nftables

package module
v0.0.0-...-ec9672c Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Jul 24, 2023 License: Apache-2.0 Imports: 13 Imported by: 0

README

Build Status GoDoc

This is not the correct repository for issues with the Linux nftables project! This repository contains a third-party Go package to programmatically interact with nftables. Find the official nftables website at https://wiki.nftables.org/

This package manipulates Linux nftables (the iptables successor). It is implemented in pure Go, i.e. does not wrap libnftnl.

This is not an official Google product.

Breaking changes

This package is in very early stages, and only contains enough data types and functions to install very basic nftables rules. It is likely that mistakes with the data types/API will be identified as more functionality is added.

Contributions

Contributions are very welcome!

Documentation

Overview

Package nftables manipulates Linux nftables (the iptables successor).

Index

Constants

View Source
const (
	// not in ztypes_linux.go, added here
	// https://cs.opensource.google/go/x/sys/+/c6bc011c:unix/ztypes_linux.go;l=1870-1892
	NFT_MSG_NEWFLOWTABLE = 0x16
	NFT_MSG_GETFLOWTABLE = 0x17
	NFT_MSG_DELFLOWTABLE = 0x18
)
View Source
const (
	NFTA_FLOWTABLE_TABLE
	NFTA_FLOWTABLE_NAME
	NFTA_FLOWTABLE_HOOK
	NFTA_FLOWTABLE_USE
	NFTA_FLOWTABLE_HANDLE
	NFTA_FLOWTABLE_PAD
	NFTA_FLOWTABLE_FLAGS
)
View Source
const (
	NFTA_FLOWTABLE_HOOK_NUM
	NFTA_FLOWTABLE_PRIORITY
	NFTA_FLOWTABLE_DEVS
)

SetConcatTypeBits defines concatination bits, originally defined in https://git.netfilter.org/iptables/tree/iptables/nft.c?id=26753888720d8e7eb422ae4311348347f5a05cb4#n1002

View Source
const (
	// not in ztypes_linux.go, added here, used for flowtable device name specification
	// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=84d12cfacf8ddd857a09435f3d982ab6250d250c#n1709
	NFTA_DEVICE_NAME = 1
)

