117243aa02
Обновление снапшота с v0.0.0-20250811.0 на пин, которого требует sing-box после мержа 235 коммитов (upstream d620bbbf2 "Update gvisor to 20260727.0"). Прежний снапшот был взят 2026-08-04 ровно с той версии, на которой тогда стоял апстрим; разрыв возник 2026-08-05 вместе с его бампом. За год апстрим-gvisor изменил ~14 000 строк в 292 файлах. Значимое для нас — сетевой стек: tcp/connect.go (PMTU-discovery + исправление начального RTT/RTO: раньше задержка ACK внутри стека завышала стартовый таймаут на несколько RTT), tcp/snd.go, tcp/rcv.go, stack/conntrack.go, stack/packet_buffer.go. Всего 30 файлов в TCP и 37 в stack. Баг SPEC 048 апстрим НЕ исправил — проверено по коду новой версии: handleConnecting по-прежнему проверяет состояние endpoint'а, но не ep.h, а performHandshake так же зануляет h и отпускает мьютекс до Close(). Поэтому guard перенесён (12 строк) вместе со своим тестом (45 строк). Red/green проверен на новой базе: без guard'а тест падает с той же nil-паникой, что в полевом крашдампе; с ним зелёный.
827 lines
25 KiB
Go
827 lines
25 KiB
Go
// Copyright 2024 The gVisor Authors.
|
|
//
|
|
// Licensed under the Apache License, Version 2.0 (the "License");
|
|
// you may not use this file except in compliance with the License.
|
|
// You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing, software
|
|
// distributed under the License is distributed on an "AS IS" BASIS,
|
|
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
// See the License for the specific language governing permissions and
|
|
// limitations under the License.
|
|
|
|
package linux
|
|
|
|
// This file contains constants required to support nf_tables.
|
|
|
|
const NFT_MAX_HOOKS = NF_INET_NUMHOOKS + 1
|
|
|
|
// Name length constants for nf_table structures. These correspond to values in
|
|
// include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_NAME_MAXLEN = 256
|
|
NFT_TABLE_MAXNAMELEN = NFT_NAME_MAXLEN
|
|
NFT_CHAIN_MAXNAMELEN = NFT_NAME_MAXLEN
|
|
NFT_SET_MAXNAMELEN = NFT_NAME_MAXLEN
|
|
NFT_OBJ_MAXNAMELEN = NFT_NAME_MAXLEN
|
|
NFT_USERDATA_MAXLEN = 256
|
|
NFT_OSF_MAXGENRELEN = 16
|
|
NFT_SET_EXPR_MAX = 2
|
|
)
|
|
|
|
// 16-byte Registers that can be used to maintain state for rules.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_REG_VERDICT = iota
|
|
NFT_REG_1
|
|
NFT_REG_2
|
|
NFT_REG_3
|
|
NFT_REG_4
|
|
__NFT_REG_MAX
|
|
)
|
|
|
|
// 4-byte Registers that can be used to maintain state for rules.
|
|
// Note that these overlap with the 16-byte registers in memory.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_REG32_00 = 8 + iota
|
|
NFT_REG32_01
|
|
NFT_REG32_02
|
|
NFT_REG32_03
|
|
NFT_REG32_04
|
|
NFT_REG32_05
|
|
NFT_REG32_06
|
|
NFT_REG32_07
|
|
NFT_REG32_08
|
|
NFT_REG32_09
|
|
NFT_REG32_10
|
|
NFT_REG32_11
|
|
NFT_REG32_12
|
|
NFT_REG32_13
|
|
NFT_REG32_14
|
|
NFT_REG32_15
|
|
)
|
|
|
|
// Other register constants, corresponding to values in
|
|
// include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_REG_MAX = __NFT_REG_MAX - 1 // Maximum register value
|
|
NFT_REG_SIZE = 16 // Size of NFT_REG
|
|
NFT_REG32_SIZE = 4 // Size of NFT_REG32
|
|
NFT_REG32_COUNT = NFT_REG32_15 - NFT_REG32_00 + 1 // Count of 4-byte registers
|
|
)
|
|
|
|
// Internal nf table verdicts. These are used for ruleset evaluation and
|
|
// are not returned to userspace.
|
|
//
|
|
// These also share their numeric name space with the netfilter verdicts. When
|
|
// used these values are converted to uint32 (purposefully overflowing the int).
