Matching packet metainformation: Difference between revisions
m (→Matching by routing class & realm: Link nexthop and fib selectors) |
(→Matching by interface: Added iifkind, oifkind) |
||
Line 80: | Line 80: | ||
|- style="vertical-align:top;" | |- style="vertical-align:top;" | ||
| '' | | ''iiftype'' | ||
| | | | ||
| input interface | | input interface type | ||
| | | iface_type | ||
| | | | ||
|- style="vertical-align:top;" | |- style="vertical-align:top;" | ||
| '' | | ''iifkind'' | ||
| | | | ||
| input interface | | input interface kind name | ||
| | | ifname | ||
| | | | ||
|- style="vertical-align:top;" | |- style="vertical-align:top;" | ||
| '' | | ''iifgroup'' | ||
| | | | ||
| input | | input interface group | ||
| | | devgroup | ||
| | | | ||
Line 112: | Line 112: | ||
| | | | ||
| output interface name | | output interface name | ||
| ifname | |||
| | |||
|- style="vertical-align:top;" | |||
| ''oiftype'' | |||
| | |||
| output interface type | |||
| iface_type | |||
| | |||
|- style="vertical-align:top;" | |||
| ''oifkind'' | |||
| | |||
| output interface kind name | |||
| ifname | | ifname | ||
| | | | ||
Line 123: | Line 137: | ||
|- style="vertical-align:top;" | |- style="vertical-align:top;" | ||
| '' | | ''ibrname'' | ||
| | | | ||
| | | input bridge interface name | ||
| | | ifname | ||
| | | | ||
Revision as of 14:02, 7 February 2021
The meta selectors allows you to match -- and in some cases, set -- packet metainformation. That is, information the local host has about the packet (such as how / when it was received) that is not necessarily carried in the packet itself.
Matching by packet info
The following meta selectors match packets by information carried by the packet itself:
meta Packet Info Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
pkttype | Y | packet type | pkt_type | |
length | packet length in bytes | integer (32 bit) | ||
protocol | packet protocol / EtherType protocol value | ether_type | as in skb->protocol | |
nfproto | netfilter packet protocol family | integer (32 bit) | like ipv4, ipv6, etc...; useful only in inet table | |
l4proto | layer 4 protocol | integer (8 bit) | like tcp, udp, etc...; skips ipv6 extension headers |
Matching by interface
The following meta selectors match packets based on incoming or outgoing interfaces:
meta Interface Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
iif | input interface index | iface_index | Faster than iifname as it only has to compare a 32-bit unsigned integer instead of a string.
The interface index is dynamically allocated, so don't use this for interfaces that are dynamically created and destroyed, eg. ppp0. | |
iifname | input interface name | ifname | ||
iiftype | input interface type | iface_type | ||
iifkind | input interface kind name | ifname | ||
iifgroup | input interface group | devgroup | ||
oif | output interface index | iface_index | Faster than oifname as it only has to compare a 32-bit unsigned integer instead of a string.
The interface index is dynamically allocated, so don't use this for interfaces that are dynamically created and destroyed, eg. ppp0. | |
oifname | output interface name | ifname | ||
oiftype | output interface type | iface_type | ||
oifkind | output interface kind name | ifname | ||
oifgroup | output interface group | devgroup | ||
ibrname | input bridge interface name | ifname | ||
obrname | output bridge interface name | ifname | ||
ibriport | input bridge port | |||
obriport | output bridge port | |||
ibrvproto | bridge protocol | |||
ibrpvid | bridge pvid |
An example rule that uses iifname to accept all traffic entering the loopback pseudodevice lo:
% nft add rule filter input meta iifname lo accept
Matching by packet mark
meta Packet Mark Selector | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
mark | Y | packet mark | mark |
You can match packets whose mark is 123 with the following rule:
nft add rule filter output meta mark 123 counter
Matching by socket UID / GID
meta UID / GID Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
skuid | UID associated with originating socket | uid | ||
skgid | GID associated with originating socket | gid |
You can use your user name to match traffic, eg.
% nft add rule filter output meta skuid pablo counter
Or the 32-bits unsigned integer (UID) in case there is no entry in /etc/passwd for a given user.
% nft add rule filter output meta skuid 1000 counter
Let's just generate some HTTP traffic to test this rule:
% wget --spider http://www.google.com
Then, if you check the counters, you can verify that the packets are matching that rule.
% nft list table filter
table ip filter {
chain output {
type filter hook output priority 0;
skuid pablo counter packets 7 bytes 510
}
chain input {
type filter hook input priority 0;
}
}
Important: Beware if you test this with ping, it is usually installed with suid so that traffic will match the root user (uid=0).
Matching by routing class & realm
meta Routing Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
priority | Y | tc packet priority | tc_handle | detailed usage example |
rtclassid | routing realm | realm | Routing realm references: |
- Since nftables v0.7 you can match the packet priority, the tc classid:
% nft add rule filter forward meta priority abcd:1234
- Packet without set priority can be matched using meta priority none
% nft add rule filter forward meta priority none
See also: nexthop and fib selectors
Matching by time
meta Time Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
time | timestamp of packet reception | integer (32 bit) or string | ||
day | day of week | integer (32 bit) or string | ||
hour | hour of day | string |
Matching by security selectors
meta Security Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
cpu | CPU number processing the packet | integer (32 bit) | ||
cgroup | control group ID | integer (32 bit) | ||
secmark | Y | packet secmark | ||
ipsec | true if packet was ipsec encrypted | boolean (1 bit) |
Matching by miscellaneous selectors
In addition to those in the above subsections, the following miscellaneous meta selectors are available:
meta Miscellaneous Selectors | ||||
---|---|---|---|---|
Keyword | Settable | Description | Data Type | Notes |
nftrace | Y | nftrace debugging bit | ||
random | pseudo-random number | integer (32 bit) |