diff mbox

[nft,v2,2/2] doc: Describe ICMP(v6) expression and types

Message ID 20170316124321.23399-2-phil@nwl.cc
State Accepted
Delegated to: Pablo Neira
Headers show

Commit Message

Phil Sutter March 16, 2017, 12:43 p.m. UTC 
This adds a description of the icmp and icmpv6 expressions (to match
various ICMP header fields) as well as the icmp and icmpv6 type types
(yay) which are used for ICMP(v6) type field.

Signed-off-by: Phil Sutter <phil@nwl.cc>
---
Changes since v1:
- Added this patch.
---
 doc/nft.xml | 380 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 380 insertions(+)

Comments

Pablo Neira Ayuso March 17, 2017, 11:45 a.m. UTC | #1 
On Thu, Mar 16, 2017 at 01:43:21PM +0100, Phil Sutter wrote:
> This adds a description of the icmp and icmpv6 expressions (to match
> various ICMP header fields) as well as the icmp and icmpv6 type types
> (yay) which are used for ICMP(v6) type field.

Also applied. Thanks.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/doc/nft.xml b/doc/nft.xml
index b3e3d9e7ac632..d412184609135 100644
--- a/doc/nft.xml
+++ b/doc/nft.xml
@@ -1504,6 +1504,254 @@  filter input tcp option timestamp exists
 				</programlisting>
 			</example>
 		</refsect2>
+		<refsect2>
+			<title>ICMP Type type</title>
+			<para>
+				<table frame="all">
+					<tgroup cols="4" align="left" colsep="1" rowsep="1">
+						<colspec colname="c1"/>
+						<colspec colname="c2"/>
+						<colspec colname="c3"/>
+						<colspec colname="c4"/>
+						<thead>
+							<row>
+								<entry>Name</entry>
+								<entry>Keyword</entry>
+								<entry>Size</entry>
+								<entry>Base type</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>ICMP Type</entry>
+								<entry>icmp_type</entry>
+								<entry>8 bit</entry>
+								<entry>integer</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+			<para>
+				The ICMP Type type is used to conveniently specify the ICMP header's type field.
+			</para>
+			<para>
+				The following keywords may be used when specifying the ICMP type:
+				<table frame="all">
+					<tgroup cols="2" align="left" colsep="1" rowsep="1">
+						<colspec colname="c1"/>
+						<colspec colname="c2"/>
+						<thead>
+							<row>
+								<entry>Keyword</entry>
+								<entry>Value</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>echo-reply</entry>
+								<entry>0</entry>
+							</row>
+							<row>
+								<entry>destination-unreachable</entry>
+								<entry>3</entry>
+							</row>
+							<row>
+								<entry>source-quench</entry>
+								<entry>4</entry>
+							</row>
+							<row>
+								<entry>redirect</entry>
+								<entry>5</entry>
+							</row>
+							<row>
+								<entry>echo-request</entry>
+								<entry>8</entry>
+							</row>
+							<row>
+								<entry>router-advertisement</entry>
+								<entry>9</entry>
+							</row>
+							<row>
+								<entry>router-solicitation</entry>
+								<entry>10</entry>
+							</row>
+							<row>
+								<entry>time-exceeded</entry>
+								<entry>11</entry>
+							</row>
+							<row>
+								<entry>parameter-problem</entry>
+								<entry>12</entry>
+							</row>
+							<row>
+								<entry>timestamp-request</entry>
+								<entry>13</entry>
+							</row>
+							<row>
+								<entry>timestamp-reply</entry>
+								<entry>14</entry>
+							</row>
+							<row>
+								<entry>info-request</entry>
+								<entry>15</entry>
+							</row>
+							<row>
+								<entry>info-reply</entry>
+								<entry>16</entry>
+							</row>
+							<row>
+								<entry>address-mask-request</entry>
+								<entry>17</entry>
+							</row>
+							<row>
+								<entry>address-mask-reply</entry>
+								<entry>18</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+			<example>
+				<title>ICMP Type specification</title>
+				<programlisting>
+# match ping packets
+filter output icmp type { echo-request, echo-reply }
+				</programlisting>
+			</example>
+		</refsect2>
+		<refsect2>
+			<title>ICMPv6 Type type</title>
+			<para>
+				<table frame="all">
+					<tgroup cols="4" align="left" colsep="1" rowsep="1">
+						<colspec colname="c1"/>
+						<colspec colname="c2"/>
+						<colspec colname="c3"/>
+						<colspec colname="c4"/>
+						<thead>
+							<row>
+								<entry>Name</entry>
+								<entry>Keyword</entry>
+								<entry>Size</entry>
+								<entry>Base type</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>ICMPv6 Type</entry>
+								<entry>icmpv6_type</entry>
+								<entry>8 bit</entry>
+								<entry>integer</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+			<para>
+				The ICMPv6 Type type is used to conveniently specify the ICMPv6 header's type field.
+			</para>
+			<para>
+				The following keywords may be used when specifying the ICMPv6 type:
+				<table frame="all">
+					<tgroup cols="2" align="left" colsep="1" rowsep="1">
+						<colspec colname="c1"/>
+						<colspec colname="c2"/>
+						<thead>
+							<row>
+								<entry>Keyword</entry>
+								<entry>Value</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>destination-unreachable</entry>
+								<entry>1</entry>
+							</row>
+							<row>
+								<entry>packet-too-big</entry>
+								<entry>2</entry>
+							</row>
+							<row>
+								<entry>time-exceeded</entry>
+								<entry>3</entry>
+							</row>
+							<row>
+								<entry>parameter-problem</entry>
+								<entry>4</entry>
+							</row>
+							<row>
+								<entry>echo-request</entry>
+								<entry>128</entry>
+							</row>
+							<row>
+								<entry>echo-reply</entry>
+								<entry>129</entry>
+							</row>
+							<row>
+								<entry>mld-listener-query</entry>
+								<entry>130</entry>
+							</row>
+							<row>
+								<entry>mld-listener-report</entry>
+								<entry>131</entry>
+							</row>
+							<row>
+								<entry>mld-listener-done</entry>
+								<entry>132</entry>
+							</row>
+							<row>
+								<entry>mld-listener-reduction</entry>
+								<entry>132</entry>
+							</row>
+							<row>
+								<entry>nd-router-solicit</entry>
+								<entry>133</entry>
+							</row>
+							<row>
+								<entry>nd-router-advert</entry>
+								<entry>134</entry>
+							</row>
+							<row>
+								<entry>nd-neighbor-solicit</entry>
+								<entry>135</entry>
+							</row>
+							<row>
+								<entry>nd-neighbor-advert</entry>
+								<entry>136</entry>
+							</row>
+							<row>
+								<entry>nd-redirect</entry>
+								<entry>137</entry>
+							</row>
+							<row>
+								<entry>router-renumbering</entry>
+								<entry>138</entry>
+							</row>
+							<row>
+								<entry>ind-neighbor-solicit</entry>
+								<entry>141</entry>
+							</row>
+							<row>
+								<entry>ind-neighbor-advert</entry>
+								<entry>142</entry>
+							</row>
+							<row>
+								<entry>mld2-listener-report</entry>
+								<entry>143</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+			<example>
+				<title>ICMPv6 Type specification</title>
+				<programlisting>
+# match ICMPv6 ping packets
+filter output icmpv6 type { echo-request, echo-reply }
+				</programlisting>
+			</example>
+		</refsect2>
 	</refsect1>
 
