Iptables のロード可能なマッチモジュールをリストする方法

Iptables のロード可能なマッチモジュールをリストする方法

iptables(フラグの後に指定)ロード可能なすべてのモジュールをリストするにはどうすればよいですか-m

この郵便受けロード可能なモジュールをリストすることを提案する

ls /lib*/iptables/

私のバージョン ( ) にはこのフォルダがありませんv1.6.0

答え1

リンク先の投稿に記載されている内容はすべて理解できました。

  1. 利用可能なすべてのモジュールを一覧表示します。
    :~# ls /lib/modules/`uname -r`/kernel/net/netfilter/
    
  2. 読み込まれたすべてのモジュールを一覧表示します (ルールで特定のモジュールを使用しない限り、このリストには表示されません)。
    :~# cat /proc/net/ip_tables_matches
    comment
    addrtype
    mark
    conntrack
    conntrack
    conntrack
    recent
    recent
    addrtype
    udplite
    udp
    tcp
    multiport
    icmp
    
  3. のマニュアル ページでは、iptables-extensions標準の iptables ディストリビューションで利用可能な拡張機能に関する情報が提供されています。
    :~# man 8 iptables-extensions
    

答え2

gruntboy からの回答を使用して、以下の出力をスクリプト化できます。

bpf match options:
--bytecode <program>            : a bpf program as generated by
                                 $(nfbpf_compile RAW '<filter>')
--object-pinned <bpf object>    : a path to a pinned BPF object in bpf fs

cgroup match options:
[!] --path path                 Recursively match path relative to cgroup2 root
[!] --cgroup classid            Match cgroup classid, can't be used with --path

cluster match options:
  --cluster-total-nodes <num>       Set number of total nodes in cluster
  [!] --cluster-local-node <num>    Set the local node number
  [!] --cluster-local-nodemask <num>    Set the local node mask
  --cluster-hash-seed <num>     Set seed value of the Jenkins hash

comment match options:
--comment COMMENT             Attach a comment to a rule

connbytes match options:
 [!] --connbytes from:[to]
     --connbytes-dir [original, reply, both]
     --connbytes-mode [packets, bytes, avgpkt]

connlabel match options:
[!] --label name     Match if label has been set on connection
    --set            Set label on connection

connlimit match options:
  --connlimit-upto n     match if the number of existing connections is 0..n
  --connlimit-above n    match if the number of existing connections is >n
  --connlimit-mask n     group hosts using prefix length (default: max len)
  --connlimit-saddr      select source address for grouping
  --connlimit-daddr      select destination addresses for grouping

connmark match options:
[!] --mark value[/mask]    Match ctmark value with optional mask

conntrack match options:
[!] --ctstate {INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED|SNAT|DNAT}[,...]
                               State(s) to match
[!] --ctproto proto            Protocol to match; by number or name, e.g. "tcp"
[!] --ctorigsrc address[/mask]
[!] --ctorigdst address[/mask]
[!] --ctreplsrc address[/mask]
[!] --ctrepldst address[/mask]
                               Original/Reply source/destination address
[!] --ctorigsrcport port
[!] --ctorigdstport port
[!] --ctreplsrcport port
[!] --ctrepldstport port
                               TCP/UDP/SCTP orig./reply source/destination port
[!] --ctstatus {NONE|EXPECTED|SEEN_REPLY|ASSURED|CONFIRMED}[,...]
                               Status(es) to match
[!] --ctexpire time[:time]     Match remaining lifetime in seconds against
                               value or range of values (inclusive)
    --ctdir {ORIGINAL|REPLY}   Flow direction of packet

cpu match options:
[!] --cpu number   Match CPU number

devgroup match options:
[!] --src-group value[/mask]    Match device group of incoming device
[!] --dst-group value[/mask]    Match device group of outgoing device

esp match options:
[!] --espspi spi[:spi]
                match spi (range)