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
// Continue evaluation of the current rule.
|
|
NFT_CONTINUE int32 = -1
|
|
|
|
// Terminate evaluation of the current rule.
|
|
NFT_BREAK int32 = -2
|
|
|
|
// Push the current chain on the jump stack and jump to a chain.
|
|
NFT_JUMP int32 = -3
|
|
|
|
// Jump to a chain without pushing the current chain on the jump stack.
|
|
NFT_GOTO int32 = -4
|
|
|
|
// Return to the topmost chain on the jump stack.
|
|
NFT_RETURN int32 = -5
|
|
)
|
|
|
|
// NfTableMsgType values map to operations within the nftables api.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
type NfTableMsgType uint16
|
|
|
|
// Netlink Netfilter table message types.
|
|
const (
|
|
NFT_MSG_NEWTABLE NfTableMsgType = iota
|
|
NFT_MSG_GETTABLE
|
|
NFT_MSG_DELTABLE
|
|
NFT_MSG_NEWCHAIN
|
|
NFT_MSG_GETCHAIN
|
|
NFT_MSG_DELCHAIN
|
|
NFT_MSG_NEWRULE
|
|
NFT_MSG_GETRULE
|
|
NFT_MSG_DELRULE
|
|
NFT_MSG_NEWSET
|
|
NFT_MSG_GETSET
|
|
NFT_MSG_DELSET
|
|
NFT_MSG_NEWSETELEM
|
|
NFT_MSG_GETSETELEM
|
|
NFT_MSG_DELSETELEM
|
|
NFT_MSG_NEWGEN
|
|
NFT_MSG_GETGEN
|
|
NFT_MSG_TRACE
|
|
NFT_MSG_NEWOBJ
|
|
NFT_MSG_GETOBJ
|
|
NFT_MSG_DELOBJ
|
|
NFT_MSG_GETOBJ_RESET
|
|
NFT_MSG_NEWFLOWTABLE
|
|
NFT_MSG_GETFLOWTABLE
|
|
NFT_MSG_DELFLOWTABLE
|
|
NFT_MSG_GETRULE_RESET
|
|
NFT_MSG_DESTROYTABLE
|
|
NFT_MSG_DESTROYCHAIN
|
|
NFT_MSG_DESTROYRULE
|
|
NFT_MSG_DESTROYSET
|
|
NFT_MSG_DESTROYSETELEM
|
|
NFT_MSG_DESTROYOBJ
|
|
NFT_MSG_DESTROYFLOWTABLE
|
|
NFT_MSG_GETSETELEM_RESET
|
|
NFT_MSG_MAX
|
|
)
|
|
|
|
var nfTableMsgTypeStrings = [...]string{
|
|
NFT_MSG_NEWTABLE: "NFT_MSG_NEWTABLE",
|
|
NFT_MSG_GETTABLE: "NFT_MSG_GETTABLE",
|
|
NFT_MSG_DELTABLE: "NFT_MSG_DELTABLE",
|
|
NFT_MSG_NEWCHAIN: "NFT_MSG_NEWCHAIN",
|
|
NFT_MSG_GETCHAIN: "NFT_MSG_GETCHAIN",
|
|
NFT_MSG_DELCHAIN: "NFT_MSG_DELCHAIN",
|
|
NFT_MSG_NEWRULE: "NFT_MSG_NEWRULE",
|
|
NFT_MSG_GETRULE: "NFT_MSG_GETRULE",
|
|
NFT_MSG_DELRULE: "NFT_MSG_DELRULE",
|
|
NFT_MSG_NEWSET: "NFT_MSG_NEWSET",
|
|
NFT_MSG_GETSET: "NFT_MSG_GETSET",
|
|
NFT_MSG_DELSET: "NFT_MSG_DELSET",
|
|
NFT_MSG_NEWSETELEM: "NFT_MSG_NEWSETELEM",
|
|
NFT_MSG_GETSETELEM: "NFT_MSG_GETSETELEM",
|
|
NFT_MSG_DELSETELEM: "NFT_MSG_DELSETELEM",
|
|
NFT_MSG_NEWGEN: "NFT_MSG_NEWGEN",
|
|
NFT_MSG_GETGEN: "NFT_MSG_GETGEN",
|
|
NFT_MSG_TRACE: "NFT_MSG_TRACE",
|
|
NFT_MSG_NEWOBJ: "NFT_MSG_NEWOBJ",
|
|
NFT_MSG_GETOBJ: "NFT_MSG_GETOBJ",
|
|
NFT_MSG_DELOBJ: "NFT_MSG_DELOBJ",
|
|
NFT_MSG_GETOBJ_RESET: "NFT_MSG_GETOBJ_RESET",
|
|
NFT_MSG_NEWFLOWTABLE: "NFT_MSG_NEWFLOWTABLE",
|
|
NFT_MSG_GETFLOWTABLE: "NFT_MSG_GETFLOWTABLE",
|
|
NFT_MSG_DELFLOWTABLE: "NFT_MSG_DELFLOWTABLE",
|
|
NFT_MSG_GETRULE_RESET: "NFT_MSG_GETRULE_RESET",
|
|
NFT_MSG_DESTROYTABLE: "NFT_MSG_DESTROYTABLE",
|
|
NFT_MSG_DESTROYCHAIN: "NFT_MSG_DESTROYCHAIN",
|
|
NFT_MSG_DESTROYRULE: "NFT_MSG_DESTROYRULE",
|
|
NFT_MSG_DESTROYSET: "NFT_MSG_DESTROYSET",
|
|
NFT_MSG_DESTROYSETELEM: "NFT_MSG_DESTROYSETELEM",
|
|
NFT_MSG_DESTROYOBJ: "NFT_MSG_DESTROYOBJ",
|
|
NFT_MSG_DESTROYFLOWTABLE: "NFT_MSG_DESTROYFLOWTABLE",
|
|
NFT_MSG_GETSETELEM_RESET: "NFT_MSG_GETSETELEM_RESET",
|
|
NFT_MSG_MAX: "NFT_MSG_MAX",
|
|
}
|
|
|
|
// String returns the string representation of the NfTableMsgType.
