# SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)
---
name: nftables
protocol: netlink-raw
protonum: 12
doc:
Netfilter nftables configuration over netlink.
definitions:
-
name: nfgenmsg
type: struct
members:
-
name: nfgen-family
type: u8
-
name: version
type: u8
-
name: res-id
byte-order: big-endian
type: u16
-
name: meta-keys
type: enum
entries:
- len
- protocol
- priority
- mark
- iif
- oif
- iifname
- oifname
- iftype
- oiftype
- skuid
- skgid
- nftrace
- rtclassid
- secmark
- nfproto
- l4-proto
- bri-iifname
- bri-oifname
- pkttype
- cpu
- iifgroup
- oifgroup
- cgroup
- prandom
- secpath
- iifkind
- oifkind
- bri-iifpvid
- bri-iifvproto
- time-ns
- time-day
- time-hour
- sdif
- sdifname
- bri-broute
-
name: bitwise-ops
type: enum
entries:
- bool
- lshift
- rshift
-
name: cmp-ops
type: enum
entries:
- eq
- neq
- lt
- lte
- gt
- gte
-
name: object-type
type: enum
entries:
- unspec
- counter
- quota
- ct-helper
- limit
- connlimit
- tunnel
- ct-timeout
- secmark
- ct-expect
- synproxy
-
name: nat-range-flags
type: flags
entries:
- map-ips
- proto-specified
- proto-random
- persistent
- proto-random-fully
- proto-offset
- netmap
-
name: table-flags
type: flags
entries:
- dormant
- owner
- persist
-
name: chain-flags
type: flags
entries:
- base
- hw-offload
- binding
-
name: set-flags
type: flags
entries:
- anonymous
- constant
- interval
- map
- timeout
- eval
- object
- concat
- expr
-
name: lookup-flags
type: flags
entries:
- invert
-
name: ct-keys
type: enum
entries:
- state
- direction
- status
- mark
- secmark
- expiration
- helper
- l3protocol
- src
- dst
- protocol
- proto-src
- proto-dst
- labels
- pkts
- bytes
- avgpkt
- zone
- eventmask
- src-ip
- dst-ip
- src-ip6
- dst-ip6
- ct-id
-
name: ct-direction
type: enum
entries:
- original
- reply
-
name: quota-flags
type: flags
entries:
- invert
- depleted
-
name: verdict-code
type: enum
entries:
- name: continue
value: 0xffffffff
- name: break
value: 0xfffffffe
- name: jump
value: 0xfffffffd
- name: goto
value: 0xfffffffc
- name: return
value: 0xfffffffb
- name: drop
value: 0
- name: accept
value: 1
- name: stolen
value: 2
- name: queue
value: 3
- name: repeat
value: 4
-
name: fib-result
type: enum
entries:
- oif
- oifname
- addrtype
-
name: fib-flags
type: flags
entries:
- saddr
- daddr
- mark
- iif
- oif
- present
-
name: reject-types
type: enum
entries:
- icmp-unreach
- tcp-rst
- icmpx-unreach
attribute-sets:
-
name: empty-attrs
attributes:
-
name: name
type: string
-
name: batch-attrs
attributes:
-
name: genid
type: u32
byte-order: big-endian
-
name: table-attrs
attributes:
-
name: name
type: string
doc: name of the table
-
name: flags
type: u32
byte-order: big-endian
doc: bitmask of flags
enum: table-flags
enum-as-flags: true
-
name: use
type: u32
byte-order: big-endian
doc: number of chains in this table
-
name: handle
type: u64
byte-order: big-endian
doc: numeric handle of the table
-
name: userdata
type: binary
doc: user data
-
name: chain-attrs
attributes:
-
name: table
type: string
doc: name of the table containing the chain
-
name: handle
type: u64
byte-order: big-endian
doc: numeric handle of the chain
-
name: name
type: string
doc: name of the chain
-
name: hook
type: nest
nested-attributes: nft-hook-attrs
doc: hook specification for basechains
-
name: policy
type: u32
byte-order: big-endian
doc: numeric policy of the chain
-
name: use
type: u32
byte-order: big-endian
doc: number of references to this chain
-
name: type
type: string
doc: type name of the chain
-
name: counters
type: nest
nested-attributes: nft-counter-attrs
doc: counter specification of the chain
-
name: flags
type: u32
byte-order: big-endian
doc: chain flags
enum: chain-flags
enum-as-flags: true
-
name: id
type: u32
byte-order: big-endian
doc: uniquely identifies a chain in a transaction
