ematch(8) Linux ematch(8) NAME ematch−extendedmatchesforusewith"basic"or"flow"filters SYNOPSIS tcfilteradd..basicmatchEXPR..flowid.. EXPR:=TERM[{and|or}EXPR] TERM:=[not]{MATCH|’(’EXPR’)’} MATCH:=module’(’ARGS’)’ ARGS:=ARG1ARG2.. MATCHES cmp Simplecomparisonematch:arithmeticcompareofpacketdatatoagivenvalue. cmp(ALIGNatOFFSET[ATTRS]{eq|lt|gt}VALUE) ALIGN:={u8|u16|u32} ATTRS:=[layerLAYER][maskMASK][trans] LAYER:={link|network|transport|0..2} meta Metadataematch meta(OBJECT{eq|lt|gt}OBJECT) OBJECT:={METAID|VALUE} METAID:=id[shiftSHIFT][maskMASK] metaattributes: random32bitrandomvalue loadavg1Loadaverageinlast5minutes nfmarkNetfiltermark vlanVlantag skrcvbufReceivebuffersize sksndqueueSendqueuelength Afulllistofmetaattributescanbeobtainedvia #tcfilteradddeveth1basicmatch’meta(list)’ iproute2 6August2012 1 ematch(8) Linux ematch(8) nbyte matchpacketdatabytesequence nbyte(NEEDLEatOFFSET[layerLAYER]) NEEDLE:={string|c-escape-sequence} OFFSET:=int LAYER:={link|network|transport|0..2} u32 u32ematch u32(ALIGNVALUEMASKat[nexthdr+]OFFSET) ALIGN:={u8|u16|u32} ipset testpacketagainstipsetmembership ipset(SETNAMEFLAGS) SETNAME:=string FLAGS:={FLAG[,FLAGS]} Theflagoptionsarethesameasthoseusedbytheiptables"set"match. Whenusingtheipsetematchwiththe"ipsethash:net,iface"settype,theinterfacecanbe queriedusing"src,dst(sourceipaddress,outgoinginterface)or"src,src"(sourceipaddress, incominginterface)syntax. CAVEATS Theematchsyntaxuses’(’and’)’togroupexpressions.Allbracesneedtobeescapedproperlyto preventshellcommandlinefrominterpretingthesedirectly. Whenusingtheipsetematchwiththe"ifb"device,theoutgoingdevicewillbetheifbdevice itself,e.g."ifb0".Theoriginalinterface(i.e.thedevicethepacketarrivedon)istreatedasthe incominginterface. EXAMPLE&USAGE #tcfilteradd..basicmatch... #’cmp(u16at3layer2mask0xff00gt20)’ #’meta(nfmarkgt24)’and’meta(tcindexmask0xf0eq0xf0)’ #’nbyte("ababa"at12layer1)’ #’u32(u160x11220xffffatnexthdr+4)’ Checkifpacketsourceipaddressismemberofsetnamedbulk: iproute2 6August2012 2 ematch(8) Linux ematch(8) #’ipset(bulksrc)’ Checkifpacketsourceipandtheinterfacethepacketarrivedonismemberof"hash:net,iface"set namedinteractive: #’ipset(interactivesrc,src)’ AUTHOR TheextendedmatchinfrastructurewasaddedbyThomasGraf. iproute2 6August2012 3