hashlimit match options:
  --hashlimit-upto <avg>           max average match rate
                                   [Packets per second unless followed by 
                                   /sec /minute /hour /day postfixes]
  --hashlimit-above <avg>          min average match rate
  --hashlimit-mode <mode>          mode is a comma-separated list of
                                   dstip,srcip,dstport,srcport (or none)
  --hashlimit-srcmask <length>     source address grouping prefix length
  --hashlimit-dstmask <length>     destination address grouping prefix length
  --hashlimit-name <name>          name for /proc/net/ipt_hashlimit
  --hashlimit-burst <num>       number to match in a burst, default 5
  --hashlimit-htable-size <num>    number of hashtable buckets
  --hashlimit-htable-max <num>     number of hashtable entries
  --hashlimit-htable-gcinterval    interval between garbage collection runs
  --hashlimit-htable-expire        after which time are idle entries expired?
  --hashlimit-rate-match           rate match the flow without rate-limiting it
  --hashlimit-rate-interval        interval in seconds for hashlimit-rate-match

helper match options:
[!] --helper string        Match helper identified by string

iprange match options:
[!] --src-range ip[-ip]    Match source IP in the specified range
[!] --dst-range ip[-ip]    Match destination IP in the specified range

length match options:
[!] --length length[:length]    Match packet length against value or range
                                of values (inclusive)

limit match options:
--limit avg         max average match rate: default 3/hour
                                [Packets per second unless followed by 
                                /sec /minute /hour /day postfixes]
--limit-burst number        number to match in a burst, default 5

mac match options:
[!] --mac-source XX:XX:XX:XX:XX:XX
                Match source MAC address

mark match options:
[!] --mark value[/mask]    Match nfmark value with optional mask

multiport match options:
[!] --source-ports port[,port:port,port...]
 --sports ...
                match source port(s)
[!] --destination-ports port[,port:port,port...]
 --dports ...
                match destination port(s)
[!] --ports port[,port:port,port]
                match both source and destination port(s)

nfacct match options:
 --nfacct-name STRING       Name of accouting area

owner match options:
[!] --uid-owner userid[-userid]      Match local UID
[!] --gid-owner groupid[-groupid]    Match local GID
[!] --socket-exists                  Match if socket exists
    --suppl-groups                   Also match supplementary groups set with --gid-owner

physdev match options:
 [!] --physdev-in inputname[+]      bridge port name ([+] for wildcard)
 [!] --physdev-out outputname[+]    bridge port name ([+] for wildcard)
 [!] --physdev-is-in            arrived on a bridge device
 [!] --physdev-is-out           will leave on a bridge device
 [!] --physdev-is-bridged       it's a bridged packet

pkttype match options:
[!] --pkt-type packettype    match packet type
Valid packet types:
    unicast             to us
    broadcast           to all
    multicast           to group

policy match options:
  --dir in|out          match policy applied during decapsulation/
                policy to be applied during encapsulation
  --pol none|ipsec      match policy
  --strict          match entire policy instead of single element
                at any position
These options may be used repeatedly, to describe policy elements:
[!] --reqid reqid       match reqid
[!] --spi spi           match SPI
[!] --proto proto       match protocol (ah/esp/ipcomp)
[!] --mode mode         match mode (transport/tunnel)
[!] --tunnel-src addr/mask  match tunnel source
[!] --tunnel-dst addr/mask  match tunnel destination
  --next            begin next element in policy

quota match options:
[!] --quota quota       quota (bytes)

rateest match options:
 --rateest1 name        Rate estimator name
 --rateest2 name        Rate estimator name
 --rateest-delta        Compare difference(s) to given rate(s)
 --rateest-bps1 [bps]       Compare bps
 --rateest-pps1 [pps]       Compare pps
 --rateest-bps2 [bps]       Compare bps
 --rateest-pps2 [pps]       Compare pps
 [!] --rateest-lt       Match if rate is less than given rate/estimator
 [!] --rateest-gt       Match if rate is greater than given rate/estimator
 [!] --rateest-eq       Match if rate is equal to given rate/estimator

