Family nftables netlink 规范

概要

通过 netlink 进行 Netfilter nftables 配置。

操作

batch-begin

开始一批操作

attribute-set:

batch-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[genid]

reply

attributes:

[genid]

batch-end

完成一批操作

attribute-set:

batch-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[genid]

newtable

创建一个新表。

attribute-set:

table-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

gettable

获取/转储表。

attribute-set:

table-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

deltable

删除现有表。

attribute-set:

table-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroytable

删除具有销毁语义的现有表（忽略 ENOENT 错误）。

attribute-set:

table-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

newchain

创建一个新链。

attribute-set:

chain-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getchain

获取/转储链。

attribute-set:

chain-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

delchain

删除现有链。

attribute-set:

chain-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroychain

删除具有销毁语义的现有链（忽略 ENOENT 错误）。

attribute-set:

chain-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

newrule

创建一个新规则。

attribute-set:

rule-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getrule

获取/转储规则。

attribute-set:

rule-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

getrule-reset

获取/转储规则并重置有状态表达式。

attribute-set:

rule-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

delrule

删除现有规则。

attribute-set:

rule-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroyrule

删除具有销毁语义的现有规则（忽略 ENOENT 错误）。

attribute-set:

rule-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

newset

创建一个新集合。

attribute-set:

set-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getset

获取/转储集合。

attribute-set:

set-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

delset

删除现有集合。

attribute-set:

set-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroyset

删除具有销毁语义的现有集合（忽略 ENOENT 错误）。

attribute-set:

set-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

newsetelem

创建一个新集合元素。

attribute-set:

setelem-list-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getsetelem

获取/转储集合元素。

attribute-set:

setelem-list-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

getsetelem-reset

获取/转储集合元素并重置有状态表达式。

attribute-set:

setelem-list-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

delsetelem

删除现有集合元素。

attribute-set:

setelem-list-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroysetelem

删除具有销毁语义的现有集合元素。

attribute-set:

setelem-list-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getgen

获取/转储规则集生成。

attribute-set:

gen-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

newobj

创建一个新的有状态对象。

attribute-set:

obj-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getobj

获取/转储有状态对象。

attribute-set:

obj-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

delobj

删除现有的有状态对象。

attribute-set:

obj-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroyobj

删除具有销毁语义的现有有状态对象。

attribute-set:

obj-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

newflowtable

创建一个新的流表。

attribute-set:

flowtable-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

getflowtable

获取/转储流表。

attribute-set:

flowtable-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

reply

attributes:

[name]

delflowtable

删除现有流表。

attribute-set:

flowtable-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

destroyflowtable

删除具有销毁语义的现有流表。

attribute-set:

flowtable-attrs

fixed-header:

nfgenmsg

do:

request

attributes:

[name]

多播组

• mgmt

定义

nfgenmsg

type:

struct

members:

nfgen-family (u8):

version (u8):

res-id (u16):

meta-keys

type:

enum

entries:

• len

• protocol

• priority

• mark

• iif

• oif

• iifname

• oifname

• iftype

• oiftype

• skuid

• skgid

• nftrace

• rtclassid

• secmark

• nfproto

• l4-proto

• bri-iifname

• bri-oifname

• pkttype

• cpu

• iifgroup

• oifgroup

• cgroup

• prandom

• secpath

• iifkind

• oifkind

• bri-iifpvid

• bri-iifvproto

• time-ns

• time-day

• time-hour

• sdif

• sdifname

• bri-broute

bitwise-ops

type:

enum

entries:

• bool

• lshift

• rshift

cmp-ops

type:

enum

entries:

• eq

• neq

• lt

• lte

• gt

• gte

object-type

type:

enum

entries:

• unspec

• counter

• quota

• ct-helper

• limit

• connlimit

• tunnel

• ct-timeout

• secmark

• ct-expect

• synproxy

nat-range-flags

type:

flags

entries:

• map-ips

• proto-specified

• proto-random

• persistent

• proto-random-fully

• proto-offset

• netmap

table-flags

type:

flags

entries:

• dormant

• owner

• persist

chain-flags

type:

flags

entries:

• base

• hw-offload

• binding

set-flags

type:

flags

entries:

• anonymous

• constant

• interval

• map

• timeout

• eval

• object

• concat

• expr

lookup-flags

type:

flags

entries:

• invert

ct-keys

type:

enum

entries:

• state

• direction

• status

• mark

• secmark

• expiration

• helper

• l3protocol

• src

• dst

• protocol

• proto-src

• proto-dst

• labels

• pkts

• bytes

• avgpkt

• zone

• eventmask

• src-ip

• dst-ip

• src-ip6

• dst-ip6

• ct-id

ct-direction

type:

enum

entries:

• original

• reply

quota-flags

type:

flags

entries:

• invert

• depleted

verdict-code

type:

enum

entries:

continue:

break:

jump:

goto:

return:

drop:

accept:

stolen:

queue:

repeat:

fib-result

type:

enum

entries:

• oif

• oifname

• addrtype

fib-flags

type:

flags

entries:

• saddr

• daddr

• mark

• iif

• oif

• present

reject-types

type:

enum

entries:

• icmp-unreach

• tcp-rst

• icmpx-unreach

属性集

empty-attrs

name (string)

batch-attrs

genid (u32)

byte-order:

big-endian

table-attrs

name (string)

doc:

table 的名称

flags (u32)

byte-order:

big-endian

doc:

flags 的位掩码

enum:

table-flags

enum-as-flags:

True

use (u32)

byte-order:

big-endian

doc:

此表中的链数

handle (u64)

byte-order:

big-endian

doc:

表的数字句柄

userdata (binary)

doc:

用户数据

chain-attrs

table (string)

doc:

包含链的表的名称

handle (u64)

byte-order:

big-endian

doc:

链的数字句柄

name (string)

doc:

链的名称

hook (nest)

nested-attributes:

nft-hook-attrs

doc:

basechains 的 hook 规范

policy (u32)

byte-order:

big-endian

doc:

链的数字策略

use (u32)

byte-order:

big-endian

doc:

对此链的引用数

type (string)

doc:

链的类型名称

counters (nest)

nested-attributes:

nft-counter-attrs

doc:

链的计数器规范

flags (u32)

byte-order:

big-endian

doc:

链 flags

enum:

chain-flags

enum-as-flags:

True

id (u32)

byte-order:

big-endian

doc:

唯一标识事务中的链

userdata (binary)

doc:

用户数据

counter-attrs

bytes (u64)

byte-order:

big-endian

packets (u64)

byte-order:

big-endian

pad (pad)

nft-hook-attrs

num (u32)

byte-order:

big-endian

priority (s32)

byte-order:

big-endian

dev (string)

doc:

网络设备名称

devs (nest)

nested-attributes:

hook-dev-attrs

doc:

网络设备列表

hook-dev-attrs

name (string)

multi-attr:

True

nft-counter-attrs

bytes (u64)

packets (u64)

rule-attrs

table (string)

doc:

包含规则的表的名称

chain (string)

doc:

包含规则的链的名称

handle (u64)

byte-order:

big-endian

doc:

规则的数字句柄

expressions (nest)

nested-attributes:

expr-list-attrs

doc:

表达式列表

compat (nest)

nested-attributes:

rule-compat-attrs

doc:

规则的兼容性规范

position (u64)

byte-order:

big-endian

doc:

前一条规则的数字句柄

userdata (binary)

doc:

用户数据

id (u32)

doc:

唯一标识事务中的规则

position-id (u32)

doc:

前一条规则的事务唯一标识符

chain-id (u32)

doc:

通过 ID 将规则添加到链，作为链名称的替代方法

expr-list-attrs

elem (nest)

nested-attributes:

expr-attrs

multi-attr:

True

expr-attrs

name (string)

doc:

表达式类型的名称

data (sub-message)

sub-message:

expr-ops

selector:

name

doc:

特定于类型的数据

rule-compat-attrs

proto (binary)

doc:

处理协议的数字值

flags (binary)

doc:

flags 的位掩码

set-attrs

table (string)

doc:

表名

name (string)

doc:

设置名称

flags (u32)

enum:

set-flags

byte-order:

big-endian

doc:

enum nft_set_flags 的位掩码

key-type (u32)

byte-order:

big-endian

doc:

键数据类型，仅用于提供信息

key-len (u32)

byte-order:

big-endian

doc:

键数据长度

data-type (u32)

byte-order:

big-endian

doc:

映射数据类型

data-len (u32)

byte-order:

big-endian

doc:

映射数据长度

policy (u32)

byte-order:

big-endian

doc:

选择策略

desc (nest)

nested-attributes:

set-desc-attrs

doc:

设置描述

id (u32)

doc:

唯一标识事务中的设置

timeout (u64)

doc:

默认超时值

gc-interval (u32)

doc:

垃圾回收间隔

userdata (binary)

doc:

用户数据

pad (pad)

obj-type (u32)

byte-order:

big-endian

doc:

有状态对象类型

handle (u64)

byte-order:

big-endian

doc:

设置句柄

expr (nest)

nested-attributes:

expr-attrs

doc:

设置表达式

multi-attr:

True

expressions (nest)

nested-attributes:

set-list-attrs

doc:

表达式列表

set-desc-attrs

size (u32)

byte-order:

big-endian

doc:

集合中的元素数

concat (nest)

nested-attributes:

set-desc-concat-attrs

doc:

字段串联的描述

multi-attr:

True

set-desc-concat-attrs

elem (nest)

nested-attributes:

set-field-attrs

set-field-attrs

len (u32)

byte-order:

big-endian

set-list-attrs

elem (nest)

nested-attributes:

expr-attrs

multi-attr:

True

setelem-attrs

key (nest)

nested-attributes:

data-attrs

doc:

键值

data (nest)

nested-attributes:

data-attrs

doc:

映射的数据值

flags (binary)

doc:

nft_set_elem_flags 的位掩码

timeout (u64)

doc:

超时值

expiration (u64)

doc:

到期时间

userdata (binary)

doc:

用户数据

expr (nest)

nested-attributes:

expr-attrs

doc:

表达式

objref (string)

doc:

有状态对象引用

key-end (nest)

nested-attributes:

data-attrs

doc:

关闭键值

expressions (nest)

nested-attributes:

expr-list-attrs

doc:

表达式列表

setelem-list-elem-attrs

elem (nest)

nested-attributes:

setelem-attrs

multi-attr:

True

setelem-list-attrs

table (string)

set (string)

elements (nest)

nested-attributes:

setelem-list-elem-attrs

set-id (u32)

gen-attrs

id (u32)

byte-order:

big-endian

doc:

规则集生成 ID

proc-pid (u32)

byte-order:

big-endian

proc-name (string)

obj-attrs

table (string)

doc:

包含表达式的表的名称

name (string)

doc:

此表达式类型的名称

type (u32)

enum:

object-type

byte-order:

big-endian

doc:

有状态对象类型

data (sub-message)

sub-message:

obj-data

selector:

type

doc:

有状态对象数据

use (u32)

byte-order:

big-endian

doc:

对此表达式的引用数

handle (u64)

byte-order:

big-endian

doc:

对象句柄

pad (pad)

userdata (binary)

doc:

用户数据

quota-attrs

bytes (u64)

byte-order:

big-endian

flags (u32)

byte-order:

big-endian

enum:

quota-flags

pad (pad)

consumed (u64)

byte-order:

big-endian

flowtable-attrs

table (string)

name (string)

hook (nest)

nested-attributes:

flowtable-hook-attrs

use (u32)

byte-order:

big-endian

handle (u64)

byte-order:

big-endian

pad (pad)

flags (u32)

byte-order:

big-endian

flowtable-hook-attrs

num (u32)

byte-order:

big-endian

priority (u32)

byte-order:

big-endian

devs (nest)

nested-attributes:

hook-dev-attrs

expr-bitwise-attrs

sreg (u32)

byte-order:

big-endian

dreg (u32)

byte-order:

big-endian

len (u32)

byte-order:

big-endian

mask (nest)

nested-attributes:

data-attrs

xor (nest)

nested-attributes:

data-attrs

op (u32)

byte-order:

big-endian

enum:

bitwise-ops

data (nest)

nested-attributes:

data-attrs

expr-cmp-attrs

sreg (u32)

byte-order:

big-endian

op (u32)

byte-order:

big-endian

enum:

cmp-ops

data (nest)

nested-attributes:

data-attrs

data-attrs

value (binary)

verdict (nest)

nested-attributes:

verdict-attrs

verdict-attrs

code (u32)

byte-order:

big-endian

enum:

verdict-code

chain (string)

chain-id (u32)

expr-counter-attrs

bytes (u64)

doc:

字节数

packets (u64)

doc:

数据包数量

pad (pad)

expr-fib-attrs

dreg (u32)

byte-order:

big-endian

result (u32)

byte-order:

big-endian

enum:

fib-result

flags (u32)

byte-order:

big-endian

enum:

fib-flags

expr-ct-attrs

dreg (u32)

byte-order:

big-endian

key (u32)

byte-order:

big-endian

enum:

ct-keys

direction (u8)

enum:

ct-direction

sreg (u32)

byte-order:

big-endian

expr-flow-offload-attrs

name (string)

doc:

流卸载表名称

expr-immediate-attrs

dreg (u32)

byte-order:

big-endian

data (nest)

nested-attributes:

data-attrs

expr-lookup-attrs

set (string)

doc:

要使用的集合的名称

set id (u32)

byte-order:

big-endian

doc:

要使用的集合的 ID

sreg (u32)

byte-order:

big-endian

dreg (u32)

byte-order:

big-endian

flags (u32)

byte-order:

big-endian

enum:

lookup-flags

expr-meta-attrs

dreg (u32)

byte-order:

big-endian

key (u32)

byte-order:

big-endian

enum:

meta-keys

sreg (u32)

byte-order:

big-endian

expr-nat-attrs

type (u32)

byte-order:

big-endian

family (u32)

byte-order:

big-endian

reg-addr-min (u32)

byte-order:

big-endian

reg-addr-max (u32)

byte-order:

big-endian

reg-proto-min (u32)

byte-order:

big-endian

reg-proto-max (u32)

byte-order:

big-endian

flags (u32)

byte-order:

big-endian

enum:

nat-range-flags

enum-as-flags:

True

expr-payload-attrs

dreg (u32)

byte-order:

big-endian

base (u32)

byte-order:

big-endian

offset (u32)

byte-order:

big-endian

len (u32)

byte-order:

big-endian

sreg (u32)

byte-order:

big-endian

csum-type (u32)

byte-order:

big-endian

csum-offset (u32)

byte-order:

big-endian

csum-flags (u32)

byte-order:

big-endian

expr-reject-attrs

type (u32)

byte-order:

big-endian

enum:

reject-types

icmp-code (u8)

expr-target-attrs

name (string)

rev (u32)

byte-order:

big-endian

info (binary)

expr-tproxy-attrs

family (u32)

byte-order:

big-endian

reg-addr (u32)

byte-order:

big-endian

reg-port (u32)

byte-order:

big-endian

expr-objref-attrs

imm-type (u32)

byte-order:

big-endian

imm-name (string)

doc:

对象名称

set-sreg (u32)

byte-order:

big-endian

set-name (string)

doc:

对象映射的名称

set-id (u32)

byte-order:

big-endian

doc:

对象映射的 ID

子消息

expr-ops

• 按位

  attribute-set:

  expr-bitwise-attrs

• 比较

  attribute-set:

  expr-cmp-attrs

• counter

  attribute-set:

  expr-counter-attrs

• ct

  attribute-set:

  expr-ct-attrs

• fib

  attribute-set:

  expr-fib-attrs

• flow_offload

  attribute-set:

  expr-flow-offload-attrs

• immediate

  attribute-set:

  expr-immediate-attrs

• lookup

  attribute-set:

  expr-lookup-attrs

• meta

  attribute-set:

  expr-meta-attrs

• nat

  attribute-set:

  expr-nat-attrs

• objref

  attribute-set:

  expr-objref-attrs

• payload

  attribute-set:

  expr-payload-attrs

• quota

  attribute-set:

  quota-attrs

• reject

  attribute-set:

  expr-reject-attrs

• target

  attribute-set:

  expr-target-attrs

• tproxy

  attribute-set:

  expr-tproxy-attrs

obj-data

• counter

  attribute-set:

  counter-attrs

• quota

  attribute-set:

  quota-attrs