|
|
func (msg NfTableMsgType) String() string {
|
|
if int(msg) < len(nfTableMsgTypeStrings) {
|
|
return nfTableMsgTypeStrings[msg]
|
|
}
|
|
return "UNKNOWN"
|
|
}
|
|
|
|
// NfTableListAttributes represents the netfilter attributes for lists of data.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_LIST_UNSPEC uint16 = iota
|
|
NFTA_LIST_ELEM
|
|
__NFTA_LIST_MAX
|
|
NFTA_LIST_MAX = __NFTA_LIST_MAX - 1
|
|
)
|
|
|
|
// NfTableHookAttributes represents the netfilter hook attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_HOOK_UNSPEC uint16 = iota
|
|
NFTA_HOOK_HOOKNUM
|
|
NFTA_HOOK_PRIORITY
|
|
NFTA_HOOK_DEV
|
|
NFTA_HOOK_DEVS
|
|
__NFTA_HOOK_MAX
|
|
NFTA_HOOK_MAX = __NFTA_HOOK_MAX - 1
|
|
)
|
|
|
|
// NfTableFlags represents table flags that can be set for a table, namely dormant.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_TABLE_F_DORMANT uint32 = 0x1
|
|
NFT_TABLE_F_OWNER = 0x2
|
|
NFT_TABLE_F_PERSIST = 0x4
|
|
NFT_TABLE_F_MASK = NFT_TABLE_F_DORMANT | NFT_TABLE_F_OWNER | NFT_TABLE_F_PERSIST
|
|
)
|
|
|
|
// NfTableAttributes represents the netfilter table attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_TABLE_UNSPEC uint16 = iota
|
|
NFTA_TABLE_NAME
|
|
NFTA_TABLE_FLAGS
|
|
NFTA_TABLE_USE
|
|
NFTA_TABLE_HANDLE
|
|
NFTA_TABLE_PAD
|
|
NFTA_TABLE_USERDATA
|
|
NFTA_TABLE_OWNER
|
|
__NFTA_TABLE_MAX
|
|
)
|
|
|
|
// NFTA_TABLE_MAX is the maximum netfilter table attribute.
|
|
const NFTA_TABLE_MAX = __NFTA_TABLE_MAX - 1
|
|
|
|
// NfTableChainFlags represents chain flags that can be set for a chain.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_CHAIN_BASE uint32 = (1 << 0)
|
|
NFT_CHAIN_HW_OFFLOAD = (1 << 1)
|
|
NFT_CHAIN_BINDING = (1 << 2)
|
|
NFT_CHAIN_FLAGS = (NFT_CHAIN_BASE | NFT_CHAIN_HW_OFFLOAD | NFT_CHAIN_BINDING)
|
|
)
|
|
|
|
// NfTableChainAttributes represents the netfilter chain attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_CHAIN_UNSPEC uint16 = iota
|
|
NFTA_CHAIN_TABLE
|
|
NFTA_CHAIN_HANDLE
|
|
NFTA_CHAIN_NAME
|
|
NFTA_CHAIN_HOOK
|
|
NFTA_CHAIN_POLICY
|
|
NFTA_CHAIN_USE
|
|
NFTA_CHAIN_TYPE
|
|
NFTA_CHAIN_COUNTERS
|
|
NFTA_CHAIN_PAD
|
|
NFTA_CHAIN_FLAGS
|
|
NFTA_CHAIN_ID
|
|
NFTA_CHAIN_USERDATA
|
|
__NFTA_CHAIN_MAX
|
|
NFTA_CHAIN_MAX = __NFTA_CHAIN_MAX - 1
|
|
)
|
|
|
|
// NfTableRuleAttributes represents the netfilter rule attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_RULE_UNSPEC uint16 = iota
|
|
NFTA_RULE_TABLE
|
|
NFTA_RULE_CHAIN
|
|
NFTA_RULE_HANDLE
|
|
NFTA_RULE_EXPRESSIONS
|
|
NFTA_RULE_COMPAT
|
|
NFTA_RULE_POSITION
|
|
NFTA_RULE_USERDATA
|
|
NFTA_RULE_PAD
|
|
NFTA_RULE_ID
|
|
NFTA_RULE_POSITION_ID
|
|
NFTA_RULE_CHAIN_ID
|
|
__NFTA_RULE_MAX
|
|
NFTA_RULE_MAX = __NFTA_RULE_MAX - 1
|
|
)
|
|
|
|
// NfTableDataTypes represents the netfilter data types.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_DATA_VALUE = iota
|
|
NFT_DATA_VERDICT = 0xffffff00
|
|
)
|
|
|
|
// NfTableDataReservedMask represents the netfilter data reserved mask for internally used types.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_DATA_RESERVED_MASK = 0xffffff00
|
|
)
|
|
|
|
// NfTableDataAttributes represents the netfilter data attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_DATA_UNSPEC uint16 = iota
|
|
NFTA_DATA_VALUE
|
|
NFTA_DATA_VERDICT
|
|
__NFTA_DATA_MAX
|
|
NFTA_DATA_MAX = __NFTA_DATA_MAX - 1
|
|
)
|
|
|
|
// NFT_DATA_VALUE_MAXLEN is the maximum length of a netfilter data value.