realm match options:
[!] --realm value[/mask]
                Match realm

recent match options:
[!] --set                       Add source address to list, always matches.
[!] --rcheck                    Match if source address in list.
[!] --update                    Match if source address in list, also update last-seen time.
[!] --remove                    Match if source address in list, also removes that address from list.
    --seconds seconds           For check and update commands above.
                                Specifies that the match will only occur if source address last seen within
                                the last 'seconds' seconds.
    --reap                      Purge entries older then 'seconds'.
                                Can only be used in conjunction with the seconds option.
    --hitcount hits             For check and update commands above.
                                Specifies that the match will only occur if source address seen hits times.
                                May be used in conjunction with the seconds option.
    --rttl                      For check and update commands above.
                                Specifies that the match will only occur if the source address and the TTL
                                match between this packet and the one which was set.
                                Useful if you have problems with people spoofing their source address in order
                                to DoS you via this module.
    --name name                 Name of the recent list to be used.  DEFAULT used if none given.
    --rsource                   Match/Save the source address of each packet in the recent list table (default).
    --rdest                     Match/Save the destination address of each packet in the recent list table.
    --mask netmask              Netmask that will be applied to this recent list.
xt_recent by: Stephen Frost <[email protected]>.

set match options:
 [!] --match-set name flags [--return-nomatch]
   [! --update-counters] [! --update-subcounters]
   [[!] --packets-eq value | --packets-lt value | --packets-gt value
   [[!] --bytes-eq value | --bytes-lt value | --bytes-gt value
         'name' is the set name from to match,
         'flags' are the comma separated list of
         'src' and 'dst' specifications.

socket match options:
  --nowildcard     Do not ignore LISTEN sockets bound on INADDR_ANY
  --transparent    Ignore non-transparent sockets
  --restore-skmark Set the packet mark to the socket mark if
                   the socket matches and transparent / 
                   nowildcard conditions are satisfied

state match options:
 [!] --state [INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED][,...]
                State(s) to match

statistic match options:
 --mode mode                    Match mode (random, nth)
 random mode:
[!] --probability p      Probability
 nth mode:
[!] --every n            Match every nth packet
 --packet p          Initial counter value (0 <= p <= n-1, default 0)

string match options:
--from                       Offset to start searching from
--to                         Offset to stop searching
--algo                       Algorithm
--icase                      Ignore case (default: 0)
[!] --string string          Match a string in a packet
[!] --hex-string string      Match a hex string in a packet

tcp match options:
[!] --tcp-flags mask comp   match when TCP flags & mask == comp
                (Flags: SYN ACK FIN RST URG PSH ALL NONE)
[!] --syn           match when only SYN flag set
                (equivalent to --tcp-flags SYN,RST,ACK,FIN SYN)
[!] --source-port port[:port]
 --sport ...
                match source port(s)
[!] --destination-port port[:port]
 --dport ...
                match destination port(s)
[!] --tcp-option number        match if TCP option set

tcpmss match options:
[!] --mss value[:value] Match TCP MSS range.
                (only valid for TCP SYN or SYN/ACK packets)

time match options:
    --datestart time     Start and stop time, to be given in ISO 8601
    --datestop time      (YYYY[-MM[-DD[Thh[:mm[:ss]]]]])
    --timestart time     Start and stop daytime (hh:mm[:ss])
    --timestop time      (between 00:00:00 and 23:59:59)
[!] --monthdays value    List of days on which to match, separated by comma
                         (Possible days: 1 to 31; defaults to all)
[!] --weekdays value     List of weekdays on which to match, sep. by comma
                         (Possible days: Mon,Tue,Wed,Thu,Fri,Sat,Sun or 1 to 7
                         Defaults to all weekdays.)
    --kerneltz           Work with the kernel timezone instead of UTC

u32 match options:
[!] --u32 tests
        tests := location "=" value | tests "&&" location "=" value
        value := range | value "," range
        range := number | number ":" number
        location := number | location operator number
        operator := "&" | "<<" | ">>" | "@"

udp match options:
[!] --source-port port[:port]
 --sport ...
                match source port(s)
[!] --destination-port port[:port]
 --dport ...
                match destination port(s)

関連情報