[gentoo-commits] gentoo-x86 commit in net-firewall/nftables/files: nftables.8 nftables-0.099-94300c7.patch

[Tony Vroon (chainsaw)]

chainsaw    14/01/24 16:11:19

  Added:                nftables.8 nftables-0.099-94300c7.patch
  Log:
  Initial commit. Patches & ebuilds by dwfreed, with some minor tweaks by me.
  
  (Portage version: 2.2.8-r1/cvs/Linux x86_64, signed Manifest commit with key 0xB5058F9A)

Revision  Changes    Path
1.1                  net-firewall/nftables/files/nftables.8

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-firewall/nftables/files/nftables.8?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-firewall/nftables/files/nftables.8?rev=1.1&content-type=text/plain

Index: nftables.8
===================================================================
'\" t -*- coding: us-ascii -*-
.if \n(.g .ds T< \\FC
.if \n(.g .ds T> \\F[\n[.fam]]
.de URL
\\$2 \(la\\$1\(ra\\$3
..
.if \n(.g .mso www.tmac
.TH nftables 8 "22 January 2014" "" ""
.SH NAME
nftables \- Administration tool for packet filtering and classification 
.SH SYNOPSIS
'nh
.fi
.ad l
\fBnftables\fR \kx
.if (\nx>(\n(.l/2)) .nr x (\n(.l/5)
'in \n(.iu+\nxu
[
\fB-n/--numeric\fR
] [
\fB-I/--includepath\fR
\fIdirectory\fR
] [
\fB-f/--file\fR
\fIfilename\fR
| 
\fB-i/--interactive\fR
| 
\fIcmd\fR
\&...]
'in \n(.iu-\nxu
.ad b
'hy
'nh
.fi
.ad l
\fBnftables\fR \kx
.if (\nx>(\n(.l/2)) .nr x (\n(.l/5)
'in \n(.iu+\nxu
[
\fB-h/--help\fR
] [
\fB-v/--version\fR
]
'in \n(.iu-\nxu
.ad b
'hy
.SH DESCRIPTION
nftables is used to set up, maintain and inspect packet
filtering and classification rules in the Linux kernel.
.SH OPTIONS
For a full summary of options, run \fBnftables --help\fR.
.TP 
\*(T<\fB\-h/\-\-help\fR\*(T>
Show help message and all options.
.TP 
\*(T<\fB\-v/\-\-version\fR\*(T>
Show version.
.TP 
\*(T<\fB\-n/\-\-numeric\fR\*(T>
Numeric output: IP addresses and other information
that might need network traffic to resolve to symbolic names
are shown numerically.
.TP 
\*(T<\fB\-I/\-\-includepath \fR\*(T>\fIdirectory\fR
Add the directory \fIdirectory\fR to the list of directories to by searched for included files.
.TP 
\*(T<\fB\-f/\-\-file \fR\*(T>\fIfilename\fR
Read input from \fIfilename\fR.
.TP 
\*(T<\fB\-i/\-\-interactive\fR\*(T>
Read input from an interactive readline CLI.
.SH "INPUT FILE FORMAT"
Input is parsed line-wise. When the last character of a line just before
the newline character is a non-quoted backslash (\*(T<\e\*(T>),
the newline is treated as a line continuation.
.PP
A \*(T<#\*(T> begins a comment. All following characters on
the same line are ignored.
.PP
Other files can be included by using
\fBinclude "\fIfilename\fB"\fR.
.SH TABLES
'nh
.fi
.ad l
{add | delete | list | flush} \fBtable\fR [\fIfamily\fR] {\fItable\fR}
.ad b
'hy
.PP
Tables are containers for chains. They are identified by their family
and their name. The family must be one of
\*(T<ip\*(T>, \*(T<ip6\*(T>, \*(T<arp\*(T>, \*(T<bridge\*(T>.
When no family is specified, \*(T<ip\*(T> is used by default.
.TP 
\*(T<\fBadd\fR\*(T>
Add a new table for the given family with the given name.
.TP 
\*(T<\fBdelete\fR\*(T>
Delete the specified table.
.TP 
\*(T<\fBlist\fR\*(T>
List all chains and rules of the specified table.
.TP 
\*(T<\fBflush\fR\*(T>
Flush all chains and rules of the specified table.
.SH CHAINS
'nh
.fi
.ad l
{add} \fBchain\fR [\fIfamily\fR] {\fItable\fR} {\fIchain\fR} {\fIhook\fR} {\fIpriority\fR}
.ad b
'hy
'nh
.fi
.ad l
{add | delete | list | flush} \fBchain\fR [\fIfamily\fR] {\fItable\fR} {\fIchain\fR}
.ad b
'hy
.PP
Chains are containers for rules. They exist in two kinds,
basechains and regular chains. A basecase is an entry point for
packets from the networking stack, a regular chain may be used
as jump target and is used for better rule organization.
.TP 
\*(T<\fBadd\fR\*(T>
Add a new chain in the specified table. When a hook and priority
value are specified, the chain is created as a base chain and hooked
up to the networking stack.
.TP 
\*(T<\fBdelete\fR\*(T>
Delete the specified chain.
.TP 
\*(T<\fBlist\fR\*(T>
List all rules of the specified chain.
.TP 
\*(T<\fBflush\fR\*(T>
Flush all rules of the specified chain.
.SH RULES
'nh
.fi
.ad l
{add | delete} \fBrule\fR [\fIfamily\fR] {\fItable\fR} {\fIchain\fR} [handle \fIhandle\fR] {\fIstatement\fR}\&...
.ad b
'hy
.PP
Rules are constructed from two kinds of components according to a set
of rules: expressions and statements. The lowest order expression is a
primary expression, representing either a constant or a single datum
from a packets payload, meta data or a stateful module. Primary expressions
can be used as arguments to relational expressions (equality,
set membership, ...) to construct match expressions.
.SH "PRIMARY EXPRESSIONS"
.SS "META EXPRESSIONS"
A meta expression refers to meta data associated with a packet.
.PP
\fBMeta expressions\fR
.TS
allbox ;
l | l | l.
T{
Keyword
T}	T{
Description
T}	T{
Type
T}
.T&
l | l | l.
T{
length
T}	T{
Length of the packet in bytes
T}	T{
Numeric (32 bit)
T}
T{
protocol
T}	T{
Ethertype protocol value