|
|
const NFT_DATA_VALUE_MAXLEN = 64
|
|
|
|
// NfTableVerdictAttributes represents the netfilter verdict attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_VERDICT_UNSPEC uint16 = iota
|
|
NFTA_VERDICT_CODE
|
|
NFTA_VERDICT_CHAIN
|
|
NFTA_VERDICT_CHAIN_ID
|
|
__NFTA_VERDICT_MAX
|
|
NFTA_VERDICT_MAX = __NFTA_VERDICT_MAX - 1
|
|
)
|
|
|
|
// NfTableExprAttributes represents the netfilter expression attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_EXPR_UNSPEC uint16 = iota
|
|
NFTA_EXPR_NAME
|
|
NFTA_EXPR_DATA
|
|
__NFTA_EXPR_MAX
|
|
NFTA_EXPR_MAX = __NFTA_EXPR_MAX - 1
|
|
)
|
|
|
|
// NfTableImmediateAttributes represents the netfilter immediate attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_IMMEDIATE_UNSPEC uint16 = iota
|
|
NFTA_IMMEDIATE_DREG
|
|
NFTA_IMMEDIATE_DATA
|
|
__NFTA_IMMEDIATE_MAX
|
|
NFTA_IMMEDIATE_MAX = __NFTA_IMMEDIATE_MAX - 1
|
|
)
|
|
|
|
// NfTablePayloadAttributes represents the netfilter payload attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_PAYLOAD_UNSPEC uint16 = iota
|
|
NFTA_PAYLOAD_DREG
|
|
NFTA_PAYLOAD_BASE
|
|
NFTA_PAYLOAD_OFFSET
|
|
NFTA_PAYLOAD_LEN
|
|
NFTA_PAYLOAD_SREG
|
|
NFTA_PAYLOAD_CSUM_TYPE
|
|
NFTA_PAYLOAD_CSUM_OFFSET
|
|
NFTA_PAYLOAD_CSUM_FLAGS
|
|
__NFTA_PAYLOAD_MAX
|
|
NFTA_PAYLOAD_MAX = __NFTA_PAYLOAD_MAX - 1
|
|
)
|
|
|
|
// Nf table relational operators.
|
|
// Used by the nft comparison operation to compare values in registers.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_CMP_EQ = iota // equal
|
|
NFT_CMP_NEQ // not equal
|
|
NFT_CMP_LT // less than
|
|
NFT_CMP_LTE // less than or equal to
|
|
NFT_CMP_GT // greater than
|
|
NFT_CMP_GTE // greater than or equal to
|
|
)
|
|
|
|
// Nf table cmp expression netlink attributes.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_CMP_UNSPEC uint16 = iota
|
|
NFTA_CMP_SREG
|
|
NFTA_CMP_OP
|
|
NFTA_CMP_DATA
|
|
__NFTA_CMP_MAX
|
|
NFTA_CMP_MAX = __NFTA_CMP_MAX - 1
|
|
)
|
|
|
|
// Nf table range operators.
|
|
// Used by the nft range operation to compare values in registers.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_RANGE_EQ = iota
|
|
NFT_RANGE_NEQ
|
|
)
|
|
|
|
// Nf table payload expression offset bases.
|
|
// Used by the nft payload operations to access appropriate data in the packet.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_PAYLOAD_LL_HEADER = iota // link layer header
|
|
NFT_PAYLOAD_NETWORK_HEADER // network header
|
|
NFT_PAYLOAD_TRANSPORT_HEADER // transport header
|
|
NFT_PAYLOAD_INNER_HEADER // inner header / payload
|
|
NFT_PAYLOAD_TUN_HEADER // tunneling protocol header
|
|
)
|
|
|
|
// Nf table payload expression checksum types.
