Matching connection tracking stateful metainformation - Revision history

Fmyhr: conntrack command sample output table: linked ct matches to sections below.

2021-04-15T18:55:50Z

conntrack command sample output table: linked ct matches to sections below.

← Older revision		Revision as of 18:55, 15 April 2021
Line 32:		Line 32:
	\| L3 protocol name		\| L3 protocol name
	\| ''ipv4''		\| ''ipv4''
	\| ''ct l3proto''		\| [[Matching_connection_tracking_stateful_metainformation#ct_l3proto_-_conntrack_L3_protocol\|''ct l3proto'']]
	\|		\|

Line 39:		Line 39:
	\| L3 protocol number		\| L3 protocol number
	\| ''2''		\| ''2''
	\| ''ct l3proto''		\| [[Matching_connection_tracking_stateful_metainformation#ct_l3proto_-_conntrack_L3_protocol\|''ct l3proto'']]
	\|		\|

Line 46:		Line 46:
	\| L4 protocol name		\| L4 protocol name
	\| ''tcp''		\| ''tcp''
	\| ''ct protocol''		\| [[Matching_connection_tracking_stateful_metainformation#ct_protocol-_conntrack_L4_protocol\|''ct protocol'']]
	\|		\|

Line 53:		Line 53:
	\| L4 protocol number		\| L4 protocol number
	\| ''6''		\| ''6''
	\| ''ct protocol''		\| [[Matching_connection_tracking_stateful_metainformation#ct_protocol-_conntrack_L4_protocol\|''ct protocol'']]
	\| As shown in [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/in.h in.h] protocol value 6 indicates TCP.		\| As shown in [https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/include/uapi/linux/in.h in.h] protocol value 6 indicates TCP.

Line 60:		Line 60:
	\| timeout, s		\| timeout, s
	\| ''421957''		\| ''421957''
	\| ''ct expiration''		\| [[Matching_connection_tracking_stateful_metainformation#ct_expiration\|''ct expiration'']]
	\| Seconds until conntrack entry is invalidated; reset to initial value when connection sees a new packet.		\| Seconds until conntrack entry is invalidated; reset to initial value when connection sees a new packet.
	Default TCP connection timeout is 5 days. You can change this via the [[Connection_Tracking_System\|conntrack sysfs setting]] ''nf_conntrack_tcp_timeout_established''.		Default TCP connection timeout is 5 days. You can change this via the [[Connection_Tracking_System\|conntrack sysfs setting]] ''nf_conntrack_tcp_timeout_established''.
Line 76:		Line 76:
	original direction		original direction
	\| ''src=192.168.0.2''		\| ''src=192.168.0.2''
	\| ''ct original saddr''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L3_source_or_destination_address\|''ct original saddr'']]
	\|		\|

Line 84:		Line 84:
	original direction		original direction
	\| ''dst=192.168.0.8''		\| ''dst=192.168.0.8''
	\| ''ct original daddr''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L3_source_or_destination_address\|''ct original daddr'']]
	\|		\|

Line 92:		Line 92:
	original direction		original direction
	\| ''sport=34621''		\| ''sport=34621''
	\| ''ct original proto‑src''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L4_protocol_source_or_destination\|''ct original proto‑src'']]
	\|		\|

Line 100:		Line 100:
	original direction		original direction
	\| ''dport=22''		\| ''dport=22''
	\| ''ct original proto‑dst''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L4_protocol_source_or_destination\|''ct original proto‑dst'']]
	\|		\|

Line 108:		Line 108:
	reply direction		reply direction
	\| ''src=192.168.0.8''		\| ''src=192.168.0.8''
	\| ''ct reply saddr''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L3_source_or_destination_address\|''ct reply saddr'']]
	\|		\|

Line 116:		Line 116:
	reply direction		reply direction
	\| ''dst=192.168.0.2''		\| ''dst=192.168.0.2''
	\| ''ct reply daddr''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L3_source_or_destination_address\|''ct reply daddr'']]
	\|		\|

Line 124:		Line 124:
	reply direction		reply direction
	\| ''sport=22''		\| ''sport=22''
	\| ''ct reply proto‑src''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L4_protocol_source_or_destination\|''ct reply proto‑src'']]
	\|		\|

Line 132:		Line 132:
	reply direction		reply direction
	\| ''dport=34621''		\| ''dport=34621''
	\| ''ct reply proto‑dst''		\| [[Matching_connection_tracking_stateful_metainformation#Conntrack_L4_protocol_source_or_destination\|''ct reply proto‑dst'']]
	\|		\|

Line 160:		Line 160:
	\| conntrack id		\| conntrack id
	\| ''id=2014938051''		\| ''id=2014938051''
	\| ''ct id''		\| [[Matching_connection_tracking_stateful_metainformation#ct_id\|''ct id'']]
	\| Unique id assigned to this conntrack entry.		\| Unique id assigned to this conntrack entry.