T}	T{
ethertype
T}
T{
priority
T}	T{
TC packet priority
T}	T{
Numeric (32 bit)
T}
T{
mark
T}	T{
Packet mark
T}	T{
packetmark
T}
T{
iif
T}	T{
Input interface index
T}	T{
ifindex
T}
T{
iifname
T}	T{
Input interface name
T}	T{
ifname
T}
T{
iiftype
T}	T{
Input interface hardware type
T}	T{
hwtype
T}
T{
oif
T}	T{
Output interface index
T}	T{
ifindex
T}
T{
oifname
T}	T{
Output interface name
T}	T{
ifname
T}
T{
oiftype
T}	T{
Output interface hardware type
T}	T{
hwtype
T}
T{
skuid
T}	T{
UID associated with originating socket
T}	T{
uid
T}
T{
skgid
T}	T{
GID associated with originating socket
T}	T{
gid
T}
T{
rtclassid
T}	T{
Routing realm
T}	T{
realm
T}
.TE
.PP
\fBMeta expression specific types\fR
.TS
allbox ;
l | l.
T{
Type
T}	T{
Description
T}
.T&
l | l.
T{
ifindex
T}	T{
Interface index (32 bit number). Can be specified numerically
or as name of an existing interface.
T}
T{
ifname
T}	T{
Interface name (16 byte string). Does not have to exist.
T}
T{
uid
T}	T{
User ID (32 bit number). Can be specified numerically or as
user name.
T}
T{
gid
T}	T{
Group ID (32 bit number). Can be specified numerically or as
group name.
T}
T{
realm
T}	T{
Routing Realm (32 bit number). Can be specified numerically
or as symbolic name defined in /etc/iproute2/rt_realms.
T}
.TE
.SS "PAYLOAD EXPRESSIONS"
\fBEthernet header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l
l | l
l | l.
T{
daddr
T}	T{
Destination address
T}
T{
saddr
T}	T{
Source address
T}
T{
type
T}	T{
EtherType
T}
.TE
.PP
\fBVLAN header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
id
T}	T{
VLAN ID (VID)
T}
T{
cfi
T}	T{
Canonical Format Indicator
T}
T{
pcp
T}	T{
Priority code point
T}
T{
type
T}	T{
EtherType
T}
.TE
.PP
\fBARP header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
htype
T}	T{
ARP hardware type
T}
T{
ptype
T}	T{
EtherType
T}
T{
hlen
T}	T{
Hardware address len
T}
T{
plen
T}	T{
Protocol address len
T}
T{
op
T}	T{
Operation
T}
.TE
.PP
\fBIPv4 header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
version
T}	T{
IP header version (4)
T}
T{
hdrlength
T}	T{
IP header length including options
T}
T{
tos
T}	T{
Type Of Service
T}
T{
length
T}	T{
Total packet length
T}
T{
id
T}	T{
IP ID
T}
T{
frag-off
T}	T{
Fragment offset
T}
T{
ttl
T}	T{
Time to live
T}
T{
protocol
T}	T{
Upper layer protocol
T}
T{
checksum
T}	T{
IP header checksum
T}
T{
saddr
T}	T{
Source address
T}
T{
daddr
T}	T{
Destination address
T}
.TE
.PP
\fBIPv6 header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
version
T}	T{
IP header version (6)
T}
T{
priority
T}	T{
T}
T{
flowlabel
T}	T{
T}
T{
length
T}	T{
T}
T{
nexthdr
T}	T{
Nexthdr protocol
T}
T{
hoplimit
T}	T{
T}
T{
saddr
T}	T{
Source address
T}
T{
daddr
T}	T{
Destination address
T}
.TE
.PP
\fBSCTP header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
sport
T}	T{
Source port
T}
T{
dport
T}	T{
Destination port
T}
T{
vtag
T}	T{
Verfication Tag
T}
T{
checksum
T}	T{
Checksum
T}
.TE
.PP
\fBDCCP header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l
l | l.
T{
sport
T}	T{
Source port
T}
T{
dport
T}	T{
Destination port
T}
.TE
.PP
\fBTCP header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
sport
T}	T{
Source port
T}
T{
dport
T}	T{
Destination port
T}
T{
sequence
T}	T{
Sequence number
T}
T{
ackseq
T}	T{
Acknowledgement number
T}
T{
doff
T}	T{
Data offset
T}
T{
reserved
T}	T{
Reserved area
T}
T{
flags
T}	T{
TCP flags
T}
T{
window
T}	T{
Window
T}
T{
checksum
T}	T{
Checksum
T}
T{
urgptr
T}	T{
Urgent pointer
T}
.TE
.PP
\fBUDP header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
sport
T}	T{
Source port
T}
T{
dport
T}	T{
Destination port
T}
T{
length
T}	T{
Total packet length
T}
T{
checksum
T}	T{
Checksum
T}
.TE
.PP
\fBUDP-Lite header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
sport
T}	T{
Source port
T}
T{
dport
T}	T{
Destination port
T}
T{
cscov
T}	T{
Checksum coverage
T}
T{
checksum
T}	T{
Checksum
T}
.TE
.PP
\fBAH header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l.
T{
nexthdr
T}	T{
Next header protocol
T}
T{
hdrlength
T}	T{
AH Header length
T}
T{
reserved
T}	T{
Reserved area
T}
T{
spi
T}	T{
Security Parameter Index
T}
T{
sequence
T}	T{
Sequence number
T}
.TE
.PP
\fBESP header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l
l | l.
T{
spi
T}	T{
Security Parameter Index
T}
T{
sequence
T}	T{
Sequence number
T}
.TE
.PP
\fBIPComp header expression\fR
.TS
allbox ;
l | l.
T{
Keyword
T}	T{
Description
T}
.T&
l | l
l | l
l | l.
T{
nexthdr
T}	T{
Next header protocol
T}
T{
flags
T}	T{
Flags
T}
T{
cfi
T}	T{
Compression Parameter Index
T}
.TE
.SH "EXIT STATUS"
On success, nftables exits with a status of 0. Unspecified
errors cause it to exit with a status of 1, memory allocation
errors with a status of 2.
.SH "SEE ALSO"
iptables(8), ip6tables(8), arptables(8), ebtables(8), ip(8), tc(8)
.SH AUTHORS
nftables was written by Patrick McHardy.
.SH COPYRIGHT
Copyright \(co 2008 Patrick McHardy <\*(T<kaber@×××××.net\*(T>>
.PP
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License version 2 as
published by the Free Software Foundation.



