|
 |
07a51b |
From 7c371119412595ad2d063b91fdea616dcacb4eed Mon Sep 17 00:00:00 2001
|
|
|
07a51b |
From: Andrea Claudi <aclaudi@redhat.com>
|
|
|
07a51b |
Date: Tue, 9 Jun 2020 15:45:56 +0200
|
|
|
07a51b |
Subject: [PATCH] man: tc-ct.8: Add manual page for ct tc action
|
|
|
07a51b |
|
|
|
07a51b |
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1844637
|
|
|
07a51b |
Upstream Status: iproute2.git commit 924c43778a845
|
|
|
07a51b |
|
|
|
07a51b |
commit 924c43778a8453e2cd0fd1440b9224bed9c87c0d
|
|
|
07a51b |
Author: Paul Blakey <paulb@mellanox.com>
|
|
|
07a51b |
Date: Thu May 14 17:10:20 2020 +0300
|
|
|
07a51b |
|
|
|
07a51b |
man: tc-ct.8: Add manual page for ct tc action
|
|
|
07a51b |
|
|
|
07a51b |
Signed-off-by: Paul Blakey <paulb@mellanox.com>
|
|
|
07a51b |
Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
|
|
|
07a51b |
---
|
|
|
07a51b |
man/man8/tc-ct.8 | 107 +++++++++++++++++++++++++++++++++++++++++++
|
|
|
07a51b |
man/man8/tc-flower.8 | 6 +++
|
|
|
07a51b |
2 files changed, 113 insertions(+)
|
|
|
07a51b |
create mode 100644 man/man8/tc-ct.8
|
|
|
07a51b |
|
|
|
07a51b |
diff --git a/man/man8/tc-ct.8 b/man/man8/tc-ct.8
|
|
|
07a51b |
new file mode 100644
|
|
|
07a51b |
index 0000000000000..45d29320f1d01
|
|
|
07a51b |
--- /dev/null
|
|
|
07a51b |
+++ b/man/man8/tc-ct.8
|
|
|
07a51b |
@@ -0,0 +1,107 @@
|
|
|
07a51b |
+.TH "ct action in tc" 8 "14 May 2020" "iproute2" "Linux"
|
|
|
07a51b |
+.SH NAME
|
|
|
07a51b |
+ct \- tc connection tracking action
|
|
|
07a51b |
+.SH SYNOPSIS
|
|
|
07a51b |
+.in +8
|
|
|
07a51b |
+.ti -8
|
|
|
07a51b |
+.BR "tc ... action ct commit [ force ] [ zone "
|
|
|
07a51b |
+.IR ZONE
|
|
|
07a51b |
+.BR "] [ mark "
|
|
|
07a51b |
+.IR MASKED_MARK
|
|
|
07a51b |
+.BR "] [ label "
|
|
|
07a51b |
+.IR MASKED_LABEL
|
|
|
07a51b |
+.BR "] [ nat "
|
|
|
07a51b |
+.IR NAT_SPEC
|
|
|
07a51b |
+.BR "]"
|
|
|
07a51b |
+
|
|
|
07a51b |
+.ti -8
|
|
|
07a51b |
+.BR "tc ... action ct [ nat ] [ zone "
|
|
|
07a51b |
+.IR ZONE
|
|
|
07a51b |
+.BR "]"
|
|
|
07a51b |
+
|
|
|
07a51b |
+.ti -8
|
|
|
07a51b |
+.BR "tc ... action ct clear"
|
|
|
07a51b |
+
|
|
|
07a51b |
+.SH DESCRIPTION
|
|
|
07a51b |
+The ct action is a tc action for sending packets and interacting with the netfilter conntrack module.
|
|
|
07a51b |
+
|
|
|
07a51b |
+It can (as shown in the synopsis, in order):
|
|
|
07a51b |
+
|
|
|
07a51b |
+Send the packet to conntrack, and commit the connection, while configuring
|
|
|
07a51b |
+a 32bit mark, 128bit label, and src/dst nat.
|
|
|
07a51b |
+
|
|
|
07a51b |
+Send the packet to conntrack, which will mark the packet with the connection's state and
|
|
|
07a51b |
+configured metadata (mark/label), and execute previous configured nat.
|
|
|
07a51b |
+
|
|
|
07a51b |
+Clear the packet's of previous connection tracking state.
|
|
|
07a51b |
+
|
|
|
07a51b |
+.SH OPTIONS
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI zone " ZONE"
|
|
|
07a51b |
+Specify a conntrack zone number on which to send the packet to conntrack.
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI mark " MASKED_MARK"
|
|
|
07a51b |
+Specify a masked 32bit mark to set for the connection (only valid with commit).
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI label " MASKED_LABEL"
|
|
|
07a51b |
+Specify a masked 128bit label to set for the connection (only valid with commit).
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI nat " NAT_SPEC"
|
|
|
07a51b |
+.BI Where " NAT_SPEC " ":= {src|dst} addr" " addr1" "[-" "addr2" "] [port " "port1" "[-" "port2" "]]"
|
|
|
07a51b |
+
|
|
|
07a51b |
+Specify src/dst and range of nat to configure for the connection (only valid with commit).
|
|
|
07a51b |
+.RS
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+src/dst - configure src or dst nat
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI "" "addr1" "/" "addr2" " - IPv4/IPv6 addresses"
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI "" "port1" "/" "port2" " - Port numbers"
|
|
|
07a51b |
+.RE
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI nat
|
|
|
07a51b |
+Restore any previous configured nat.