Fmyhr: Added ct count section, linking to connlimits page.

2021-04-15T18:44:57Z

Added ct count section, linking to connlimits page.

← Older revision		Revision as of 18:44, 15 April 2021
Line 397:		Line 397:

	You can match packets based on when their associated connection is set to expire, e.g. ''ct expiration < 1m30s''.		You can match packets based on when their associated connection is set to expire, e.g. ''ct expiration < 1m30s''.


			== ''ct count'' ==

			You can match based on the current number of tracked connections matching the specified properties. See [[Connlimits\|connlimits]].

Fmyhr: Reordered ct matches, tried to put most-used near top and the rest in logical order (open to some interpretation, but think better than alphabetical).

2021-04-15T18:30:43Z

Reordered ct matches, tried to put most-used near top and the rest in logical order (open to some interpretation, but think better than alphabetical).

← Older revision		Revision as of 18:30, 15 April 2021
Line 221:		Line 221:

	The rule in the ''IN'' chain accepts packets that are part of an established connection, and related packets. Note the use of a comma-separated list of the conntrack states that you want to match. The default chain policy drops all other incoming packets. Thus, any attempt from a computer in the network to initiate a new connection to your computer will be blocked. However, traffic that is part of a flow that you have started will be accepted.		The rule in the ''IN'' chain accepts packets that are part of an established connection, and related packets. Note the use of a comma-separated list of the conntrack states that you want to match. The default chain policy drops all other incoming packets. Thus, any attempt from a computer in the network to initiate a new connection to your computer will be blocked. However, traffic that is part of a flow that you have started will be accepted.


			== ''ct helper'' - conntrack helper ==

			The following example shows how to match packets based on the conntrack helper:

			<source lang="bash">
			nft add rule filter input ct helper "ftp" counter
			</source>

			[[Conntrack_helpers\|More on using ct helpers]].


Line 366:		Line 377:

	To know more about conntrack marks and packet marks, see [[Setting packet metainformation]].		To know more about conntrack marks and packet marks, see [[Setting packet metainformation]].


	~~== ''ct helper'' - conntrack helper ==~~

	~~The following example shows how to match packets based on the conntrack helper:~~

	~~<source lang="bash">~~
	~~nft add rule filter input ct helper "ftp" counter~~
	~~</source>~~

	~~[[Conntrack_helpers\|More on using ct helpers]].~~


	~~== ''ct direction'' ==~~

	A packet with ''original'' direction is traveling in the same direction as the first packet seen for this connection, e.g. in the direction of the original SYN packet for a TCP connection. A packet with ''reply'' direction is traveling in the direction opposite to ''original''.


Line 394:		Line 389:


	== ''ct ~~expiration~~'' ==		== ''ct direction'' ==

	~~You can match packets based on when their associated~~ connection ~~is set to expire~~, e.g. ''~~ct expiration < 1m30s~~''.		A packet with ''original'' direction is traveling in the same direction as the first packet seen for this connection, e.g. in the direction of the original SYN packet for a TCP connection. A packet with ''reply'' direction is traveling in the direction opposite to ''original''.


	== ''ct id'' ==		== ''ct expiration'' ==

	~~This expression will~~ match packets associated ~~with a specific~~ connection ~~with given conntrack id (as from ''conntrack -L -o id''). You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''id'' ct_id.~~		You can match packets based on when their associated connection is set to expire, e.g. ''ct expiration < 1m30s''.


	~~== ''ct l3proto'' ==~~

	~~Matches the L3 protocol of the conntrack entry associated with a packet. You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''l3proto'' l3_protocol~~.