Variables

View Source
var (
	TypeInvalid     = SetDatatype{Name: "invalid", /* contains filtered or unexported fields */}
	TypeVerdict     = SetDatatype{Name: "verdict", Bytes: 0, /* contains filtered or unexported fields */}
	TypeNFProto     = SetDatatype{Name: "nf_proto", Bytes: 1, /* contains filtered or unexported fields */}
	TypeBitmask     = SetDatatype{Name: "bitmask", Bytes: 0, /* contains filtered or unexported fields */}
	TypeInteger     = SetDatatype{Name: "integer", Bytes: 4, /* contains filtered or unexported fields */}
	TypeString      = SetDatatype{Name: "string", Bytes: 0, /* contains filtered or unexported fields */}
	TypeLLAddr      = SetDatatype{Name: "ll_addr", Bytes: 0, /* contains filtered or unexported fields */}
	TypeIPAddr      = SetDatatype{Name: "ipv4_addr", Bytes: 4, /* contains filtered or unexported fields */}
	TypeIP6Addr     = SetDatatype{Name: "ipv6_addr", Bytes: 16, /* contains filtered or unexported fields */}
	TypeEtherAddr   = SetDatatype{Name: "ether_addr", Bytes: 6, /* contains filtered or unexported fields */}
	TypeEtherType   = SetDatatype{Name: "ether_type", Bytes: 2, /* contains filtered or unexported fields */}
	TypeARPOp       = SetDatatype{Name: "arp_op", Bytes: 2, /* contains filtered or unexported fields */}
	TypeInetProto   = SetDatatype{Name: "inet_proto", Bytes: 1, /* contains filtered or unexported fields */}
	TypeInetService = SetDatatype{Name: "inet_service", Bytes: 2, /* contains filtered or unexported fields */}
	TypeICMPType    = SetDatatype{Name: "icmp_type", Bytes: 1, /* contains filtered or unexported fields */}
	TypeTCPFlag     = SetDatatype{Name: "tcp_flag", Bytes: 1, /* contains filtered or unexported fields */}
	TypeDCCPPktType = SetDatatype{Name: "dccp_pkttype", Bytes: 1, /* contains filtered or unexported fields */}
	TypeMHType      = SetDatatype{Name: "mh_type", Bytes: 1, /* contains filtered or unexported fields */}
	TypeTime        = SetDatatype{Name: "time", Bytes: 8, /* contains filtered or unexported fields */}
	TypeMark        = SetDatatype{Name: "mark", Bytes: 4, /* contains filtered or unexported fields */}
	TypeIFIndex     = SetDatatype{Name: "iface_index", Bytes: 4, /* contains filtered or unexported fields */}
	TypeARPHRD      = SetDatatype{Name: "iface_type", Bytes: 2, /* contains filtered or unexported fields */}
	TypeRealm       = SetDatatype{Name: "realm", Bytes: 4, /* contains filtered or unexported fields */}
	TypeClassID     = SetDatatype{Name: "classid", Bytes: 4, /* contains filtered or unexported fields */}
	TypeUID         = SetDatatype{Name: "uid", Bytes: sizeOfUIDT, /* contains filtered or unexported fields */}
	TypeGID         = SetDatatype{Name: "gid", Bytes: sizeOfGIDT, /* contains filtered or unexported fields */}
	TypeCTState     = SetDatatype{Name: "ct_state", Bytes: 4, /* contains filtered or unexported fields */}
	TypeCTDir       = SetDatatype{Name: "ct_dir", Bytes: 1, /* contains filtered or unexported fields */}
	TypeCTStatus    = SetDatatype{Name: "ct_status", Bytes: 4, /* contains filtered or unexported fields */}
	TypeICMP6Type   = SetDatatype{Name: "icmpv6_type", Bytes: 1, /* contains filtered or unexported fields */}
	TypeCTLabel     = SetDatatype{Name: "ct_label", Bytes: ctLabelBitSize / 8, /* contains filtered or unexported fields */}
	TypePktType     = SetDatatype{Name: "pkt_type", Bytes: 1, /* contains filtered or unexported fields */}
	TypeICMPCode    = SetDatatype{Name: "icmp_code", Bytes: 1, /* contains filtered or unexported fields */}
	TypeICMPV6Code  = SetDatatype{Name: "icmpv6_code", Bytes: 1, /* contains filtered or unexported fields */}
	TypeICMPXCode   = SetDatatype{Name: "icmpx_code", Bytes: 1, /* contains filtered or unexported fields */}
	TypeDevGroup    = SetDatatype{Name: "devgroup", Bytes: 4, /* contains filtered or unexported fields */}
	TypeDSCP        = SetDatatype{Name: "dscp", Bytes: 1, /* contains filtered or unexported fields */}
	TypeECN         = SetDatatype{Name: "ecn", Bytes: 1, /* contains filtered or unexported fields */}
	TypeFIBAddr     = SetDatatype{Name: "fib_addrtype", Bytes: 4, /* contains filtered or unexported fields */}
	TypeBoolean     = SetDatatype{Name: "boolean", Bytes: 1, /* contains filtered or unexported fields */}
	TypeCTEventBit  = SetDatatype{Name: "ct_event", Bytes: 4, /* contains filtered or unexported fields */}
	TypeIFName      = SetDatatype{Name: "ifname", Bytes: ifNameSize, /* contains filtered or unexported fields */}
	TypeIGMPType    = SetDatatype{Name: "igmp_type", Bytes: 1, /* contains filtered or unexported fields */}
	TypeTimeDate    = SetDatatype{Name: "time", Bytes: 8, /* contains filtered or unexported fields */}
	TypeTimeHour    = SetDatatype{Name: "hour", Bytes: 4, /* contains filtered or unexported fields */}
	TypeTimeDay     = SetDatatype{Name: "day", Bytes: 1, /* contains filtered or unexported fields */}
	TypeCGroupV2    = SetDatatype{Name: "cgroupsv2", Bytes: 8, /* contains filtered or unexported fields */}
)

NFT datatypes. See: https://git.netfilter.org/nftables/tree/include/datatype.h

View Source
var ErrTooManyTypes = errors.New("too many types to concat")

ErrTooManyTypes is the error returned by ConcatSetType, if nftMagic would overflow.

Functions

This section is empty.