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI clear
|
|
|
07a51b |
+Remove any conntrack state and metadata (mark/label) from the packet (must only option specified).
|
|
|
07a51b |
+.TP
|
|
|
07a51b |
+.BI force
|
|
|
07a51b |
+Forces conntrack direction for a previously commited connections, so that current direction will become the original direction (only valid with commit).
|
|
|
07a51b |
+
|
|
|
07a51b |
+.SH EXAMPLES
|
|
|
07a51b |
+Example showing natted firewall in conntrack zone 2, and conntrack mark usage:
|
|
|
07a51b |
+.EX
|
|
|
07a51b |
+
|
|
|
07a51b |
+#Add ingress qdisc on eth0 and eth1 interfaces
|
|
|
07a51b |
+.nf
|
|
|
07a51b |
+$ tc qdisc add dev eth0 handle ingress
|
|
|
07a51b |
+$ tc qdisc add dev eth1 handle ingress
|
|
|
07a51b |
+
|
|
|
07a51b |
+#Setup filters on eth0, allowing opening new connections in zone 2, and doing src nat + mark for each new connection
|
|
|
07a51b |
+$ tc filter add dev eth0 ingress prio 1 chain 0 proto ip flower ip_proto tcp ct_state -trk \\
|
|
|
07a51b |
+action ct zone 2 pipe action goto chain 2
|
|
|
07a51b |
+$ tc filter add dev eth0 ingress prio 1 chain 2 proto ip flower ct_state +trk+new \\
|
|
|
07a51b |
+action ct zone 2 commit mark 0xbb nat src addr 5.5.5.7 pipe action mirred egress redirect dev eth1
|
|
|
07a51b |
+$ tc filter add dev eth0 ingress prio 1 chain 2 proto ip flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \\
|
|
|
07a51b |
+action ct nat pipe action mirred egress redirect dev eth1
|
|
|
07a51b |
+
|
|
|
07a51b |
+#Setup filters on eth1, allowing only established connections of zone 2 through, and reverse nat (dst nat in this case)
|
|
|
07a51b |
+$ tc filter add dev eth1 ingress prio 1 chain 0 proto ip flower ip_proto tcp ct_state -trk \\
|
|
|
07a51b |
+action ct zone 2 pipe action goto chain 1
|
|
|
07a51b |
+$ tc filter add dev eth1 ingress prio 1 chain 1 proto ip flower ct_zone 2 ct_mark 0xbb ct_state +trk+est \\
|
|
|
07a51b |
+action ct nat pipe action mirred egress redirect dev eth0
|
|
|
07a51b |
+.fi
|
|
|
07a51b |
+
|
|
|
07a51b |
+.EE
|
|
|
07a51b |
+
|
|
|
07a51b |
+.RE
|
|
|
07a51b |
+.SH SEE ALSO
|
|
|
07a51b |
+.BR tc (8),
|
|
|
07a51b |
+.BR tc-flower (8)
|
|
|
07a51b |
+.BR tc-mirred (8)
|
|
|
07a51b |
+.SH AUTHORS
|
|
|
07a51b |
+Paul Blakey <paulb@mellanox.com>
|
|
|
07a51b |
+
|
|
|
07a51b |
+Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
|
|
|
07a51b |
+
|
|
|
07a51b |
+Yossi Kuperman <yossiku@mellanox.com>
|
|
|
07a51b |
diff --git a/man/man8/tc-flower.8 b/man/man8/tc-flower.8
|
|
|
07a51b |
index 0f95f303f23b7..02a7256f36ebb 100644
|
|
|
07a51b |
--- a/man/man8/tc-flower.8
|
|
|
07a51b |
+++ b/man/man8/tc-flower.8
|
|
|
07a51b |
@@ -1,5 +1,11 @@
|
|
|
07a51b |
.TH "Flower filter in tc" 8 "22 Oct 2015" "iproute2" "Linux"
|
|
|
07a51b |
|
|
|
07a51b |
+ "Usage: ct clear\n"
|
|
|
07a51b |
+ " ct commit [force] [zone ZONE] [mark MASKED_MARK] [label MASKED_LABEL] [nat NAT_SPEC] [OFFLOAD_POLICY]\n"
|
|
|
07a51b |
+ " ct [nat] [zone ZONE] [OFFLOAD_POLICY]\n"
|
|
|
07a51b |
+ "Where: ZONE is the conntrack zone table number\n"
|
|
|
07a51b |
+ " NAT_SPEC is {src|dst} addr addr1[-addr2] [port port1[-port2]]\n"
|
|
|
07a51b |
+ " OFFLOAD_POLICY is [policy_pkts PACKETS] [policy_timeout TIMEOUT]\n"
|
|
|
07a51b |
.SH NAME
|
|
|
07a51b |
flower \- flow based traffic control filter
|
|
|
07a51b |
.SH SYNOPSIS
|
|
|
07a51b |
--
|
|
|
07a51b |
2.26.2
|
|
|
07a51b |
|