|
|
// Used by the nft payload set operation to mark the type of checksum to use.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_PAYLOAD_CSUM_NONE = iota // no checksumming
|
|
NFT_PAYLOAD_CSUM_INET // internet checksum (RFC 791)
|
|
NFT_PAYLOAD_CSUM_SCTP // CRC-32c, for use in SCTP header (RFC 3309)
|
|
)
|
|
|
|
// Nf table payload expression checksum flags.
|
|
// Used by the nft payload set operation to mark the flags for checksumming.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0) // use pseudoheader for L4 checksum
|
|
)
|
|
|
|
// Nf table bitwise operators.
|
|
// Used by the nft bitwise operation to perform bitwise math over register data.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_BITWISE_BOOL = iota // mask-and-xor operation for NOT, AND, OR, & XOR
|
|
NFT_BITWISE_LSHIFT // left-shift operation
|
|
NFT_BITWISE_RSHIFT // right-shift operation
|
|
)
|
|
|
|
// Nf table bitwise expression netlink attributes.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_BITWISE_UNSPEC uint16 = iota
|
|
NFTA_BITWISE_SREG
|
|
NFTA_BITWISE_DREG
|
|
NFTA_BITWISE_LEN
|
|
NFTA_BITWISE_MASK
|
|
NFTA_BITWISE_XOR
|
|
NFTA_BITWISE_OP
|
|
NFTA_BITWISE_DATA
|
|
__NFTA_BITWISE_MAX
|
|
NFTA_BITWISE_MAX = __NFTA_BITWISE_MAX - 1
|
|
)
|
|
|
|
// Nf table route expression keys.
|
|
// Used by the nft route operation to determine the routing data to retrieve.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
// Traffic Class Identifier (Realm) associated with route
|
|
NFT_RT_CLASSID = iota
|
|
|
|
// Routing nexthop for IPv4 (next IPv4 address to jump to)
|
|
NFT_RT_NEXTHOP4
|
|
|
|
// Routing nexthop for IPv6 (next IPv6 address to jump to)
|
|
NFT_RT_NEXTHOP6
|
|
|
|
// Maximum Segment Size for TCP connections (largest size for a single packet)
|
|
NFT_RT_TCPMSS
|
|
|
|
// Bool for whether packet route involves a IPsec transform st xfrm is applied
|
|
NFT_RT_XFRM
|
|
)
|
|
|
|
// Nf table byteorder operators.
|
|
// Used by the nft byteorder operation to convert data in a register to a
|
|
// specific byte order.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_BYTEORDER_NTOH = iota // network to host operator
|
|
NFT_BYTEORDER_HTON // host to network operator
|
|
)
|
|
|
|
// Nf tables meta expression keys.
|
|
// Used by the nft meta operation to retrieve meta data from the packet.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_META_LEN = iota // Packet length
|
|
NFT_META_PROTOCOL // Packet ethertype protocol, invalid in OUTPUT
|
|
NFT_META_PRIORITY // Packet priority
|
|
NFT_META_MARK // Packet mark
|
|
NFT_META_IIF // Packet input interface index
|
|
NFT_META_OIF // Packet output interface index
|
|
NFT_META_IIFNAME // Packet input interface name
|
|
NFT_META_OIFNAME // Packet output interface name
|
|
NFT_META_IIFTYPE // Packet input interface type
|
|
NFT_META_OIFTYPE // Packet output interface type
|
|
NFT_META_SKUID // Originating socket UID
|
|
NFT_META_SKGID // Originating socket GID
|
|
NFT_META_NFTRACE // Packet nftrace bit
|
|
NFT_META_RTCLASSID // Realm value of packet's route
|
|
NFT_META_SECMARK // Packet secmark
|
|
NFT_META_NFPROTO // Netfilter protocol
|
|
NFT_META_L4PROTO // Layer 4 protocol number
|
|
NFT_META_BRI_IIFNAME // Packet input bridge interface name
|
|
NFT_META_BRI_OIFNAME // Packet output bridge interface name
|
|
NFT_META_PKTTYPE // Packet type, special handling for loopback
|
|
NFT_META_CPU // CPU id through smp_processor_id()
|
|
NFT_META_IIFGROUP // Packet input interface group
|
|
NFT_META_OIFGROUP // Packet output interface group