Types

type Chain

type Chain struct {
	Name     string
	Table    *Table
	Hooknum  *ChainHook
	Priority *ChainPriority
	Type     ChainType
	Policy   *ChainPolicy
}

A Chain contains Rules. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains

type ChainHook

type ChainHook uint32

ChainHook specifies at which step in packet processing the Chain should be executed. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_hooks

Possible ChainHook values.

func ChainHookRef

func ChainHookRef(h ChainHook) *ChainHook

ChainHookRef returns a pointer to a ChainHookRef value.

type ChainPolicy

type ChainPolicy uint32

ChainPolicy defines what this chain default policy will be.

const (
	ChainPolicyDrop ChainPolicy = iota
	ChainPolicyAccept
)

Possible ChainPolicy values.

type ChainPriority

type ChainPriority int32

ChainPriority orders the chain relative to Netfilter internal operations. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_priority

var (
	ChainPriorityFirst            *ChainPriority = ChainPriorityRef(math.MinInt32)
	ChainPriorityConntrackDefrag  *ChainPriority = ChainPriorityRef(-400)
	ChainPriorityRaw              *ChainPriority = ChainPriorityRef(-300)
	ChainPrioritySELinuxFirst     *ChainPriority = ChainPriorityRef(-225)
	ChainPriorityConntrack        *ChainPriority = ChainPriorityRef(-200)
	ChainPriorityMangle           *ChainPriority = ChainPriorityRef(-150)
	ChainPriorityNATDest          *ChainPriority = ChainPriorityRef(-100)
	ChainPriorityFilter           *ChainPriority = ChainPriorityRef(0)
	ChainPrioritySecurity         *ChainPriority = ChainPriorityRef(50)
	ChainPriorityNATSource        *ChainPriority = ChainPriorityRef(100)
	ChainPrioritySELinuxLast      *ChainPriority = ChainPriorityRef(225)
	ChainPriorityConntrackHelper  *ChainPriority = ChainPriorityRef(300)
	ChainPriorityConntrackConfirm *ChainPriority = ChainPriorityRef(math.MaxInt32)
	ChainPriorityLast             *ChainPriority = ChainPriorityRef(math.MaxInt32)
)

Possible ChainPriority values.

func ChainPriorityRef

func ChainPriorityRef(p ChainPriority) *ChainPriority

ChainPriorityRef returns a pointer to a ChainPriority value.

type ChainType

type ChainType string

ChainType defines what this chain will be used for. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Base_chain_types

const (
	ChainTypeFilter ChainType = "filter"
	ChainTypeRoute  ChainType = "route"
	ChainTypeNAT    ChainType = "nat"
)

Possible ChainType values.

type Conn

type Conn struct {
	TestDial nltest.Func // for testing only; passed to nltest.Dial
	NetNS    int         // fd referencing the network namespace netlink will interact with.
	// contains filtered or unexported fields
}

A Conn represents a netlink connection of the nftables family.

All methods return their input, so that variables can be defined from string literals when desired.

Commands are buffered. Flush sends all buffered commands in a single batch.

func New

func New(opts ...ConnOption) (*Conn, error)

New returns a netlink connection for querying and modifying nftables. Some aspects of the new netlink connection can be configured using the options WithNetNSFd, WithTestDial, and AsLasting.

A lasting netlink connection should be closed by calling CloseLasting() to close the underlying lasting netlink connection, cancelling all pending operations using this connection.

func (*Conn) AddChain

func (cc *Conn) AddChain(c *Chain) *Chain

AddChain adds the specified Chain. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Adding_base_chains

func (*Conn) AddFlowtable

func (cc *Conn) AddFlowtable(f *Flowtable) *Flowtable

func (*Conn) AddObj

func (cc *Conn) AddObj(o Obj) Obj

AddObj adds the specified Obj. See also https://wiki.nftables.org/wiki-nftables/index.php/Stateful_objects

func (*Conn) AddObject

func (cc *Conn) AddObject(o Obj) Obj

AddObject adds the specified Obj. Alias of AddObj.

func (*Conn) AddRule

func (cc *Conn) AddRule(r *Rule) *Rule

func (*Conn) AddSet

func (cc *Conn) AddSet(s *Set, vals []SetElement) error

AddSet adds the specified Set.

func (*Conn) AddTable

func (cc *Conn) AddTable(t *Table) *Table

AddTable adds the specified Table. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables

func (*Conn) CloseLasting

func (cc *Conn) CloseLasting() error

CloseLasting closes the lasting netlink connection that has been opened using AsLasting option when creating this connection. If either no lasting netlink connection has been opened or the lasting connection is already in the process of closing or has been closed, CloseLasting will immediately return without any error.

CloseLasting will terminate all pending netlink operations using the lasting connection.

