Matching packet headers - Revision history

Pablo: /* Matching transport protocol */ a bit more detailed explanation on how meta l4proto works

2021-08-31T11:41:27Z

Matching transport protocol: a bit more detailed explanation on how meta l4proto works

← Older revision		Revision as of 11:41, 31 August 2021
Line 156:		Line 156:
	</source>		</source>

	This allows you to match on the transport protocol regardless the packet is either IPv4 or IPv6.		This allows you to match on the transport protocol regardless the packet is either IPv4 or IPv6. For IPv6, ''meta l4proto'' also skips any extension header until the first transport protocol is found.

	= Matching TCP/UDP/UDPlite traffic =		= Matching TCP/UDP/UDPlite traffic =

Pablo: /* Matching IPv6 headers */ another typo

2021-08-31T11:39:34Z

Matching IPv6 headers: another typo

← Older revision		Revision as of 11:39, 31 August 2021
Line 131:		Line 131:
	You could use ''meta l4proto'' to match on the transport protocol (ie. TCP, UDP, ICMPv6,...), this is walking down the headers until the real transport protocol is found.		You could use ''meta l4proto'' to match on the transport protocol (ie. TCP, UDP, ICMPv6,...), this is walking down the headers until the real transport protocol is found.

	If you specifically want to match on the ICMPv6 type, then ''nftables'' creates an implicit ''meta l4proto'' dependency that is not shown, therefore, there is ~~not~~ for		If you specifically want to match on the ICMPv6 type, then ''nftables'' creates an implicit ''meta l4proto'' dependency that is not shown, therefore, there is no need for
	being verbose in your notation, ie.		being verbose in your notation, ie.

Pablo: /* Matching IPv6 headers */ fix typos and style

2021-08-31T11:38:58Z

Matching IPv6 headers: fix typos and style

← Older revision		Revision as of 11:38, 31 August 2021
Line 118:		Line 118:
	</source>		</source>

	Caution when using ip6 nexthdr, the value only refers to the next header, i.e. ip6 nexthdr tcp will only match if the ipv6 packet does not contain any extension headers.		Caution when using ''ip6 nexthdr'', the value only refers to the next header, i.e. ip6 nexthdr tcp will only match if the ipv6 packet does not contain any extension headers.
			Specifically, using ''ip6 nexthdr'' to match on IPv6 ICMP matching might break because quoting RFC2710:
	IPv6 ICMP matching might break because quoting RFC2710:

	MLD message types are a subset of the set of ICMPv6 messages, and MLD messages		MLD message types are a subset of the set of ICMPv6 messages, and MLD messages

Pablo: /* Matching IPv6 headers */ refer to the ICMPv6 case

2021-08-31T11:37:47Z

Matching IPv6 headers: refer to the ICMPv6 case

@@ Line 110: / Line 110: @@
 </source>
-To filter on a layer 4 protocol like TCP, you can use the ''nexthdr'' keyword:
+Do not forget to create an ''ip6'' [[Configuring tables|table]] and register the corresponding [[Configuring chains|chains]] to run the examples.
 <source lang="bash">
@@ Line 116: / Line 118: @@
 </source>
-Do not forget to create an ''ip6'' [[Configuring tables|table]] and register the corresponding [[Configuring chains|chains]] to run the examples.
+Caution when using ip6 nexthdr, the value only refers to the next header, i.e. ip6 nexthdr tcp will only match if the ipv6 packet does not contain any extension headers.
 NOTE: the syntax mixing IPv6/IPv4 notation is not supported yet: '::ffff:192.168.1.0'
 = Matching transport protocol =

Fmyhr: /* Matching UDP/TCP headers in the same rule */ link man page for raw payload expression

2021-08-27T18:20:52Z

Matching UDP/TCP headers in the same rule: link man page for raw payload expression

← Older revision		Revision as of 18:20, 27 August 2021
Line 175:		Line 175:
	</source>		</source>

	Note: Before nftables 0.9.2 and Linux kernel 5.3 the ''th'' expression is not available. In this case you can use a raw payload expression to do the same job:		Note: Before nftables 0.9.2 and Linux kernel 5.3 the ''th'' expression is not available. In this case you can use a [https://www.mankier.com/8/nft#Payload_Expressions-Raw_Payload_Expression raw payload expression] to do the same job:

	<source lang="bash">		<source lang="bash">
	% nft add rule filter input meta l4proto { tcp, udp } @th,16,16 53 counter packets 0 bytes 0 accept comment \"accept DNS\"		% nft add rule filter input meta l4proto { tcp, udp } @th,16,16 53 counter packets 0 bytes 0 accept comment \"accept DNS\"
	</source>		</source>

Pablo: /* Matching transport protocol */ document inet

2021-07-23T16:13:56Z

Matching transport protocol: document inet

← Older revision		Revision as of 16:13, 23 July 2021
Line 129:		Line 129:
	</source>		</source>

			If you are on the ''inet'' family, then use ''meta l4proto'':

			<source lang="bash">
			% nft add rule inet filter output meta l4proto tcp
			</source>

			This allows you to match on the transport protocol regardless the packet is either IPv4 or IPv6.

	= Matching TCP/UDP/UDPlite traffic =		= Matching TCP/UDP/UDPlite traffic =

Fmyhr: Matching ARP headers: added brief descriptions.

2021-04-20T14:55:09Z

Matching ARP headers: added brief descriptions.

← Older revision		Revision as of 14:55, 20 April 2021
Line 27:		Line 27:

	You can match [https://en.wikipedia.org/wiki/Address_Resolution_Protocol ARP] headers:		You can match [https://en.wikipedia.org/wiki/Address_Resolution_Protocol ARP] headers:
	* ''arp htype'' «[[Data_types#ARP_types\|16-bit integer HTYPE]]»		* ''arp htype'' «[[Data_types#ARP_types\|16-bit integer HTYPE]]» - match hardware link protocol type (1 for ethernet)
	* ''arp ptype'' «[[Data_types#Ethernet_types\|ether_type]]»		* ''arp ptype'' «[[Data_types#Ethernet_types\|ether_type]]» - match EtherType
	* ''arp hlen'' «[[Data_types#ARP_types\|8-bit integer HLEN]]»		* ''arp hlen'' «[[Data_types#ARP_types\|8-bit integer HLEN]]» - match hardware address length in octets (6 for ethernet)
	* ''arp plen'' «[[Data_types#ARP_types\|8-bit integer PLEN]]»		* ''arp plen'' «[[Data_types#ARP_types\|8-bit integer PLEN]]» - match internetwork protocol address length in octets (4 for IPv4)
	* ''arp operation'' «[[Data_types#ARP_types\|arp_op]]»		* ''arp operation'' «[[Data_types#ARP_types\|arp_op]]» - match ARP operation
	* ''arp'' {''saddr'' \| ''daddr ''} ''ether'' «[[Data_types#Ethernet_types\|ether_addr]]»		* ''arp'' {''saddr'' \| ''daddr ''} ''ether'' «[[Data_types#Ethernet_types\|ether_addr]]» - ''saddr'' matches SHA, Sender Hardware Address; ''daddr'' matches THA, Target Hardware Address
	* ''arp'' {''saddr'' \| ''daddr ''} ''ip'' «[[Data_types#IP_types\|ipv4_addr]]»		* ''arp'' {''saddr'' \| ''daddr ''} ''ip'' «[[Data_types#IP_types\|ipv4_addr]]» - ''saddr'' matches SPA, Sender Protocol Address; ''daddr'' matches TPA, Target Protocol Address

Fmyhr: Reordered sections, moving up network layers and matching man page.

2021-04-20T14:34:05Z

Reordered sections, moving up network layers and matching man page.

@@ Line 34: / Line 34: @@
 * ''arp'' {''saddr'' | ''daddr ''} ''ether'' &laquo;[[Data_types#Ethernet_types|ether_addr]]&raquo;
 * ''arp'' {''saddr'' | ''daddr ''} ''ip'' &laquo;[[Data_types#IP_types|ipv4_addr]]&raquo;
@@ Line 58: / Line 49: @@
 <source lang="bash">
 % nft add rule filter input protocol tcp counter
 </source>
@@ Line 157: / Line 99: @@
 % nft add rule filter output icmp code frag-needed counter accept
 </source>

Fmyhr: Added section: Matching ARP headers

2021-04-20T14:28:04Z

Added section: Matching ARP headers

← Older revision		Revision as of 14:28, 20 April 2021
Line 22:		Line 22:

	Do not forget that the [https://en.wikipedia.org/wiki/Link_layer layer 2] header information is only available in the input path.		Do not forget that the [https://en.wikipedia.org/wiki/Link_layer layer 2] header information is only available in the input path.


