables_delobj()
|
|
- table
|
|
- name
|
|
- type
|
|
- handle
|
|
-
|
|
name: destroyobj
|
|
doc: Delete an existing stateful object with destroy semantics.
|
|
attribute-set: obj-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa1f
|
|
attributes:
|
|
# Mentioned in nf_tables_delobj()
|
|
- table
|
|
- name
|
|
- type
|
|
- handle
|
|
-
|
|
name: newflowtable
|
|
doc: Create a new flow table.
|
|
attribute-set: flowtable-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa16
|
|
attributes:
|
|
# Mentioned in nf_tables_newflowtable()
|
|
- table
|
|
- name
|
|
- hook
|
|
- flags
|
|
-
|
|
name: getflowtable
|
|
doc: Get / dump flow tables.
|
|
attribute-set: flowtable-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa17
|
|
attributes:
|
|
# Mentioned in nf_tables_getflowtable()
|
|
- name
|
|
- table
|
|
reply:
|
|
value: 0xa16
|
|
attributes: &flowtable-info
|
|
# Mentioned in nf_tables_fill_flowtable_info()
|
|
- table
|
|
- name
|
|
- handle
|
|
- use
|
|
- flags
|
|
- hook
|
|
dump:
|
|
reply:
|
|
attributes: *flowtable-info
|
|
-
|
|
name: delflowtable
|
|
doc: Delete an existing flow table.
|
|
attribute-set: flowtable-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa18
|
|
attributes: &del-flowtable
|
|
# Mentioned in nf_tables_delflowtable()
|
|
- table
|
|
- name
|
|
- handle
|
|
- hook
|
|
-
|
|
name: destroyflowtable
|
|
doc: Delete an existing flow table with destroy semantics.
|
|
attribute-set: flowtable-attrs
|
|
fixed-header: nfgenmsg
|
|
do:
|
|
request:
|
|
value: 0xa20
|
|
attributes: *del-flowtable
|
|
|
|
mcast-groups:
|
|
list:
|
|
-
|
|
name: mgmt
|