 	<refsect1>
@@ -2171,6 +2419,70 @@  inet filter meta nfproto ipv6 output rt nexthop fd00::1
 		</refsect2>
 
 		<refsect2>
+			<title>ICMP header expression</title>
+			<para>
+				<cmdsynopsis>
+					<command>icmp</command>
+					<arg opt="req"><replaceable>ICMP header field</replaceable></arg>
+				</cmdsynopsis>
+			</para>
+			<para>
+				<table frame="all">
+					<title>ICMP header expression</title>
+					<tgroup cols="3" align="left" colsep="1" rowsep="1">
+						<colspec colname="c1"/>
+						<colspec colname="c2"/>
+						<colspec colname="c3"/>
+						<thead>
+							<row>
+								<entry>Keyword</entry>
+								<entry>Description</entry>
+								<entry>Type</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>type</entry>
+								<entry>ICMP type field</entry>
+								<entry>icmp_type</entry>
+							</row>
+							<row>
+								<entry>code</entry>
+								<entry>ICMP code field</entry>
+								<entry>integer (8 bit)</entry>
+							</row>
+							<row>
+								<entry>checksum</entry>
+								<entry>ICMP checksum field</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+							<row>
+								<entry>id</entry>
+								<entry>ID of echo request/response</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+							<row>
+								<entry>sequence</entry>
+								<entry>sequence number of echo request/response</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+							<row>
+								<entry>gateway</entry>
+								<entry>gateway of redirects</entry>
+								<entry>integer (32 bit)</entry>
+							</row>
+							<row>
+								<entry>mtu</entry>
+								<entry>MTU of path MTU discovery</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+		</refsect2>
+
+		<refsect2>
 			<title>IPv6 header expression</title>
 			<para>
 				<cmdsynopsis>
@@ -2245,6 +2557,74 @@  inet filter meta nfproto ipv6 output rt nexthop fd00::1
 		</refsect2>
 
 		<refsect2>
+			<title>ICMPv6 header expression</title>
+			<para>
+				<cmdsynopsis>
+					<command>icmpv6</command>
+					<arg opt="req"><replaceable>ICMPv6 header field</replaceable></arg>
+				</cmdsynopsis>
+			</para>
+			<para>
+				<table frame="all">
+					<title>ICMPv6 header expression</title>
+					<tgroup cols="3" align="left" colsep="1" rowsep="1">
+						<colspec colname="c1"/>
+						<colspec colname="c2"/>
+						<colspec colname="c3"/>
+						<thead>
+							<row>
+								<entry>Keyword</entry>
+								<entry>Description</entry>
+								<entry>Type</entry>
+							</row>
+						</thead>
+						<tbody>
+							<row>
+								<entry>type</entry>
+								<entry>ICMPv6 type field</entry>
+								<entry>icmpv6_type</entry>
+							</row>
+							<row>
+								<entry>code</entry>
+								<entry>ICMPv6 code field</entry>
+								<entry>integer (8 bit)</entry>
+							</row>
+							<row>
+								<entry>checksum</entry>
+								<entry>ICMPv6 checksum field</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+							<row>
+								<entry>parameter-problem</entry>
+								<entry>pointer to problem</entry>
+								<entry>integer (32 bit)</entry>
+							</row>
+							<row>
+								<entry>packet-too-big</entry>
+								<entry>oversized MTU</entry>
+								<entry>integer (32 bit)</entry>
+							</row>
+							<row>
+								<entry>id</entry>
+								<entry>ID of echo request/response</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+							<row>
+								<entry>sequence</entry>
+								<entry>sequence number of echo request/response</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+							<row>
+								<entry>max-delay</entry>
+								<entry>maximum response delay of MLD queries</entry>
+								<entry>integer (16 bit)</entry>
+							</row>
+						</tbody>
+					</tgroup>
+				</table>
+			</para>
+		</refsect2>
+		<refsect2>
 			<title>TCP header expression</title>
 			<para>
 				<cmdsynopsis>