nftables syntax tree

<style type="text/css"> ::-moz-selection { color: #FFFCF0; background: #0F0C00; } ::selection { color: #FFFCF0; background: #0F0C00; } body { font: normal 12px Verdana, sans-serif; color: #0F0C00; background: #FFFCF0; } .ebnf a { text-decoration: none; } .ebnf a:hover { color: #050400; text-decoration: underline; } .signature { color: #806600; font-size: 11px; text-align: right; } a:link, a:visited { color: #0F0C00; } a:link.signature, a:visited.signature { color: #806600; } div.ebnf { padding: 10px; background: #FFF6D1; width: 992px; } .ebnf div { padding-left: 13ch; text-indent: -13ch; } .ebnf code { font:12px SFMono-Regular,Consolas,Liberation Mono,Menlo,Courier,monospace; } </style> <style type="text/css"> @namespace "http://www.w3.org/2000/svg"; .line {fill: none; stroke: #332900; stroke-width: 1;} .bold-line {stroke: #141000; shape-rendering: crispEdges; stroke-width: 2;} .thin-line {stroke: #1F1800; shape-rendering: crispEdges} .filled {fill: #332900; stroke: none;} text.terminal {font-family: Verdana, Sans-serif; font-size: 12px; fill: #141000; font-weight: bold; } text.nonterminal {font-family: Verdana, Sans-serif; font-size: 12px; fill: #1A1400; font-weight: normal; } text.regexp {font-family: Verdana, Sans-serif; font-size: 12px; fill: #1F1800; font-weight: normal; } rect, circle, polygon {fill: #332900; stroke: #332900;} rect.terminal {fill: #FFDB4D; stroke: #332900; stroke-width: 1;} rect.nonterminal {fill: #FFEC9E; stroke: #332900; stroke-width: 1;} rect.text {fill: none; stroke: none;} polygon.regexp {fill: #FFF4C7; stroke: #332900; stroke-width: 1;} </style>

input:

line

no references

stmt_separator:

NEWLINE SEMICOLON

referenced by:

• chain_block
• chain_stmt
• common_block
• counter_block
• ct_expect_block
• ct_expect_config
• ct_helper_block
• ct_helper_config
• ct_timeout_block
• ct_timeout_config
• flowtable_block
• limit_block
• line
• map_block
• quota_block
• secmark_block
• set_block
• synproxy_block
• synproxy_config
• table_block

opt_newline:

NEWLINE

referenced by:

• flowtable_expr
• set_expr
• set_list_member_expr
• verdict_map_expr
• verdict_map_list_member_expr

close_scope_ah:

referenced by:

• auth_hdr_expr
• primary_rhs_expr

close_scope_arp:

referenced by:

• arp_hdr_expr
• family_spec_explicit
• keyword_expr

close_scope_at:

referenced by:

• meta_stmt
• payload_raw_expr
• set_ref_symbol_expr
• tcp_hdr_expr

close_scope_comp:

referenced by:

• comp_hdr_expr
• primary_rhs_expr

close_scope_ct:

referenced by:

• add_cmd
• connlimit_stmt
• create_cmd
• ct_expr
• ct_stmt
• list_cmd
• map_block_obj_typeof
• objref_stmt_ct
• set_elem_stmt
• table_block

close_scope_counter:

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• flowtable_block
• list_cmd
• map_block_obj_type
• objref_stmt_counter
• reset_cmd
• set_elem_stmt
• stateful_stmt
• table_block

close_scope_last:

referenced by:

• keyword_expr
• set_elem_stmt
• stateful_stmt

close_scope_dccp:

referenced by:

• dccp_hdr_expr
• primary_rhs_expr

close_scope_destroy:

referenced by:

• base_cmd
• keyword_expr

close_scope_dst:

referenced by:

• dst_hdr_expr
• exthdr_key

close_scope_dup:

referenced by:

• stmt

close_scope_esp:

referenced by:

• esp_hdr_expr
• primary_rhs_expr

close_scope_eth:

referenced by:

• arp_hdr_field
• eth_hdr_expr
• keyword_expr
• log_flags

close_scope_export:

referenced by:

• base_cmd

close_scope_fib:

referenced by:

• fib_expr

close_scope_frag:

referenced by:

• exthdr_key
• frag_hdr_expr

close_scope_fwd:

referenced by:

• stmt

close_scope_gre:

referenced by:

• gre_hdr_expr
• gretap_hdr_expr
• primary_rhs_expr

close_scope_hash:

referenced by:

• hash_expr

close_scope_hbh:

referenced by:

• exthdr_key
• hbh_hdr_expr

close_scope_ip:

referenced by:

• arp_hdr_field
• ct_key_proto_field
• family_spec_explicit
• ip_hdr_expr
• keyword_expr
• log_flags
• nf_key_proto

close_scope_ip6:

referenced by:

• ct_key_proto_field
• family_spec_explicit
• ip6_hdr_expr
• keyword_expr
• nf_key_proto

close_scope_vlan:

referenced by:

• keyword_expr
• vlan_hdr_expr

close_scope_icmp:

referenced by:

• icmp6_hdr_expr
• icmp_hdr_expr
• primary_rhs_expr
• reject_opts

close_scope_igmp:

referenced by:

• igmp_hdr_expr

close_scope_import:

referenced by:

• base_cmd

close_scope_ipsec:

referenced by:

• meta_key_unqualified
• rt_key
• xfrm_expr

close_scope_list:

referenced by:

• base_cmd

close_scope_limit:

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• limit_stmt
• list_cmd
• map_block_obj_type
• objref_stmt_limit
• set_elem_stmt
• table_block

close_scope_meta:

referenced by:

• meta_expr
• meta_stmt

close_scope_mh:

referenced by:

• exthdr_key
• mh_hdr_expr

close_scope_monitor:

referenced by:

• base_cmd

close_scope_nat:

referenced by:

• keyword_expr
• primary_rhs_expr
• stmt

close_scope_numgen:

referenced by:

• numgen_expr

close_scope_osf:

referenced by:

• osf_expr

close_scope_policy:

referenced by:

• ct_timeout_config
• policy_spec
• set_mechanism

close_scope_quota:

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• list_cmd
• map_block_obj_type
• objref_stmt_quota
• quota_stmt
• reset_cmd
• set_elem_stmt
• table_block

close_scope_queue:

referenced by:

• queue_stmt

close_scope_reject:

referenced by:

• stmt

close_scope_reset:

referenced by:

• base_cmd
• keyword_expr
• reject_opts

close_scope_rt:

referenced by:

• exthdr_key
• rt0_hdr_expr
• rt2_hdr_expr
• rt4_hdr_expr
• rt_expr
• rt_hdr_expr

close_scope_sctp:

referenced by:

• primary_rhs_expr
• sctp_hdr_expr

close_scope_sctp_chunk:

referenced by:

• sctp_hdr_expr

close_scope_secmark:

referenced by:

• add_cmd
• create_cmd
• ct_key
• delete_cmd
• destroy_cmd
• list_cmd
• map_block_obj_type
• meta_key_qualified
• table_block

close_scope_socket:

referenced by:

• socket_expr

close_scope_tcp:

referenced by:

• ct_l4protoname
• inner_inet_expr
• log_flags
• optstrip_stmt
• payload_expr
• primary_rhs_expr
• reject_opts

close_scope_tproxy:

referenced by:

• stmt

close_scope_type:

referenced by:

• ct_helper_config
• dccp_hdr_field
• eth_hdr_field
• fib_result
• hook_spec
• icmp6_hdr_field
• icmp_hdr_field
• igmp_hdr_field
• ip_option_field
• map_block
• mh_hdr_field
• reject_opts
• rt_hdr_field
• sctp_chunk_common_field
• typeof_key_expr
• vlan_hdr_field

close_scope_th:

referenced by:

• payload_base_spec
• th_hdr_expr

close_scope_udp:

referenced by:

• ct_l4protoname
• primary_rhs_expr
• udp_hdr_expr

close_scope_udplite:

referenced by:

• primary_rhs_expr
• udplite_hdr_expr

close_scope_log:

referenced by:

• stmt

close_scope_synproxy:

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• list_cmd
• map_block_obj_type
• objref_stmt_synproxy
• stmt
• table_block

close_scope_xt:

referenced by:

• stmt

common_block:

INCLUDE QUOTED_STRING DEFINE REDEFINE identifier = initializer_expr UNDEFINE identifier error stmt_separator

referenced by:

• chain_block
• counter_block
• ct_expect_block
• ct_helper_block
• ct_timeout_block
• flowtable_block
• limit_block
• line
• map_block
• quota_block
• secmark_block
• set_block
• synproxy_block
• table_block

line:

common_block stmt_separator base_cmd stmt_separator TOKEN_EOF

referenced by:

• input

base_cmd:

ADD add_cmd REPLACE replace_cmd CREATE create_cmd INSERT insert_cmd DELETE delete_cmd GET get_cmd LIST list_cmd close_scope_list RESET reset_cmd close_scope_reset FLUSH flush_cmd RENAME rename_cmd IMPORT import_cmd close_scope_import EXPORT export_cmd close_scope_export MONITOR monitor_cmd close_scope_monitor DESCRIBE describe_cmd DESTROY destroy_cmd close_scope_destroy

referenced by:

• line

add_cmd:

TABLE table_spec table_block_alloc { table_block } CHAIN chain_spec chain_block_alloc { chain_block } RULE rule_position rule SET set_spec set_block_alloc { set_block MAP set_spec map_block_alloc { map_block FLOWTABLE flowtable_spec flowtable_block_alloc { flowtable_block } ELEMENT set_spec set_block_expr COUNTER obj_spec counter_obj counter_config { counter_block } close_scope_counter QUOTA obj_spec quota_obj quota_config { quota_block } close_scope_quota CT HELPER obj_spec ct_obj_alloc { ct_helper_block TIMEOUT obj_spec ct_obj_alloc { ct_timeout_block EXPECTATION obj_spec ct_obj_alloc { ct_expect_block } close_scope_ct LIMIT obj_spec limit_obj limit_config { limit_block } close_scope_limit SECMARK obj_spec secmark_obj secmark_config { secmark_block } close_scope_secmark SYNPROXY obj_spec synproxy_obj synproxy_config { synproxy_block } close_scope_synproxy

referenced by:

• base_cmd

replace_cmd:

RULE ruleid_spec rule

referenced by:

• base_cmd

create_cmd:

TABLE table_spec table_block_alloc { table_block } CHAIN chain_spec chain_block_alloc { chain_block } SET set_spec set_block_alloc { set_block MAP set_spec map_block_alloc { map_block FLOWTABLE flowtable_spec flowtable_block_alloc { flowtable_block } ELEMENT set_spec set_block_expr COUNTER obj_spec counter_obj counter_config close_scope_counter QUOTA obj_spec quota_obj quota_config close_scope_quota CT HELPER obj_spec ct_obj_alloc { ct_helper_block TIMEOUT obj_spec ct_obj_alloc { ct_timeout_block EXPECTATION obj_spec ct_obj_alloc { ct_expect_block } close_scope_ct LIMIT obj_spec limit_obj limit_config close_scope_limit SECMARK obj_spec secmark_obj secmark_config close_scope_secmark SYNPROXY obj_spec synproxy_obj synproxy_config close_scope_synproxy

referenced by:

• base_cmd

insert_cmd:

RULE rule_position rule

referenced by:

• base_cmd

table_or_id_spec:

table_spec tableid_spec

referenced by:

• delete_cmd
• destroy_cmd

chain_or_id_spec:

chain_spec chainid_spec

referenced by:

• delete_cmd
• destroy_cmd

set_or_id_spec:

set_spec setid_spec

referenced by:

• delete_cmd
• destroy_cmd
• reset_cmd

obj_or_id_spec:

obj_spec objid_spec

referenced by:

• delete_cmd
• destroy_cmd

delete_cmd:

TABLE table_or_id_spec CHAIN chain_or_id_spec chain_spec chain_block_alloc { chain_block } RULE ruleid_spec SET set_or_id_spec MAP set_spec ELEMENT set_spec set_block_expr FLOWTABLE flowtable_spec flowtable_block_alloc { flowtable_block } flowtableid_spec COUNTER obj_or_id_spec close_scope_counter QUOTA obj_or_id_spec close_scope_quota CT ct_obj_type obj_spec ct_obj_allocclose_scope_ct LIMIT obj_or_id_spec close_scope_limit SECMARK obj_or_id_spec close_scope_secmark SYNPROXY obj_or_id_spec close_scope_synproxy

referenced by:

• base_cmd

destroy_cmd:

TABLE table_or_id_spec CHAIN chain_or_id_spec RULE ruleid_spec SET set_or_id_spec MAP set_spec ELEMENT set_spec set_block_expr FLOWTABLE flowtable_spec flowtable_block_alloc { flowtable_block } flowtableid_spec COUNTER obj_or_id_spec close_scope_counter QUOTA obj_or_id_spec close_scope_quota CT ct_obj_type obj_spec ct_obj_allocclose_scope_ct LIMIT obj_or_id_spec close_scope_limit SECMARK obj_or_id_spec close_scope_secmark SYNPROXY obj_or_id_spec close_scope_synproxy

referenced by:

• base_cmd

get_cmd:

ELEMENT set_spec set_block_expr

referenced by:

• base_cmd

list_cmd:

TABLE table_spec TABLES CHAINS RULESET METERS FLOWTABLES MAPS ruleset_spec CHAIN chain_spec SETS COUNTERS QUOTAS LIMITS SECMARKS SYNPROXYS ruleset_spec TABLE table_spec SET METER MAP set_spec COUNTER obj_spec close_scope_counter QUOTA obj_spec close_scope_quota LIMIT obj_spec close_scope_limit SECMARK obj_spec close_scope_secmark SYNPROXY obj_spec close_scope_synproxy FLOW TABLES ruleset_spec TABLE set_spec FLOWTABLE flowtable_spec CT ct_obj_type obj_spec ct_cmd_type TABLE table_spec close_scope_ct HOOKS basehook_spec

referenced by:

• base_cmd

basehook_device_name:

DEVICE STRING

referenced by:

• basehook_spec

basehook_spec:

ruleset_spec basehook_device_name

referenced by:

• list_cmd

reset_cmd:

COUNTERS QUOTAS ruleset_spec TABLE table_spec COUNTER obj_spec close_scope_counter QUOTA obj_spec close_scope_quota RULES ruleset_spec TABLE table_spec CHAIN chain_spec RULE ruleid_spec ELEMENT set_spec set_block_expr SET MAP set_or_id_spec

referenced by:

• base_cmd

flush_cmd:

TABLE table_spec CHAIN chain_spec SET MAP FLOW TABLE METER set_spec RULESET ruleset_spec

referenced by:

• base_cmd

rename_cmd:

CHAIN chain_spec identifier

referenced by:

• base_cmd

import_cmd:

RULESET markup_format

referenced by:

• base_cmd

export_cmd:

RULESET markup_format

referenced by:

• base_cmd

monitor_cmd:

monitor_event monitor_object monitor_format

referenced by:

• base_cmd

monitor_event:

STRING

referenced by:

• monitor_cmd

monitor_object:

TABLES CHAINS SETS RULES ELEMENTS RULESET TRACE

referenced by:

• monitor_cmd

monitor_format:

markup_format

referenced by:

• monitor_cmd

markup_format:

XML VM JSON

referenced by:

• export_cmd
• import_cmd
• monitor_format

describe_cmd:

primary_expr

referenced by:

• base_cmd

table_block_alloc:

referenced by:

• add_cmd
• create_cmd

table_options:

FLAGS table_flag COMMA comment_spec

referenced by:

• table_block

table_flag:

STRING

referenced by:

• table_options

table_block:

common_block table_options CHAIN chain_identifier chain_block_alloc { chain_block SET set_identifier set_block_alloc { set_block MAP set_identifier map_block_alloc { map_block FLOWTABLE flowtable_identifier flowtable_block_alloc { flowtable_block } stmt_separator COUNTER obj_identifier obj_block_alloc { counter_block } stmt_separator close_scope_counter QUOTA obj_identifier obj_block_alloc { quota_block } stmt_separator close_scope_quota CT HELPER obj_identifier obj_block_alloc { ct_helper_block TIMEOUT obj_identifier obj_block_alloc { ct_timeout_block EXPECTATION obj_identifier obj_block_alloc { ct_expect_block } stmt_separator close_scope_ct LIMIT obj_identifier obj_block_alloc { limit_block } stmt_separator close_scope_limit SECMARK obj_identifier obj_block_alloc { secmark_block } stmt_separator close_scope_secmark SYNPROXY obj_identifier obj_block_alloc { synproxy_block } stmt_separator close_scope_synproxy

referenced by:

• add_cmd
• create_cmd

chain_block_alloc:

referenced by:

• add_cmd
• chain_stmt
• create_cmd
• delete_cmd
• table_block

chain_block:

common_block hook_spec policy_spec flags_spec rule DEVICES = flowtable_expr comment_spec stmt_separator

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• table_block

typeof_verdict_expr:

typeof_expr DOT primary_expr

referenced by:

• typeof_data_expr

typeof_data_expr:

INTERVAL typeof_expr typeof_verdict_expr

referenced by:

• map_block

typeof_expr:

primary_expr DOT

referenced by:

• map_block
• typeof_data_expr
• typeof_key_expr
• typeof_verdict_expr

set_block_alloc:

referenced by:

• add_cmd
• create_cmd
• table_block

typeof_key_expr:

TYPEOF typeof_expr TYPE data_type_expr close_scope_type

referenced by:

• set_block

set_block:

common_block typeof_key_expr FLAGS set_flag_list TIMEOUT GC_INTERVAL time_spec stateful_stmt_list set_mechanism comment_spec stmt_separator ELEMENTS = set_block_expr AUTOMERGE

referenced by:

• add_cmd
• create_cmd
• table_block

set_block_expr:

set_expr variable_expr

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• get_cmd
• map_block
• reset_cmd
• set_block

set_flag_list:

set_flag COMMA

referenced by:

• map_block
• set_block

set_flag:

CONSTANT INTERVAL TIMEOUT DYNAMIC

referenced by:

• set_flag_list

map_block_alloc:

referenced by:

• add_cmd
• create_cmd
• table_block

ct_obj_type_map:

TIMEOUT EXPECTATION

referenced by:

• map_block_obj_typeof

map_block_obj_type:

COUNTER close_scope_counter QUOTA close_scope_quota LIMIT close_scope_limit SECMARK close_scope_secmark SYNPROXY close_scope_synproxy

referenced by:

• map_block
• map_block_obj_typeof

map_block_obj_typeof:

map_block_obj_type CT ct_obj_type_map close_scope_ct

referenced by:

• map_block

map_block_data_interval:

INTERVAL

referenced by:

• map_block

map_block:

common_block TIMEOUT GC_INTERVAL time_spec FLAGS set_flag_list stateful_stmt_list comment_spec set_mechanism TYPEOF typeof_expr COLON typeof_data_expr map_block_obj_typeof stmt_separator TYPE data_type_expr COLON map_block_data_interval data_type_expr map_block_obj_type stmt_separator close_scope_type ELEMENTS = set_block_expr

referenced by:

• add_cmd
• create_cmd
• table_block

set_mechanism:

POLICY set_policy_spec close_scope_policy SIZE NUM

referenced by:

• map_block
• set_block

set_policy_spec:

PERFORMANCE MEMORY

referenced by:

• set_mechanism

flowtable_block_alloc:

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• table_block

flowtable_block:

common_block HOOK STRING prio_spec DEVICES = flowtable_expr FLAGS OFFLOAD stmt_separator COUNTER close_scope_counter

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• table_block

flowtable_expr:

{ flowtable_expr_member COMMA flowtable_expr_member opt_newline } variable_expr

referenced by:

• chain_block
• dev_spec
• flowtable_block

flowtable_expr_member:

QUOTED_STRING STRING variable_expr

referenced by:

• flowtable_expr

data_type_atom_expr:

type_identifier TIME

referenced by:

• data_type_expr

data_type_expr:

data_type_atom_expr DOT

referenced by:

• map_block
• typeof_key_expr

obj_block_alloc:

referenced by:

• table_block

counter_block:

common_block stmt_separator counter_config comment_spec

referenced by:

• add_cmd
• table_block

quota_block:

common_block stmt_separator quota_config comment_spec

referenced by:

• add_cmd
• table_block

ct_helper_block:

common_block stmt_separator ct_helper_config comment_spec

referenced by:

• add_cmd
• create_cmd
• table_block

ct_timeout_block:

common_block stmt_separator ct_timeout_config comment_spec

referenced by:

• add_cmd
• create_cmd
• table_block

ct_expect_block:

common_block stmt_separator ct_expect_config comment_spec

referenced by:

• add_cmd
• create_cmd
• table_block

limit_block:

common_block stmt_separator limit_config comment_spec

referenced by:

• add_cmd
• table_block

secmark_block:

common_block stmt_separator secmark_config comment_spec

referenced by:

• add_cmd
• table_block

synproxy_block:

common_block stmt_separator synproxy_config comment_spec

referenced by:

• add_cmd
• table_block

type_identifier:

STRING MARK DSCP ECN CLASSID

referenced by:

• data_type_atom_expr

hook_spec:

TYPE close_scope_type STRING HOOK STRING dev_spec prio_spec

referenced by:

• chain_block

prio_spec:

PRIORITY extended_prio_spec

referenced by:

• flowtable_block
• hook_spec

extended_prio_name:

OUT STRING

referenced by:

• extended_prio_spec

extended_prio_spec:

int_num variable_expr extended_prio_name PLUS DASH NUM

referenced by:

• prio_spec

int_num:

DASH NUM

referenced by:

• extended_prio_spec

dev_spec:

DEVICE string variable_expr DEVICES = flowtable_expr

referenced by:

• hook_spec

flags_spec:

FLAGS OFFLOAD

referenced by:

• chain_block

policy_spec:

POLICY policy_expr close_scope_policy

referenced by:

• chain_block

policy_expr:

variable_expr chain_policy

referenced by:

• policy_spec

chain_policy:

ACCEPT DROP

referenced by:

• policy_expr

identifier:

STRING LAST

referenced by:

• chain_expr
• chain_identifier
• chain_spec
• common_block
• flowtable_identifier
• flowtable_spec
• meter_stmt_alloc
• obj_identifier
• obj_spec
• rename_cmd
• set_identifier
• set_ref_symbol_expr
• set_spec
• table_spec
• variable_expr

string:

STRING QUOTED_STRING ASTERISK_STRING

referenced by:

• comment_spec
• dev_spec
• level_type
• log_arg
• meta_stmt
• secmark_config
• symbol_expr
• xt_stmt

time_spec:

STRING

referenced by:

• ct_expect_config
• last_stmt
• map_block
• set_block
• set_elem_expr_option
• set_elem_option
• set_elem_stmt
• time_spec_or_num_s

time_spec_or_num_s:

NUM time_spec

referenced by:

• timeout_state

family_spec:

family_spec_explicit

referenced by:

• table_spec
• tableid_spec

family_spec_explicit:

IP close_scope_ip IP6 close_scope_ip6 INET ARP close_scope_arp BRIDGE NETDEV

referenced by:

• ct_expect_config
• ct_helper_config
• ct_timeout_config
• family_spec
• ruleset_spec

table_spec:

family_spec identifier

referenced by:

• add_cmd
• chain_spec
• chainid_spec
• create_cmd
• flowtable_spec
• flowtableid_spec
• flush_cmd
• list_cmd
• obj_spec
• objid_spec
• reset_cmd
• set_spec
• setid_spec
• table_or_id_spec

tableid_spec:

family_spec HANDLE NUM

referenced by:

• table_or_id_spec

chain_spec:

table_spec identifier

referenced by:

• add_cmd
• chain_or_id_spec
• create_cmd
• delete_cmd
• flush_cmd
• list_cmd
• rename_cmd
• reset_cmd
• rule_position
• ruleid_spec

chainid_spec:

table_spec HANDLE NUM

referenced by:

• chain_or_id_spec

chain_identifier:

identifier

referenced by:

• table_block

set_spec:

table_spec identifier

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• flush_cmd
• get_cmd
• list_cmd
• reset_cmd
• set_or_id_spec

setid_spec:

table_spec HANDLE NUM

referenced by:

• set_or_id_spec

set_identifier:

identifier

referenced by:

• table_block

flowtable_spec:

table_spec identifier

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• list_cmd

flowtableid_spec:

table_spec HANDLE NUM

referenced by:

• delete_cmd
• destroy_cmd

flowtable_identifier:

identifier

referenced by:

• table_block

obj_spec:

table_spec identifier

referenced by:

• add_cmd
• create_cmd
• delete_cmd
• destroy_cmd
• list_cmd
• obj_or_id_spec
• reset_cmd

objid_spec:

table_spec HANDLE NUM

referenced by:

• obj_or_id_spec

obj_identifier:

identifier

referenced by:

• table_block

handle_spec:

HANDLE NUM

referenced by:

• rule_position
• ruleid_spec

position_spec:

POSITION NUM

referenced by:

• rule_position

index_spec:

INDEX NUM

referenced by:

• rule_position

rule_position:

chain_spec position_spec handle_spec index_spec

referenced by:

• add_cmd
• insert_cmd

ruleid_spec:

chain_spec handle_spec

referenced by:

• delete_cmd
• destroy_cmd
• replace_cmd
• reset_cmd

comment_spec:

COMMENT string

referenced by:

• chain_block
• counter_block
• ct_expect_block
• ct_helper_block
• ct_timeout_block
• limit_block
• map_block
• quota_block
• rule
• secmark_block
• set_block
• set_elem_expr_option
• set_elem_option
• synproxy_block
• table_options

ruleset_spec:

family_spec_explicit

referenced by:

• basehook_spec
• flush_cmd
• list_cmd
• reset_cmd

rule:

rule_alloc comment_spec

referenced by:

• add_cmd
• chain_block
• chain_stmt
• insert_cmd
• replace_cmd

rule_alloc:

stmt

referenced by:

• rule

stateful_stmt_list:

stateful_stmt

referenced by:

• map_block
• map_stmt
• set_block
• set_stmt

objref_stmt_counter:

COUNTER NAME stmt_expr close_scope_counter

referenced by:

• objref_stmt

objref_stmt_limit:

LIMIT NAME stmt_expr close_scope_limit

referenced by:

• objref_stmt

objref_stmt_quota:

QUOTA NAME stmt_expr close_scope_quota

referenced by:

• objref_stmt

objref_stmt_synproxy:

SYNPROXY NAME stmt_expr close_scope_synproxy

referenced by:

• objref_stmt

objref_stmt_ct:

CT TIMEOUT EXPECTATION SET stmt_expr close_scope_ct

referenced by:

• objref_stmt

objref_stmt:

objref_stmt_counter objref_stmt_limit objref_stmt_quota objref_stmt_synproxy objref_stmt_ct

referenced by:

• stmt

stateful_stmt:

counter_stmt close_scope_counter limit_stmt quota_stmt connlimit_stmt last_stmt close_scope_last

referenced by:

• stateful_stmt_list
• stmt

stmt:

verdict_stmt match_stmt meter_stmt payload_stmt stateful_stmt meta_stmt log_stmt close_scope_log reject_stmt close_scope_reject nat_stmt masq_stmt redir_stmt close_scope_nat tproxy_stmt close_scope_tproxy queue_stmt ct_stmt dup_stmt close_scope_dup fwd_stmt close_scope_fwd set_stmt map_stmt synproxy_stmt close_scope_synproxy chain_stmt optstrip_stmt xt_stmt close_scope_xt objref_stmt

referenced by:

• meter_stmt_alloc
• rule_alloc

xt_stmt:

XT STRING string

referenced by:

• stmt

chain_stmt_type:

JUMP GOTO

referenced by:

• chain_stmt

chain_stmt:

chain_stmt_type chain_block_alloc { rule stmt_separator }

referenced by:

• stmt

verdict_stmt:

verdict_expr verdict_map_stmt

referenced by:

• stmt

verdict_map_stmt:

concat_expr VMAP verdict_map_expr

referenced by:

• verdict_stmt

verdict_map_expr:

{ verdict_map_list_member_expr COMMA verdict_map_list_member_expr opt_newline } set_ref_expr

referenced by:

• verdict_map_stmt

verdict_map_list_member_expr:

opt_newline set_elem_expr COLON verdict_expropt_newline

referenced by:

• verdict_map_expr

connlimit_stmt:

CT COUNT OVER NUM close_scope_ct

referenced by:

• stateful_stmt

counter_stmt:

counter_stmt_alloc counter_arg

referenced by:

• stateful_stmt

counter_stmt_alloc:

COUNTER

referenced by:

• counter_stmt

counter_arg:

PACKETS BYTES NUM

referenced by:

• counter_stmt

last_stmt:

LAST USED NEVER time_spec

referenced by:

• stateful_stmt

log_stmt:

log_stmt_alloc log_arg

referenced by:

• stmt

log_stmt_alloc:

LOG

referenced by:

• log_stmt

log_arg:

PREFIX string GROUP SNAPLEN QUEUE_THRESHOLD NUM LEVEL level_type FLAGS log_flags

referenced by:

• log_stmt

level_type:

string

referenced by:

• log_arg

log_flags:

TCP log_flag_tcp COMMA close_scope_tcp IP OPTIONS close_scope_ip SKUID ETHER close_scope_eth ALL

referenced by:

• log_arg

log_flag_tcp:

SEQUENCE OPTIONS

referenced by:

• log_flags

limit_stmt:

LIMIT RATE limit_mode limit_rate_pkts limit_burst_pkts limit_rate_bytes limit_burst_bytes close_scope_limit

referenced by:

• stateful_stmt

quota_mode:

OVER UNTIL

referenced by:

• quota_config
• quota_stmt
• set_elem_stmt

quota_unit:

BYTES STRING

referenced by:

• quota_config
• quota_stmt
• quota_used
• set_elem_stmt

quota_used:

USED NUM quota_unit

referenced by:

• quota_config
• quota_stmt
• set_elem_stmt

quota_stmt:

QUOTA quota_mode NUM quota_unit quota_used close_scope_quota

referenced by:

• stateful_stmt

limit_mode:

OVER UNTIL

referenced by:

• limit_config
• limit_stmt
• set_elem_stmt

limit_burst_pkts:

BURST NUM PACKETS

referenced by:

• limit_config
• limit_stmt
• set_elem_stmt

limit_rate_pkts:

NUM SLASH time_unit

referenced by:

• limit_config
• limit_stmt
• set_elem_stmt

limit_burst_bytes:

BURST limit_bytes

referenced by:

• limit_config
• limit_stmt
• set_elem_stmt

limit_rate_bytes:

NUM STRING limit_bytes SLASH time_unit

referenced by:

• limit_config
• limit_stmt
• set_elem_stmt

limit_bytes:

NUM BYTES STRING

referenced by:

• limit_burst_bytes
• limit_rate_bytes

time_unit:

SECOND MINUTE HOUR DAY WEEK

referenced by:

• limit_rate_bytes
• limit_rate_pkts

reject_stmt:

reject_stmt_alloc reject_opts

referenced by:

• stmt

reject_stmt_alloc:

_REJECT

referenced by:

• reject_stmt

reject_with_expr:

STRING integer_expr

referenced by:

• reject_opts

reject_opts:

WITH ICMP ICMP6 TYPE reject_with_expr close_scope_type close_scope_icmp reject_with_expr ICMPX TYPE reject_with_expr close_scope_type reject_with_expr TCP close_scope_tcp RESET close_scope_reset

referenced by:

• reject_stmt

nat_stmt:

nat_stmt_alloc TO stmt_expr COLON INTERVAL PREFIX TO nf_key_proto TO stmt_expr COLON ADDR DOT PORT INTERVAL PREFIX TO stmt_expr nf_nat_flags