	~~== ''ct protocol'' ==~~

	~~Matches the L4 protocol of the conntrack entry associated with a packet~~. ~~You can optionally include a packet direction with this match:~~ ''ct'' ~~[''original'' \| ''reply''] ''protocol'' l4_protocol~~.


	== ''ct packets'' ==		== ''ct packets'' ==

	Match based on how many packets have previously traversed the connection associated with a packet. If you specify an optional direction, only packets in that direction are counted. Otherwise, packets in both directions are counted. For example:		Match based on how many packets have previously traversed the connection associated with a packet. If you specify an optional direction, only packets in that direction are counted. Otherwise, packets in both directions are counted. For example:<br>
	''ct'' [''original'' \| ''reply''] packets < 10000		''ct'' [''original'' \| ''reply''] packets < 10000

Line 422:		Line 407:
	== ''ct bytes'' ==		== ''ct bytes'' ==

	Match based on how many total bytes have previously traversed the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:		Match based on how many total bytes have previously traversed the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:<br>
	''ct'' [''original'' \| ''reply''] bytes < 100000		''ct'' [''original'' \| ''reply''] bytes < 100000

Line 428:		Line 413:
	== ''ct avgpkt'' ==		== ''ct avgpkt'' ==

	Match based on the average packet size (bytes/packet) seen so far on the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:		Match based on the average packet size (bytes/packet) seen so far on the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:<br>
	''ct'' [''original'' \| ''reply''] avgpkt < 100		''ct'' [''original'' \| ''reply''] avgpkt < 100


			== ''ct l3proto'' - conntrack L3 protocol ==

			Matches the L3 protocol of the conntrack entry associated with a packet. You can optionally include a packet direction with this match:<br>
			''ct'' [''original'' \| ''reply''] ''l3proto'' l3_protocol.


	== Conntrack L3 source or destination address ==		== Conntrack L3 source or destination address ==

	This match requires specifying both direction and L3 protocol (''ip'' or ''ip6'' currently recognized):		This match requires specifying both direction and L3 protocol (''ip'' or ''ip6'' currently recognized):<br>
	''ct'' {''original'' \| ''reply''} {''ip'' \| ''ip6''} {''saddr'' \| ''daddr''}		''ct'' {''original'' \| ''reply''} {''ip'' \| ''ip6''} {''saddr'' \| ''daddr''}


			== ''ct protocol''- conntrack L4 protocol ==

			Matches the L4 protocol of the conntrack entry associated with a packet. You can optionally include a packet direction with this match:<br>
			''ct'' [''original'' \| ''reply''] ''protocol'' l4_protocol.


	== Conntrack L4 protocol source or destination ==		== Conntrack L4 protocol source or destination ==

	This match requires specifying the direction:		This match requires specifying the direction:<br>
	''ct'' {''original'' \| ''reply''} {''proto-src'' \| ''proto-dst''}		''ct'' {''original'' \| ''reply''} {''proto-src'' \| ''proto-dst''}


			== ''ct id'' ==

			This expression will match packets associated with a specific connection with given conntrack id (as from ''conntrack -L -o id''). You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''id'' ct_id.

Fmyhr: Added minimal sections for conntrack L3 and L4 source and destination matches.

2021-04-15T18:20:50Z

Added minimal sections for conntrack L3 and L4 source and destination matches.

← Older revision		Revision as of 18:20, 15 April 2021
Line 430:		Line 430:
	Match based on the average packet size (bytes/packet) seen so far on the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:		Match based on the average packet size (bytes/packet) seen so far on the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:
	''ct'' [''original'' \| ''reply''] avgpkt < 100		''ct'' [''original'' \| ''reply''] avgpkt < 100


			== Conntrack L3 source or destination address ==

			This match requires specifying both direction and L3 protocol (''ip'' or ''ip6'' currently recognized):
			''ct'' {''original'' \| ''reply''} {''ip'' \| ''ip6''} {''saddr'' \| ''daddr''}


			== Conntrack L4 protocol source or destination ==

			This match requires specifying the direction:
			''ct'' {''original'' \| ''reply''} {''proto-src'' \| ''proto-dst''}

Fmyhr: Added sections; ct l3proto, protocol, packets, bytes, avgpkt.

2021-04-15T18:12:16Z

Added sections; ct l3proto, protocol, packets, bytes, avgpkt.

← Older revision		Revision as of 18:12, 15 April 2021
Line 402:		Line 402:

	This expression will match packets associated with a specific connection with given conntrack id (as from ''conntrack -L -o id''). You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''id'' ct_id.		This expression will match packets associated with a specific connection with given conntrack id (as from ''conntrack -L -o id''). You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''id'' ct_id.


			== ''ct l3proto'' ==

			Matches the L3 protocol of the conntrack entry associated with a packet. You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''l3proto'' l3_protocol.


			== ''ct protocol'' ==

			Matches the L4 protocol of the conntrack entry associated with a packet. You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''protocol'' l4_protocol.


			== ''ct packets'' ==

			Match based on how many packets have previously traversed the connection associated with a packet. If you specify an optional direction, only packets in that direction are counted. Otherwise, packets in both directions are counted. For example:
			''ct'' [''original'' \| ''reply''] packets < 10000


			== ''ct bytes'' ==

			Match based on how many total bytes have previously traversed the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:
			''ct'' [''original'' \| ''reply''] bytes < 100000


			== ''ct avgpkt'' ==

			Match based on the average packet size (bytes/packet) seen so far on the connection associated with a packet. If you specify an optional direction, only traffic in that direction is counted. Otherwise, traffic in both directions is counted. For example:
			''ct'' [''original'' \| ''reply''] avgpkt < 100

Fmyhr: Added ct id section. Added note about specifying optional direction with ct zone.

2021-04-15T17:45:47Z

Added ct id section. Added note about specifying optional direction with ct zone.

← Older revision		Revision as of 17:45, 15 April 2021
Line 391:		Line 391:
	== ''ct zone'' ==		== ''ct zone'' ==

	Similar to ''ct label'', if a [[Setting_packet_connection_tracking_metainformation#ct_zone_set_-_Set_conntrack_zone\|conntrack zone has been assigned to a packet]], you can then match such packets using this expression.		Similar to ''ct label'', if a [[Setting_packet_connection_tracking_metainformation#ct_zone_set_-_Set_conntrack_zone\|conntrack zone has been assigned to a packet]], you can then match such packets using this expression. You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''zone'' zone.


Line 397:		Line 397:

	You can match packets based on when their associated connection is set to expire, e.g. ''ct expiration < 1m30s''.		You can match packets based on when their associated connection is set to expire, e.g. ''ct expiration < 1m30s''.


			== ''ct id'' ==

			This expression will match packets associated with a specific connection with given conntrack id (as from ''conntrack -L -o id''). You can optionally include a packet direction with this match: ''ct'' [''original'' \| ''reply''] ''id'' ct_id.

Fmyhr: Added very basic section for ct zone.

2021-04-15T17:16:24Z

Added very basic section for ct zone.

← Older revision		Revision as of 17:16, 15 April 2021
Line 387:		Line 387:

	If a [[Setting_packet_connection_tracking_metainformation#ct_label_set_-_Set_conntrack_label\|conntrack label has been applied to a packet]], you can match such packets with this expression.		If a [[Setting_packet_connection_tracking_metainformation#ct_label_set_-_Set_conntrack_label\|conntrack label has been applied to a packet]], you can match such packets with this expression.


			== ''ct zone'' ==

			Similar to ''ct label'', if a [[Setting_packet_connection_tracking_metainformation#ct_zone_set_-_Set_conntrack_zone\|conntrack zone has been assigned to a packet]], you can then match such packets using this expression.

Fmyhr: Added (very basic) sections for ct direction, label and expiration.

2021-04-15T17:12:39Z

Added (very basic) sections for ct direction, label and expiration.

← Older revision		Revision as of 17:12, 15 April 2021
Line 377:		Line 377:

	[[Conntrack_helpers\|More on using ct helpers]].		[[Conntrack_helpers\|More on using ct helpers]].


			== ''ct direction'' ==

			A packet with ''original'' direction is traveling in the same direction as the first packet seen for this connection, e.g. in the direction of the original SYN packet for a TCP connection. A packet with ''reply'' direction is traveling in the direction opposite to ''original''.


			== ''ct label'' ==

			If a [[Setting_packet_connection_tracking_metainformation#ct_label_set_-_Set_conntrack_label\|conntrack label has been applied to a packet]], you can match such packets with this expression.