			= Matching ARP headers =

			You can match [https://en.wikipedia.org/wiki/Address_Resolution_Protocol ARP] headers:
			* ''arp htype'' «[[Data_types#ARP_types\|16-bit integer HTYPE]]»
			* ''arp ptype'' «[[Data_types#Ethernet_types\|ether_type]]»
			* ''arp hlen'' «[[Data_types#ARP_types\|8-bit integer HLEN]]»
			* ''arp plen'' «[[Data_types#ARP_types\|8-bit integer PLEN]]»
			* ''arp operation'' «[[Data_types#ARP_types\|arp_op]]»
			* ''arp'' {''saddr'' \| ''daddr ''} ''ether'' «[[Data_types#Ethernet_types\|ether_addr]]»
			* ''arp'' {''saddr'' \| ''daddr ''} ''ip'' «[[Data_types#IP_types\|ipv4_addr]]»

Fmyhr: Link references to ethernet, EtherType, L2.

2021-04-20T12:29:09Z

Link references to ethernet, EtherType, L2.

← Older revision		Revision as of 12:29, 20 April 2021
Line 4:		Line 4:
	= Matching ethernet headers =		= Matching ethernet headers =

	You can match packets on ethernet source or destination address or on EtherType:		You can match packets on [https://en.wikipedia.org/wiki/Ethernet ethernet] source or destination address or on [https://en.wikipedia.org/wiki/EtherType EtherType]:
	* ''ether'' {''saddr'' \| ''daddr''} «[[Data_types#Ethernet_types\|ether_addr]]»		* ''ether'' {''saddr'' \| ''daddr''} «[[Data_types#Ethernet_types\|ether_addr]]»
	* ''ether type'' «[[Data_types#Ethernet_types\|ether_type]]»		* ''ether type'' «[[Data_types#Ethernet_types\|ether_type]]»
Line 21:		Line 21:


	Do not forget that the layer 2 header information is only available in the input path.		Do not forget that the [https://en.wikipedia.org/wiki/Link_layer layer 2] header information is only available in the input path.

← Older revision		Revision as of 14:55, 20 April 2021
Line 27:		Line 27:

	You can match [https://en.wikipedia.org/wiki/Address_Resolution_Protocol ARP] headers:		You can match [https://en.wikipedia.org/wiki/Address_Resolution_Protocol ARP] headers:
	* ''arp htype'' «[[Data_types#ARP_types\|16-bit integer HTYPE]]»		* ''arp htype'' «[[Data_types#ARP_types\|16-bit integer HTYPE]]» - match hardware link protocol type (1 for ethernet)
	* ''arp ptype'' «[[Data_types#Ethernet_types\|ether_type]]»		* ''arp ptype'' «[[Data_types#Ethernet_types\|ether_type]]» - match EtherType
	* ''arp hlen'' «[[Data_types#ARP_types\|8-bit integer HLEN]]»		* ''arp hlen'' «[[Data_types#ARP_types\|8-bit integer HLEN]]» - match hardware address length in octets (6 for ethernet)
	* ''arp plen'' «[[Data_types#ARP_types\|8-bit integer PLEN]]»		* ''arp plen'' «[[Data_types#ARP_types\|8-bit integer PLEN]]» - match internetwork protocol address length in octets (4 for IPv4)
	* ''arp operation'' «[[Data_types#ARP_types\|arp_op]]»		* ''arp operation'' «[[Data_types#ARP_types\|arp_op]]» - match ARP operation
	* ''arp'' {''saddr'' \| ''daddr ''} ''ether'' «[[Data_types#Ethernet_types\|ether_addr]]»		* ''arp'' {''saddr'' \| ''daddr ''} ''ether'' «[[Data_types#Ethernet_types\|ether_addr]]» - ''saddr'' matches SHA, Sender Hardware Address; ''daddr'' matches THA, Target Hardware Address
	* ''arp'' {''saddr'' \| ''daddr ''} ''ip'' «[[Data_types#IP_types\|ipv4_addr]]»		* ''arp'' {''saddr'' \| ''daddr ''} ''ip'' «[[Data_types#IP_types\|ipv4_addr]]» - ''saddr'' matches SPA, Sender Protocol Address; ''daddr'' matches TPA, Target Protocol Address