|
|
NFT_META_CGROUP // Socket control group
|
|
NFT_META_PRANDOM // A 32bit pseudo-random number
|
|
NFT_META_SECPATH // Boolean, secpath_exists
|
|
NFT_META_IIFKIND // Packet input interface kind name
|
|
NFT_META_OIFKIND // Packet output interface kind name
|
|
NFT_META_BRI_IIFPVID // Packet input bridge port pvid
|
|
NFT_META_BRI_IIFVPROTO // Packet input bridge vlan proto
|
|
NFT_META_TIME_NS // Time since epoch (in nanoseconds)
|
|
NFT_META_TIME_DAY // Day of week (from 0 = Sunday to 6 = Saturday)
|
|
NFT_META_TIME_HOUR // Hour of day (in sec), secs since start of day
|
|
NFT_META_SDIF // Slave device interface index
|
|
NFT_META_SDIFNAME // Slave device interface name
|
|
NFT_META_BRI_BROUTE // Packet br_netfilter_broute bit
|
|
)
|
|
|
|
// Nf table meta expression netlink attributes
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_META_UNSPEC = iota
|
|
NFTA_META_DREG
|
|
NFTA_META_KEY
|
|
NFTA_META_SREG
|
|
__NFTA_META_MAX
|
|
NFTA_META_MAX = __NFTA_META_MAX - 1
|
|
)
|
|
|
|
// Nf table counter expression netlink attributes.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_COUNTER_UNSPEC = iota
|
|
NFTA_COUNTER_BYTES
|
|
NFTA_COUNTER_PACKETS
|
|
NFTA_COUNTER_PAD
|
|
__NFTA_COUNTER_MAX
|
|
NFTA_COUNTER_MAX = __NFTA_COUNTER_MAX - 1
|
|
)
|
|
|
|
// Nftables Generation Attributes
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_GEN_UNSPEC uint16 = iota
|
|
NFTA_GEN_ID
|
|
NFTA_GEN_PROC_PID
|
|
NFTA_GEN_PROC_NAME
|
|
__NFTA_GEN_MAX
|
|
NFTA_GEN_MAX = __NFTA_GEN_MAX - 1
|
|
)
|
|
|
|
// Nf table nat expression netlink attributes.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_NAT_UNSPEC uint16 = iota
|
|
NFTA_NAT_TYPE
|
|
NFTA_NAT_FAMILY
|
|
NFTA_NAT_REG_ADDR_MIN
|
|
NFTA_NAT_REG_ADDR_MAX
|
|
NFTA_NAT_REG_PROTO_MIN
|
|
NFTA_NAT_REG_PROTO_MAX
|
|
NFTA_NAT_FLAGS
|
|
__NFTA_NAT_MAX
|
|
NFTA_NAT_MAX = __NFTA_NAT_MAX - 1
|
|
)
|
|
|
|
// NfTableSetFlags represents the netfilter set flags.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_SET_ANONYMOUS = uint16(0x1)
|
|
NFT_SET_CONSTANT = uint16(0x2)
|
|
NFT_SET_INTERVAL = uint16(0x4)
|
|
NFT_SET_MAP = uint16(0x8)
|
|
NFT_SET_TIMEOUT = uint16(0x10)
|
|
NFT_SET_EVAL = uint16(0x20)
|
|
NFT_SET_OBJECT = uint16(0x40)
|
|
NFT_SET_CONCAT = uint16(0x80)
|
|
NFT_SET_EXPR = uint16(0x100)
|
|
)
|
|
|
|
// NfTableSetAttributes represents the netfilter set attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_SET_UNSPEC uint16 = iota
|
|
NFTA_SET_TABLE
|
|
NFTA_SET_NAME
|
|
NFTA_SET_FLAGS
|
|
NFTA_SET_KEY_TYPE
|
|
NFTA_SET_KEY_LEN
|
|
NFTA_SET_DATA_TYPE
|
|
NFTA_SET_DATA_LEN
|
|
NFTA_SET_POLICY
|
|
NFTA_SET_DESC
|
|
NFTA_SET_ID
|
|
NFTA_SET_TIMEOUT
|
|
NFTA_SET_GC_INTERVAL
|
|
NFTA_SET_USERDATA
|
|
NFTA_SET_PAD
|
|
NFTA_SET_OBJ_TYPE
|
|
NFTA_SET_HANDLE
|
|
NFTA_SET_EXPR
|
|
NFTA_SET_EXPRESSIONS
|
|
__NFTA_SET_MAX
|
|
NFTA_SET_MAX = __NFTA_SET_MAX - 1
|
|
)
|
|
|
|
// NfTableSetPolicies represents the netfilter set policies.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_SET_POL_PERFORMANCE uint32 = iota // prefer high performance over low memory use
|
|
NFT_SET_POL_MEMORY // prefer low memory use over high performance
|
|
)
|
|
|
|
// NfTableSetDescAttributes represents the netfilter set description attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_SET_DESC_UNSPEC uint16 = iota
|
|
NFTA_SET_DESC_SIZE
|
|
NFTA_SET_DESC_CONCAT
|
|
__NFTA_SET_DESC_MAX
|
|
NFTA_SET_DESC_MAX = __NFTA_SET_DESC_MAX - 1
|
|
)
|
|
|
|
// NfTableSetFieldAttributes represents the netfilter set field attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_SET_FIELD_UNSPEC uint16 = iota