			== ''ct expiration'' ==

			You can match packets based on when their associated connection is set to expire, e.g. ''ct expiration < 1m30s''.

Fmyhr: Include user-assigned conntrack metadata, and link to Set packet connection tracking metainformation page.

2021-04-15T16:40:45Z

Include user-assigned conntrack metadata, and link to Set packet connection tracking metainformation page.

← Older revision		Revision as of 16:40, 15 April 2021
Line 1:		Line 1:
	nftables conntrack (''ct'') expressions enable [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls] by matching packets that correspond to connections tracked by netfilter's [[Connection_Tracking_System \| Connection Tracking System]].		nftables conntrack (''ct'') expressions enable [https://en.wikipedia.org/wiki/Stateful_firewall stateful firewalls] by matching packets that correspond to connections tracked by netfilter's [[Connection_Tracking_System \| Connection Tracking System]].

	= Conntrack ~~expressions~~ =		= Conntrack metadata available =

	It is useful to refer to the [[Data_types#Conntrack_types\|conntrack data types]].		It is useful to refer to the [[Data_types#Conntrack_types\|conntrack data types]].

	The ~~following sections will make use of this sample partial~~ [http://conntrack-tools.netfilter.org/conntrack.html ''conntrack'' command] output, ~~shown~~ in ''/proc/net/nf_conntrack'' format:
			== Conntrack-assigned metadata ==

			Conntrack itself maintains most of its metadata for each tracked connection. The [http://conntrack-tools.netfilter.org/conntrack.html ''conntrack''] command-line tool makes it easy to list these metadata as well as manage the connections. Following is a sample partial output, run on a host serving an active sshd session. The ''id'' option includes the unique conntrack id in the output; the ''extended'' option produces the listing in ''/proc/net/nf_conntrack'' format.

	<source>		<source>
Line 13:		Line 16:
	...		...
	</source>		</source>

			The following table lists each conntrack metadata field in the above output along with the nftables ''ct'' selector to match it.

	{\| class="wikitable"		{\| class="wikitable"
Line 142:		Line 147:
	\| ''mark=6''		\| ''mark=6''
	\| [[Matching_connection_tracking_stateful_metainformation#ct_mark_-_conntrack_mark\|''ct mark'']]		\| [[Matching_connection_tracking_stateful_metainformation#ct_mark_-_conntrack_mark\|''ct mark'']]
	\|		\| [[Setting_packet_connection_tracking_metainformation#ct_mark_set_-_Set_conntrack_mark\|Can also be set]].

	\|- style="vertical-align:top;"		\|- style="vertical-align:top;"
Line 160:		Line 165:
	\|}		\|}


			== User-assigned metadata ==

			* Conntrack ''mark'', ''label'' and ''zone'' are user-settable, and nftables can subsequently match packets against them.
			* In addition, ''notrack'', ''ct helper set'' and ''ct event set'' affect conntrack and nftables operation.
			Please see [[Setting_packet_connection_tracking_metainformation\|Setting packet connection tracking metainformation]] for more information.


			= Matching conntrack metadata =

	== ''ct state'' - conntrack state ==		== ''ct state'' - conntrack state ==

Fmyhr: ct status: include table of all known bits.

2021-04-13T12:02:23Z

ct status: include table of all known bits.

@@ Line 211: / Line 211: @@
 == ''ct status'' - conntrack status ==
-The  conntrack status is a bitfield consisting of the following flags:
+The  conntrack status is a bitfield defined by enum ''ip_conntrack_status'' in [https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next.git/tree/include/uapi/linux/netfilter/nf_conntrack_common.h /include/uapi/linux/netfilter/nf_conntrack_common.h]. Nftables includes (in [http://git.netfilter.org/nftables/tree/src/ct.c /src/ct.c struct ''ct_status_tbl'']) symbolic named constants for the conntrack status bits that make sense for filtering, as per the following table:
-* ''expected''
-* ''seen-reply''
+{| class="wikitable"
-* ''assured''
+!colspan="5"|conntrack status bits
-* ''confirmed''
+|- style="vertical-align:bottom;"
-* ''snat''
+! style="text-align:right;" | Bit&nbsp;#
-* ''dnat''
+! style="text-align:left;" | Kernel symbol
-* ''dying''
+! style="text-align:left;" | Nftables selector
 Match single flag: ''ct status snat''