-
name: userdata
type: binary
doc: user data
-
name: counter-attrs
attributes:
-
name: bytes
type: u64
byte-order: big-endian
-
name: packets
type: u64
byte-order: big-endian
-
name: pad
type: pad
-
name: nft-hook-attrs
attributes:
-
name: num
type: u32
byte-order: big-endian
-
name: priority
type: s32
byte-order: big-endian
-
name: dev
type: string
doc: net device name
-
name: devs
type: nest
nested-attributes: hook-dev-attrs
doc: list of net devices
-
name: hook-dev-attrs
attributes:
-
name: name
type: string
multi-attr: true
-
name: nft-counter-attrs
attributes:
-
name: bytes
type: u64
-
name: packets
type: u64
-
name: rule-attrs
attributes:
-
name: table
type: string
doc: name of the table containing the rule
-
name: chain
type: string
doc: name of the chain containing the rule
-
name: handle
type: u64
byte-order: big-endian
doc: numeric handle of the rule
-
name: expressions
type: nest
nested-attributes: expr-list-attrs
doc: list of expressions
-
name: compat
type: nest
nested-attributes: rule-compat-attrs
doc: compatibility specifications of the rule
-
name: position
type: u64
byte-order: big-endian
doc: numeric handle of the previous rule
-
name: userdata
type: binary
doc: user data
-
name: id
type: u32
doc: uniquely identifies a rule in a transaction
-
name: position-id
type: u32
doc: transaction unique identifier of the previous rule
-
name: chain-id
type: u32
doc: add the rule to chain by ID, alternative to chain name
-
name: expr-list-attrs
attributes:
-
name: elem
type: nest
nested-attributes: expr-attrs
multi-attr: true
-
name: expr-attrs
attributes:
-
name: name
type: string
doc: name of the expression type
-
name: data
type: sub-message
sub-message: expr-ops
selector: name
doc: type specific data
-
name: rule-compat-attrs
attributes:
-
name: proto
type: binary
doc: numeric value of the handled protocol
-
name: flags
type: binary
doc: bitmask of flags
-
name: set-attrs
attributes:
-
name: table
type: string
doc: table name
-
name: name
type: string
doc: set name
-
name: flags
type: u32
enum: set-flags
byte-order: big-endian
doc: bitmask of enum nft_set_flags
-
name: key-type
type: u32
byte-order: big-endian
doc: key data type, informational purpose only
-
name: key-len
type: u32
byte-order: big-endian
doc: key data length
-
name: data-type
type: u32
byte-order: big-endian
doc: mapping data type
-
name: data-len
type: u32
byte-order: big-endian
doc: mapping data length
-
name: policy
type: u32
byte-order: big-endian
doc: selection policy
-
name: desc
type: nest
nested-attributes: set-desc-attrs
doc: set description
-
name: id
type: u32
doc: uniquely identifies a set in a transaction
-
name: timeout
type: u64
doc: default timeout value
-
name: gc-interval
type: u32
doc: garbage collection interval
-
name: userdata
type: binary
doc: user data
-
name: pad
type: pad
-
name: obj-type
type: u32
byte-order: big-endian
doc: stateful object type
-
name: handle
type: u64
byte-order: big-endian
doc: set handle
-
name: expr
type: nest
nested-attributes: expr-attrs
doc: set expression
multi-attr: true
-
name: expressions
type: nest
nested-attributes: set-list-attrs
doc: list of expressions
-
name: set-desc-attrs
attributes:
-
name: size
type: u32
byte-order: big-endian
doc: number of elements in set
-
name: concat
type: nest
nested-attributes: set-desc-concat-attrs
doc: description of field concatenation
multi-attr: true
-
name: set-desc-concat-attrs
attributes:
-
name: elem
type: nest
nested-attributes: set-field-attrs
-
name: set-field-attrs
attributes:
-
name: len
type: u32
byte-order: big-endian
-
name: set-list-attrs
attributes:
-
name: elem
type: nest
nested-attributes: expr-attrs
multi-attr: true
-
name: setelem-attrs
attributes:
-
name: key
type: nest
nested-attributes: data-attrs
doc: key value
-
name: data
type: nest
nested-attributes: data-attrs
doc: data value of mapping
-
name: flags
type: binary
doc: bitmask of nft_set_elem_flags
-
name: timeout
type: u64
doc: timeout value
-
name: expiration
type: u64
doc: expiration time
-
name: userdata
type: binary
doc: user data
-
name: expr
type: nest
nested-attributes: expr-attrs
doc: expression
-
name: objref
type: string
doc: stateful object reference
-
name: key-end
type: nest
nested-attributes: data-attrs
doc: closing key value
-
name: expressions
type: nest
nested-attributes: expr-list-attrs
doc: list of expressions
-
name: setelem-list-elem-attrs
attributes:
-
name: elem
type: nest
nested-attributes: setelem-attrs
multi-attr: true
-
name: setelem-list-attrs
attributes:
-
name: table
type: string
-
name: set
type: string
-
name: elements
type: nest
nested-attributes: setelem-list-elem-attrs
-
name: set-id
type: u32
-
name: gen-attrs
attributes:
-
name: id
type: u32
byte-order: big-endian
doc: ruleset generation id
-
name: proc-pid
type: u32
byte-order: big-endian
-
name: proc-name
type: string
-
name: obj-attrs
attributes:
-
name: table
type: string
doc: name of the table containing the expression
-
name: name
type: string
doc: name of this expression type
-
name: type
type: u32
enum: object-type
byte-order: big-endian
doc: stateful object type
-
name: data
type: sub-message
sub-message: obj-data
selector: type
doc: stateful object data
-
name: use
type: u32
byte-order: big-endian
doc: number of references to this expression
-
name: handle
type: u64
byte-order: big-endian
doc: object handle
-
name: pad
type: pad
-
name: userdata
type: binary
doc: user data
-
name: quota-attrs
attributes:
-
name: bytes
type: u64
byte-order: big-endian
-
name: flags
type: u32
byte-order: big-endian
enum: quota-flags
-
name: pad
type: pad
-
name: consumed
type: u64
byte-order: big-endian
-
name: flowtable-attrs
attributes:
-
name: table
type: string
-
name: name
type: string
-
name: hook
type: nest
nested-attributes: flowtable-hook-attrs
-
name: use
type: u32
byte-order: big-endian
-
name: handle
type: u64
byte-order: big-endian
-
name: pad
type: pad
-
name: flags
type: u32
byte-order: big-endian
-
name: flowtable-hook-attrs
attributes:
-
name: num
type: u32
byte-order: big-endian
-
name: priority
type: u32
byte-order: big-endian
-
name: devs
type: nest
nested-attributes: hook-dev-attrs
-
name: expr-bitwise-attrs
attributes:
-
name: sreg
type: u32
byte-order: big-endian
-
name: dreg
type: u32
byte-order: big-endian
-
name: len
type: u32
byte-order: big-endian
-
name: mask
type: nest
nested-attributes: data-attrs
-
name: xor
type: nest
nested-attributes: data-attrs
-
name: op
type: u32
byte-order: big-endian
enum: bitwise-ops
-
name: data
type: nest
nested-attributes: data-attrs
-
name: expr-cmp-attrs
attributes:
-
name: sreg
type: u32
byte-order: big-endian
-
name: op
type: u32
byte-order: big-endian
enum: cmp-ops
-
name: data
type: nest
nested-attributes: data-attrs
-
name: data-attrs
attributes:
-
name: value
type: binary
# sub-type: u8
-
name: verdict
type: nest
nested-attributes: verdict-attrs
-
name: verdict-attrs
attributes:
-
name: code
type: u32
byte-order: big-endian
enum: verdict-code
-
name: chain
type: string
-
name: chain-id
type: u32
-
name: expr-counter-attrs
attributes:
-
name: bytes
type: u64
doc: Number of bytes
-
name: packets
type: u64
doc: Number of packets
-
name: pad
type: pad
-
name: expr-fib-attrs
attributes:
-
name: dreg
type: u32
byte-order: big-endian
-
name: result
type: u32
byte-order: big-endian
enum: fib-result
-
name: flags
type: u32
byte-order: big-endian
enum: fib-flags
-
name: expr-ct-attrs
attributes:
-
name: dreg
type: u32
byte-order: big-endian
-
name: key
type: u32
byte-order: big-endian
enum: ct-keys
-
name: direction
type: u8
enum: ct-direction
-
name: sreg
type: u32
byte-order: big-endian
-
name: expr-flow-offload-attrs
attributes:
-
name: name
type: string
doc: Flow offload table name
-
name: expr-immediate-attrs
attributes:
-
name: dreg
type: u32
byte-order: big-endian
-
name: data
type: nest
nested-attributes: data-attrs
-
name: expr-lookup-attrs
attributes:
-
name: set
type: string
doc: Name of set to use
-
name: set id
type: u32
byte-order: big-endian
doc: ID of set to use
-
name: sreg
type: u32
byte-order: big-endian
-
name: dreg
type: u32
byte-order: big-endian
-
name: flags
type: u32
byte-order: big-endian
enum: lookup-flags
-
name: expr-meta-attrs
attributes:
-
name: dreg
type: u32
byte-order: big-endian
-
name: key
type: u32
byte-order: big-endian
enum: meta-keys
-
name: sreg
type: u32
byte-order: big-endian
-
name: expr-nat-attrs
attributes:
-
name: type
type: u32
byte-order: big-endian
-
name: family
type: u32
byte-order: big-endian
-
name: reg-addr-min
type: u32
byte-order: big-endian
-
name: reg-addr-max
type: u32
byte-order: big-endian
-
name: reg-proto-min
type: u32
byte-order: big-endian
-
name: reg-proto-max
type: u32
byte-order: big-endian
-
name: flags
type: u32
byte-order: big-endian
enum: nat-range-flags
enum-as-flags: true
-
name: expr-payload-attrs
attributes:
-
name: dreg
type: u32
byte-order: big-endian
-
name: base
type: u32
byte-order: big-endian
-
name: offset
type: u32
byte-order: big-endian
-
name: len
type: u32
byte-order: big-endian
-
name: sreg
type: u32
byte-order: big-endian
-
name: csum-type
type: u32
byte-order: big-endian
-
name: csum-offset
type: u32
byte-order: big-endian
-
name: csum-flags
type: u32
byte-order: big-endian
-
name: expr-reject-attrs
attributes:
-
name: type
type: u32
byte-order: big-endian
enum: reject-types
-
name: icmp-code
type: u8
-
name: expr-target-attrs
attributes:
-
name: name
type: string
-
name: rev
type: u32
byte-order: big-endian
-
name: info
type: binary
-
name: expr-tproxy-attrs
attributes:
-
name: family
type: u32
byte-order: big-endian
-
name: reg-addr
type: u32
byte-order: big-endian
-
name: reg-port
type: u32
byte-order: big-endian
-
name: expr-objref-attrs
attributes:
-
name: imm-type
type: u32
byte-order: big-endian
-
name: imm-name
type: string
doc: object name
-
name: set-sreg
type: u32
byte-order: big-endian
-
name: set-name
type: string
doc: name of object map
-
name: set-id
type: u32
byte-order: big-endian
doc: id of object map
sub-messages:
-
name: expr-ops
formats:
-
value: bitwise
attribute-set: expr-bitwise-attrs
-
value: cmp
attribute-set: expr-cmp-attrs
-
value: counter
attribute-set: expr-counter-attrs
-
value: ct
attribute-set: expr-ct-attrs
-
value: fib
attribute-set: expr-fib-attrs
-
value: flow_offload
attribute-set: expr-flow-offload-attrs
-
value: immediate
attribute-set: expr-immediate-attrs
-
value: lookup
attribute-set: expr-lookup-attrs
-
value: meta
attribute-set: expr-meta-attrs
-
value: nat
attribute-set: expr-nat-attrs
-
value: objref
attribute-set: expr-objref-attrs
-
value: payload
attribute-set: expr-payload-attrs
-
value: quota
attribute-set: quota-attrs
-
value: reject
attribute-set: expr-reject-attrs
-
value: target
attribute-set: expr-target-attrs
-
value: tproxy
attribute-set: expr-tproxy-attrs
-
name: obj-data
formats:
-
value: counter
attribute-set: counter-attrs
-
value: quota
attribute-set: quota-attrs
operations:
enum-model: directional
list:
-
name: batch-begin
doc: Start a batch of operations
attribute-set: batch-attrs
fixed-header: nfgenmsg
do:
request:
value: 0x10
attributes:
- genid
reply:
value: 0x10
attributes:
- genid
-
name: batch-end
doc: Finish a batch of operations
attribute-set: batch-attrs
fixed-header: nfgenmsg
do:
request:
value: 0x11
attributes:
- genid
-
name: newtable
doc: Create a new table.
attribute-set: table-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa00
attributes:
- name
-
name: gettable
doc: Get / dump tables.
attribute-set: table-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa01
attributes:
- name
reply:
value: 0xa00
attributes:
- name
-
name: deltable
doc: Delete an existing table.
attribute-set: table-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa02
attributes:
- name
-
name: destroytable
doc: |
Delete an existing table with destroy semantics (ignoring ENOENT
errors).
attribute-set: table-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa1a
attributes:
- name
-
name: newchain
doc: Create a new chain.
attribute-set: chain-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa03
attributes:
- name
-
name: getchain
doc: Get / dump chains.
attribute-set: chain-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa04
attributes:
- name
reply:
value: 0xa03
attributes:
- name
-
name: delchain
doc: Delete an existing chain.
attribute-set: chain-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa05
attributes:
- name
-
name: destroychain
doc: |
Delete an existing chain with destroy semantics (ignoring ENOENT
errors).
attribute-set: chain-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa1b
attributes:
- name
-
name: newrule
doc: Create a new rule.
attribute-set: rule-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa06
attributes:
- name
-
name: getrule
doc: Get / dump rules.
attribute-set: rule-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa07
attributes:
- name
reply:
value: 0xa06
attributes:
- name
-
name: getrule-reset
doc: Get / dump rules and reset stateful expressions.
attribute-set: rule-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa19
attributes:
- name
reply:
value: 0xa06
attributes:
- name
-
name: delrule
doc: Delete an existing rule.
attribute-set: rule-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa08
attributes:
- name
-
name: destroyrule
doc: |
Delete an existing rule with destroy semantics (ignoring ENOENT errors).
attribute-set: rule-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa1c
attributes:
- name
-
name: newset
doc: Create a new set.
attribute-set: set-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa09
attributes:
- name
-
name: getset
doc: Get / dump sets.
attribute-set: set-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa0a
attributes:
- name
reply:
value: 0xa09
attributes:
- name
-
name: delset
doc: Delete an existing set.
attribute-set: set-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa0b
attributes:
- name
-
name: destroyset
doc: |
Delete an existing set with destroy semantics (ignoring ENOENT errors).
attribute-set: set-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa1d
attributes:
- name
-
name: newsetelem
doc: Create a new set element.
attribute-set: setelem-list-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa0c
attributes:
- name
-
name: getsetelem
doc: Get / dump set elements.
attribute-set: setelem-list-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa0d
attributes:
- name
reply:
value: 0xa0c
attributes:
- name
-
name: getsetelem-reset
doc: Get / dump set elements and reset stateful expressions.
attribute-set: setelem-list-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa21
attributes:
- name
reply:
value: 0xa0c
attributes:
- name
-
name: delsetelem
doc: Delete an existing set element.
attribute-set: setelem-list-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa0e
attributes:
- name
-
name: destroysetelem
doc: Delete an existing set element with destroy semantics.
attribute-set: setelem-list-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa1e
attributes:
- name
-
name: getgen
doc: Get / dump rule-set generation.
attribute-set: gen-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa10
attributes:
- name
reply:
value: 0xa0f
attributes:
- name
-
name: newobj
doc: Create a new stateful object.
attribute-set: obj-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa12
attributes:
- name
-
name: getobj
doc: Get / dump stateful objects.
attribute-set: obj-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa13
attributes:
- name
reply:
value: 0xa12
attributes:
- name
-
name: delobj
doc: Delete an existing stateful object.
attribute-set: obj-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa14
attributes:
- name
-
name: destroyobj
doc: Delete an existing stateful object with destroy semantics.
attribute-set: obj-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa1f
attributes:
- name
-
name: newflowtable
doc: Create a new flow table.
attribute-set: flowtable-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa16
attributes:
- name
-
name: getflowtable
doc: Get / dump flow tables.
attribute-set: flowtable-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa17
attributes:
- name
reply:
value: 0xa16
attributes:
- name
-
name: delflowtable
doc: Delete an existing flow table.
attribute-set: flowtable-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa18
attributes:
- name
-
name: destroyflowtable
doc: Delete an existing flow table with destroy semantics.
attribute-set: flowtable-attrs
fixed-header: nfgenmsg
do:
request:
value: 0xa20
attributes:
- name
mcast-groups:
list:
-
name: mgmt
[ Dauer der Verarbeitung: 0.8 Sekunden
(vorverarbeitet)
]