|
|
NFTA_SET_FIELD_LEN
|
|
__NFTA_SET_FIELD_MAX
|
|
NFTA_SET_FIELD_MAX = __NFTA_SET_FIELD_MAX - 1
|
|
)
|
|
|
|
// NfTableObjectAttributes represents the netfilter object attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_OBJECT_UNSPEC uint32 = iota
|
|
NFT_OBJECT_COUNTER
|
|
NFT_OBJECT_QUOTA
|
|
NFT_OBJECT_CT_HELPER
|
|
NFT_OBJECT_LIMIT
|
|
NFT_OBJECT_CONNLIMIT
|
|
NFT_OBJECT_TUNNEL
|
|
NFT_OBJECT_CT_TIMEOUT
|
|
NFT_OBJECT_SECMARK
|
|
NFT_OBJECT_CT_EXPECT
|
|
NFT_OBJECT_SYNPROXY
|
|
__NFT_OBJECT_MAX
|
|
NFT_OBJECT_MAX = __NFT_OBJECT_MAX - 1
|
|
)
|
|
|
|
// NfTableSetElemListAttributes represents the netfilter set element list attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_SET_ELEM_LIST_UNSPEC uint16 = iota
|
|
NFTA_SET_ELEM_LIST_TABLE
|
|
NFTA_SET_ELEM_LIST_SET
|
|
NFTA_SET_ELEM_LIST_ELEMENTS
|
|
NFTA_SET_ELEM_LIST_SET_ID
|
|
__NFTA_SET_ELEM_LIST_MAX
|
|
NFTA_SET_ELEM_LIST_MAX = __NFTA_SET_ELEM_LIST_MAX - 1
|
|
)
|
|
|
|
// NfTableSetElemAttributes represents the netfilter set element attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_SET_ELEM_UNSPEC uint16 = iota
|
|
NFTA_SET_ELEM_KEY
|
|
NFTA_SET_ELEM_DATA
|
|
NFTA_SET_ELEM_FLAGS
|
|
NFTA_SET_ELEM_TIMEOUT
|
|
NFTA_SET_ELEM_EXPIRATION
|
|
NFTA_SET_ELEM_USERDATA
|
|
NFTA_SET_ELEM_EXPR
|
|
NFTA_SET_ELEM_PAD
|
|
NFTA_SET_ELEM_OBJREF
|
|
NFTA_SET_ELEM_KEY_END
|
|
NFTA_SET_ELEM_EXPRESSIONS
|
|
__NFTA_SET_ELEM_MAX
|
|
NFTA_SET_ELEM_MAX = __NFTA_SET_ELEM_MAX - 1
|
|
)
|
|
|
|
// NfTableSetElemFlags represents the netfilter set element flags.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_SET_ELEM_INTERVAL_END = uint16(0x1)
|
|
NFT_SET_ELEM_CATCHALL = uint16(0x2)
|
|
)
|
|
|
|
// NfTableLookupAttributes represents the netfilter lookup attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_LOOKUP_UNSPEC uint16 = iota
|
|
NFTA_LOOKUP_SET
|
|
NFTA_LOOKUP_SREG
|
|
NFTA_LOOKUP_DREG
|
|
NFTA_LOOKUP_SET_ID
|
|
NFTA_LOOKUP_FLAGS
|
|
__NFTA_LOOKUP_MAX
|
|
NFTA_LOOKUP_MAX = __NFTA_LOOKUP_MAX - 1
|
|
)
|
|
const NFT_LOOKUP_F_INV = uint32(1 << 0)
|
|
|
|
// NfTable fib expression netlink attributes.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_FIB_UNSPEC uint16 = iota
|
|
NFTA_FIB_DREG
|
|
NFTA_FIB_RESULT
|
|
NFTA_FIB_FLAGS
|
|
__NFTA_FIB_MAX
|
|
)
|
|
|
|
const NFTA_FIB_MAX = __NFTA_FIB_MAX - 1
|
|
|
|
// NfTable fib result types.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_FIB_RESULT_UNSPEC = iota
|
|
NFT_FIB_RESULT_OIF
|
|
NFT_FIB_RESULT_OIFNAME
|
|
NFT_FIB_RESULT_ADDRTYPE
|
|
__NFT_FIB_RESULT_MAX
|
|
)
|
|
|
|
const NFT_FIB_RESULT_MAX = __NFT_FIB_RESULT_MAX - 1
|
|
|
|
// NfTable fib flags.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_FIB_F_SADDR = 1 << 0
|
|
NFTA_FIB_F_DADDR = 1 << 1
|
|
NFTA_FIB_F_MARK = 1 << 2
|
|
NFTA_FIB_F_IIF = 1 << 3
|
|
NFTA_FIB_F_OIF = 1 << 4
|
|
NFTA_FIB_F_PRESENT = 1 << 5
|
|
)
|
|
|
|
// Nf table ct expression keys.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFT_CT_STATE = iota
|
|
NFT_CT_DIRECTION
|
|
NFT_CT_STATUS
|
|
NFT_CT_MARK
|
|
NFT_CT_SECMARK
|
|
NFT_CT_EXPIRATION
|
|
NFT_CT_HELPER
|
|
NFT_CT_L3PROTOCOL
|
|
NFT_CT_SRC
|
|
NFT_CT_DST
|
|
NFT_CT_PROTOCOL
|
|
NFT_CT_PROTO_SRC
|
|
NFT_CT_PROTO_DST
|
|
NFT_CT_LABELS
|
|
NFT_CT_PKTS
|
|
NFT_CT_BYTES
|
|
NFT_CT_AVGPKT
|
|
NFT_CT_ZONE
|
|
NFT_CT_EVENTMASK
|
|
NFT_CT_SRC_IP
|
|
NFT_CT_DST_IP
|
|
NFT_CT_SRC_IP6
|
|
NFT_CT_DST_IP6
|
|
NFT_CT_ID
|
|
__NFT_CT_MAX
|
|
NFT_CT_MAX = __NFT_CT_MAX - 1
|
|
)
|
|
|
|
// Nf table ct expression netlink attributes.
|
|
// These correspond to values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_CT_UNSPEC uint16 = iota
|
|
NFTA_CT_DREG
|
|
NFTA_CT_KEY
|
|
NFTA_CT_DIRECTION
|
|
NFTA_CT_SREG
|
|
__NFTA_CT_MAX
|
|
NFTA_CT_MAX = __NFTA_CT_MAX - 1
|
|
)
|
|
|
|
// IPCTInfo represents the state of a connection.
|
|
// Used with NF_CT_STATE to represent the state of a connection.
|
|
// Ref: enum include/uapi/linux/netfilter/nf_conntrack.h:ip_conntrack_info
|
|
type IPCTInfo int
|
|
|
|
const (
|
|
// IP_CT_ESTABLISHED represents an established connection (either direction).
|
|
IP_CT_ESTABLISHED IPCTInfo = iota
|
|
// IP_CT_RELATED represents a connection related to an existing connection,
|
|
// or an ICMP error (in either direction).
|
|
IP_CT_RELATED
|
|
// IP_CT_NEW represents a new connection to track.
|
|
IP_CT_NEW
|
|
// IP_CT_IS_REPLY indicates reply direction.
|
|
IP_CT_IS_REPLY
|
|
// IP_CT_ESTABLISHED_REPLY represents an established connection in the reply direction.
|
|
IP_CT_ESTABLISHED_REPLY = IP_CT_ESTABLISHED + IP_CT_IS_REPLY
|
|
// IP_CT_RELATED_REPLY represents a connection related to an existing connection,
|
|
// or an ICMP error in the reply direction.
|
|
IP_CT_RELATED_REPLY = IP_CT_RELATED + IP_CT_IS_REPLY
|
|
// IP_CT_NUMBER is the number of distinct IP_CT types.
|
|
IP_CT_NUMBER = 5
|
|
// IP_CT_NEW_REPLY is for userspace compatibility.
|
|
IP_CT_NEW_REPLY = IP_CT_NUMBER
|
|
// IP_CT_UNTRACKED represents an untracked connection.
|
|
IP_CT_UNTRACKED = 7
|
|
)
|
|
|
|
// Conntrack states.
|
|
const (
|
|
// NF_CT_STATE_INVALID_BIT represents an invalid connection state.
|
|
NF_CT_STATE_INVALID_BIT = 1 << 0
|
|
// NF_CT_STATE_UNTRACKED_BIT represents an untracked connection state.
|
|
NF_CT_STATE_UNTRACKED_BIT = 1 << 6
|
|
)
|
|
|
|
// From include/uapi/linux/netfilter/nf_conntrack_common.h.
|
|
const (
|
|
IP_CT_DIR_ORIGINAL uint8 = iota
|
|
IP_CT_DIR_REPLY
|
|
IP_CT_DIR_MAX
|
|
)
|
|
|
|
// Nf table masq expression netlink attributes.
|
|
// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h.
|
|
const (
|
|
NFTA_MASQ_UNSPEC uint16 = iota
|
|
NFTA_MASQ_FLAGS
|
|
NFTA_MASQ_REG_PROTO_MIN
|
|
NFTA_MASQ_REG_PROTO_MAX
|
|
__NFTA_MASQ_MAX
|
|
NFTA_MASQ_MAX = __NFTA_MASQ_MAX - 1
|
|
)
|
|
|
|
// SizeOfNfConntrackManProto is the size of the nf_conntrack_man_proto in bytes.
|
|
// Ref: include/uapi/linux/netfilter/nf_conntrack_tuple_common.h:nf_conntrack_man_proto.
|
|
const SizeOfNfConntrackManProto = 2
|