After closing a lasting connection, the connection will revert to using on-demand transient netlink connections when calling further netlink operations (such as GetTables).

func (*Conn) DelChain

func (cc *Conn) DelChain(c *Chain)

DelChain deletes the specified Chain. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Deleting_chains

func (*Conn) DelFlowtable

func (cc *Conn) DelFlowtable(f *Flowtable)

func (*Conn) DelRule

func (cc *Conn) DelRule(r *Rule) error

DelRule deletes the specified Rule, rule's handle cannot be 0

func (*Conn) DelSet

func (cc *Conn) DelSet(s *Set)

DelSet deletes a specific set, along with all elements it contains.

func (*Conn) DelTable

func (cc *Conn) DelTable(t *Table)

DelTable deletes a specific table, along with all chains/rules it contains.

func (*Conn) DeleteObject

func (cc *Conn) DeleteObject(o Obj)

DeleteObject deletes the specified Obj

func (*Conn) Flush

func (cc *Conn) Flush() error

Flush sends all buffered commands in a single batch to nftables.

func (*Conn) FlushChain

func (cc *Conn) FlushChain(c *Chain)

FlushChain removes all rules within the specified Chain. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_chains#Flushing_chain

func (*Conn) FlushRuleset

func (cc *Conn) FlushRuleset()

FlushRuleset flushes the entire ruleset. See also https://wiki.nftables.org/wiki-nftables/index.php/Operations_at_ruleset_level

func (*Conn) FlushSet

func (cc *Conn) FlushSet(s *Set)

FlushSet deletes all data points from an nftables set.

func (*Conn) FlushTable

func (cc *Conn) FlushTable(t *Table)

FlushTable removes all rules in all chains within the specified Table. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables#Flushing_tables

func (*Conn) GetObj

func (cc *Conn) GetObj(o Obj) ([]Obj, error)

GetObj is a legacy method that return all Obj that belongs to the same table as the given one

func (*Conn) GetObjReset

func (cc *Conn) GetObjReset(o Obj) ([]Obj, error)

GetObjReset is a legacy method that reset all Obj that belongs the same table as the given one

func (*Conn) GetObject

func (cc *Conn) GetObject(o Obj) (Obj, error)

GetObject gets the specified Object

func (*Conn) GetObjects

func (cc *Conn) GetObjects(t *Table) ([]Obj, error)

GetObjects get all the Obj that belongs to the given table

func (*Conn) GetRule deprecated

func (cc *Conn) GetRule(t *Table, c *Chain) ([]*Rule, error)

GetRule returns the rules in the specified table and chain.

Deprecated: use GetRules instead.

func (*Conn) GetRules

func (cc *Conn) GetRules(t *Table, c *Chain) ([]*Rule, error)

GetRules returns the rules in the specified table and chain.

func (*Conn) GetSetByName

func (cc *Conn) GetSetByName(t *Table, name string) (*Set, error)

GetSetByName returns the set in the specified table if matching name is found.

func (*Conn) GetSetElements

func (cc *Conn) GetSetElements(s *Set) ([]SetElement, error)

GetSetElements returns the elements in the specified set.

func (*Conn) GetSets

func (cc *Conn) GetSets(t *Table) ([]*Set, error)

GetSets returns the sets in the specified table.

func (*Conn) InsertRule

func (cc *Conn) InsertRule(r *Rule) *Rule

func (*Conn) ListChains

func (cc *Conn) ListChains() ([]*Chain, error)

ListChains returns currently configured chains in the kernel

func (*Conn) ListChainsOfTableFamily

func (cc *Conn) ListChainsOfTableFamily(family TableFamily) ([]*Chain, error)

ListChainsOfTableFamily returns currently configured chains for the specified family in the kernel. It lists all chains ins all tables if family is TableFamilyUnspecified.

func (*Conn) ListFlowtables

func (cc *Conn) ListFlowtables(t *Table) ([]*Flowtable, error)

func (*Conn) ListTables

func (cc *Conn) ListTables() ([]*Table, error)

ListTables returns currently configured tables in the kernel

func (*Conn) ListTablesOfFamily

func (cc *Conn) ListTablesOfFamily(family TableFamily) ([]*Table, error)

ListTablesOfFamily returns currently configured tables for the specified table family in the kernel. It lists all tables if family is TableFamilyUnspecified.