1.1                  net-firewall/nftables/files/nftables-0.099-94300c7.patch

file : http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-firewall/nftables/files/nftables-0.099-94300c7.patch?rev=1.1&view=markup
plain: http://sources.gentoo.org/viewvc.cgi/gentoo-x86/net-firewall/nftables/files/nftables-0.099-94300c7.patch?rev=1.1&content-type=text/plain

Index: nftables-0.099-94300c7.patch
===================================================================
From 94300c75fc3e113009e68e2ab9db91c31e99e9f4 Mon Sep 17 00:00:00 2001
From: Pablo Neira Ayuso <pablo@×××××××××.org>
Date: Mon, 20 Jan 2014 14:02:50 +0000
Subject: build: use libnftnl instead of libnftables in configure.in

Signed-off-by: Pablo Neira Ayuso <pablo@×××××××××.org>
---
diff --git a/configure.ac b/configure.ac
index b38295f..9f0d894 100644
--- a/configure.ac
+++ b/configure.ac
@@ -53,7 +53,7 @@ fi
 AC_CHECK_LIB([mnl], [mnl_socket_open], ,
 	     AC_MSG_ERROR([No suitable version of libmnl found]))
 
-AC_CHECK_LIB([nftables], [nft_rule_alloc], ,
+AC_CHECK_LIB([nftnl], [nft_rule_alloc], ,
 	     AC_MSG_ERROR([No suitable version of libnftnl found]))
 
 AC_CHECK_LIB([gmp], [__gmpz_init], ,
--
cgit v0.9.2