Matching packet metainformation

From nftables wiki
Jump to navigation Jump to search

The meta selectors allows you to match -- and in some cases, set -- packet metainformation. That is, information the local host has about the packet (such as how / when it was received) that is not necessarily carried in the packet itself.

The meta selectors

The following meta selectors are available:

Meta Selectors
Keyword Settable Description Data Type Notes
mark Y packet mark mark
iif input interface index iface_index
iifname input interface name ifname
iiftype input interface type iface_type
oif output interface index iface_index
oifname output interface name ifname
oiftype output interface type iface_type
skuid UID associated with originating socket uid
skgid GID associated with originating socket gid
nftrace Y nftrace debugging bit
rtclassid routing realm realm
ibriport input bridge port
obriport output bridge port
ibrname input bridge interface name ifname
obrname output bridge interface name ifname
pkttype Y packet type pkt_type
cpu CPU number processing the packet integer (32 bit)
iifgroup input interface group devgroup
oifgroup output interface group devgroup
cgroup control group ID integer (32 bit)
ipsec true if packet was ipsec encrypted boolean (1 bit)
time timestamp of packet reception integer (32 bit) or string
day day of week integer (32 bit) or string
hour hour of day string
length packet length in bytes integer (32 bit)
protocol packet protocol / EtherType protocol value ether_type as in skb->protocol
nfproto netfilter packet protocol family integer (32 bit) like ipv4, ipv6, etc...; useful only in inet table
l4proto layer 4 protocol integer (8 bit) like tcp, udp, etc...; skips ipv6 extension headers
priority Y tc packet priority tc_handle
random pseudo-random number integer (32 bit)
secmark Y packet secmark
ibrvproto bridge protocol
ibrpvid bridge pvid

Matching by interface

You can use one of the following selectors to match the interface name:

  • iifname, to match the input network interface name.
  • oifname, to match the output network interface name.
  • iif, to match the interface index of the network interface name. This is faster than iifname as it only has to compare a 32-bits unsigned integer instead of a string. The interface index is dynamically allocated, so don't use this for interfaces that are dynamically created and destroyed, eg. ppp0.
  • oif, like iif but it matches the output network interface index.

An example usage of the interface name is the following:

% nft add rule filter input meta oifname lo accept

This rule accepts all traffic for the loopback pseudodevice lo.

Matching by packet mark

You can match packets whose mark is 123 with the following rule:

nft add rule filter output meta mark 123 counter

Matching by socket UID

You can use your user name to match traffic, eg.

% nft add rule filter output meta skuid pablo counter

Or the 32-bits unsigned integer (UID) in case there is no entry in /etc/passwd for a given user.

% nft add rule filter output meta skuid 1000 counter

Let's just generate some HTTP traffic to test this rule:

% wget --spider http://www.google.com

Then, if you check the counters, you can verify that the packets are matching that rule.

% nft list table filter
table ip filter {
        chain output {
                 type filter hook output priority 0;
                 skuid pablo counter packets 7 bytes 510
        }

        chain input {
                 type filter hook input priority 0;
        }
}

Important: Beware if you test this with ping, it is usually installed with suid so that traffic will match the root user (uid=0).

Matching by tc priority

  • Since nftables v0.7 you can match the packet priority, the tc classid:
% nft add rule filter forward meta priority abcd:1234
  • Packet without set priority can be matched using meta priority none
% nft add rule filter forward meta priority none