func (*Conn) ReplaceRule

func (cc *Conn) ReplaceRule(r *Rule) *Rule

func (*Conn) ResetObject

func (cc *Conn) ResetObject(o Obj) (Obj, error)

ResetObject reset the given Obj

func (*Conn) ResetObjects

func (cc *Conn) ResetObjects(t *Table) ([]Obj, error)

ResetObjects reset all the Obj that belongs to the given table

func (*Conn) SetAddElements

func (cc *Conn) SetAddElements(s *Set, vals []SetElement) error

SetAddElements applies data points to an nftables set.

func (*Conn) SetDeleteElements

func (cc *Conn) SetDeleteElements(s *Set, vals []SetElement) error

SetDeleteElements deletes data points from an nftables set.

type ConnOption

type ConnOption func(*Conn)

ConnOption is an option to change the behavior of the nftables Conn returned by Open.

func AsLasting

func AsLasting() ConnOption

AsLasting creates the new netlink connection as a lasting connection that is reused across multiple netlink operations, instead of opening and closing the underlying netlink connection only for the duration of a single netlink operation.

func WithNetNSFd

func WithNetNSFd(fd int) ConnOption

WithNetNSFd sets the network namespace to create a new netlink connection to: the fd must reference a network namespace.

func WithTestDial

func WithTestDial(f nltest.Func) ConnOption

WithTestDial sets the specified nltest.Func when creating a new netlink connection.

type CounterObj

type CounterObj struct {
	Table *Table
	Name  string // e.g. “fwded”

	Bytes   uint64
	Packets uint64
}

CounterObj implements Obj.

type Flowtable

type Flowtable struct {
	Table    *Table
	Name     string
	Hooknum  *FlowtableHook
	Priority *FlowtablePriority
	Devices  []string
	Use      uint32
	// Bitmask flags, can be HW_OFFLOAD or COUNTER
	// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=84d12cfacf8ddd857a09435f3d982ab6250d250c#n1621
	Flags  FlowtableFlags
	Handle uint64
}

type FlowtableFlags

type FlowtableFlags uint32
const (
	FlowtableFlagsHWOffload FlowtableFlags
	FlowtableFlagsCounter
	FlowtableFlagsMask = (FlowtableFlagsHWOffload | FlowtableFlagsCounter)
)

type FlowtablePriority

type FlowtablePriority int32
var (
	// As per man page:
	// The priority can be a signed integer or filter which stands for 0. Addition and subtraction can be used to set relative priority, e.g. filter + 5 equals to 5.
	// https://git.netfilter.org/nftables/tree/doc/nft.txt?id=8c600a843b7c0c1cc275ecc0603bd1fc57773e98#n712
	FlowtablePriorityFilter *FlowtablePriority = FlowtablePriorityRef(0)
)

func FlowtablePriorityRef

func FlowtablePriorityRef(p FlowtablePriority) *FlowtablePriority

type Obj

type Obj interface {
	// contains filtered or unexported methods
}

Obj represents a netfilter stateful object. See also https://wiki.nftables.org/wiki-nftables/index.php/Stateful_objects

type Rule

type Rule struct {
	Table    *Table
	Chain    *Chain
	Position uint64
	Handle   uint64
	// The list of possible flags are specified by nftnl_rule_attr, see
	// https://git.netfilter.org/libnftnl/tree/include/libnftnl/rule.h#n21
	// Current nftables go implementation supports only
	// NFTNL_RULE_POSITION flag for setting rule at position 0
	Flags    uint32
	Exprs    []expr.Any
	UserData []byte
}

A Rule does something with a packet. See also https://wiki.nftables.org/wiki-nftables/index.php/Simple_rule_management

type Set

type Set struct {
	Table      *Table
	ID         uint32
	Name       string
	Anonymous  bool
	Constant   bool
	Interval   bool
	IsMap      bool
	HasTimeout bool
	Counter    bool
	// Can be updated per evaluation path, per `nft list ruleset`
	// indicates that set contains "flags dynamic"
	// https://git.netfilter.org/libnftnl/tree/include/linux/netfilter/nf_tables.h?id=84d12cfacf8ddd857a09435f3d982ab6250d250c#n298
	Dynamic bool
	// Indicates that the set contains a concatenation
	// https://git.netfilter.org/nftables/tree/include/linux/netfilter/nf_tables.h?id=d1289bff58e1878c3162f574c603da993e29b113#n306
	Concatenation bool
	Timeout       time.Duration
	KeyType       SetDatatype
	DataType      SetDatatype
	// Either host (binaryutil.NativeEndian) or big (binaryutil.BigEndian) endian as per
	// https://git.netfilter.org/nftables/tree/include/datatype.h?id=d486c9e626405e829221b82d7355558005b26d8a#n109
	KeyByteOrder binaryutil.ByteOrder
}

Set represents an nftables set. Anonymous sets are only valid within the context of a single batch.

type SetDatatype

type SetDatatype struct {
	Name  string
	Bytes uint32
	// contains filtered or unexported fields
}

SetDatatype represents a datatype declared by nft.

func ConcatSetType

func ConcatSetType(types ...SetDatatype) (SetDatatype, error)

ConcatSetType constructs a new SetDatatype which consists of a concatenation of the passed types. It returns ErrTooManyTypes, if nftMagic would overflow (more than 5 types).

func ConcatSetTypeElements

func ConcatSetTypeElements(t SetDatatype) []SetDatatype

ConcatSetTypeElements uses the ConcatSetType name to calculate and return a list of base types which were used to construct the concatenated type

func MustConcatSetType

func MustConcatSetType(types ...SetDatatype) SetDatatype

MustConcatSetType does the same as ConcatSetType, but panics instead of an error. It simplifies safe initialization of global variables.

func (*SetDatatype) GetNFTMagic

func (s *SetDatatype) GetNFTMagic() uint32

GetNFTMagic returns a custom datatype based on user's parameters

func (*SetDatatype) SetNFTMagic

func (s *SetDatatype) SetNFTMagic(nftMagic uint32)

SetNFTMagic returns a custom datatype based on user's parameters

type SetElement

type SetElement struct {
	Key []byte
	Val []byte
	// Field used for definition of ending interval value in concatenated types
	// https://git.netfilter.org/libnftnl/tree/include/set_elem.h?id=e2514c0eff4da7e8e0aabd410f7b7d0b7564c880#n11
	KeyEnd      []byte
	IntervalEnd bool
	// To support vmap, a caller must be able to pass Verdict type of data.
	// If IsMap is true and VerdictData is not nil, then Val of SetElement will be ignored
	// and VerdictData will be wrapped into Attribute data.
	VerdictData *expr.Verdict
	// To support aging of set elements
	Timeout time.Duration

	// Life left of the "timeout" elements
	Expires time.Duration

	Counter *expr.Counter
}

SetElement represents a data point within a set.

type Table

type Table struct {
	Name   string // NFTA_TABLE_NAME
	Use    uint32 // NFTA_TABLE_USE (Number of chains in table)
	Flags  uint32 // NFTA_TABLE_FLAGS
	Family TableFamily
}

A Table contains Chains. See also https://wiki.nftables.org/wiki-nftables/index.php/Configuring_tables

type TableFamily

type TableFamily byte

TableFamily specifies the address family for this table.

const (
	TableFamilyUnspecified TableFamily = unix.NFPROTO_UNSPEC
	TableFamilyINet        TableFamily = unix.NFPROTO_INET
	TableFamilyIPv4        TableFamily = unix.NFPROTO_IPV4
	TableFamilyIPv6        TableFamily = unix.NFPROTO_IPV6
	TableFamilyARP         TableFamily = unix.NFPROTO_ARP
	TableFamilyNetdev      TableFamily = unix.NFPROTO_NETDEV
	TableFamilyBridge      TableFamily = unix.NFPROTO_BRIDGE
)

Possible TableFamily values.

Directories

Path Synopsis
Package alignedbuff implements encoding and decoding aligned data elements to/from buffers in native endianess.
Package alignedbuff implements encoding and decoding aligned data elements to/from buffers in native endianess.
Package binaryutil contains convenience wrappers around encoding/binary.
Package binaryutil contains convenience wrappers around encoding/binary.
Package expr provides nftables rule expressions.
Package expr provides nftables rule expressions.
internal
nftest
Package nftest contains utility functions for nftables testing.
Package nftest contains utility functions for nftables testing.
Package userdata implements a TLV parser/serializer for libnftables-compatible comments
Package userdata implements a TLV parser/serializer for libnftables-compatible comments
Package xt implements dedicated types for (some) of the "Info" payload in Match and Target expressions that bridge between the nftables and xtables worlds.
Package xt implements dedicated types for (some) of the "Info" payload in Match and Target expressions that bridge between the nftables and xtables worlds.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL