ematch(8)

okay bestie, welcome to ematch(8) on Linux 💖 this is the page for extended matches, the fancy little rules you bolt onto basic, cgroup or flow filters ✨

✨ NAME ✨

ematch is the extended match system for the basic, cgroup or flow filters. It's giving precision 💅

✨ SYNOPSIS ✨

tc filter add .. basic match EXPR .. flowid ..

EXPR := TERM [ { and | or } EXPR ]

TERM := [ not ] { MATCH | '(' EXPR ')' }

MATCH := module '(' ARGS ')'

ARGS := ARG1 ARG2 ..

✨ MATCHES ✨

Okay so here's the menu of matches you can pick from 🍓

💜 cmp

Simple comparison ematch. It does an arithmetic compare of packet data against a value you give it, so you're basically asking "is this bigger, smaller, or equal?" 🦋

cmp( ALIGN at OFFSET [ ATTRS ] { eq | lt | gt } VALUE )

ALIGN := { u8 | u16 | u32 }

ATTRS := [ layer LAYER ] [ mask MASK ] [ trans ]

LAYER := { link | network | transport | 0..2 }

🌸 meta

Metadata ematch. It checks metadata about the packet instead of the bytes 🧚

meta( OBJECT { eq | lt |gt } OBJECT )

OBJECT := { META_ID |  VALUE }

META_ID := id [ shift SHIFT ] [ mask MASK ]

Here are the meta attributes you can use:

• random — a random 32 bit value 🎲
• loadavg_1 — load average over the last 5 minutes
• nf_mark — the Netfilter mark 🔥
• vlan — the VLAN tag
• sk_rcvbuf — the receive buffer size
• sk_snd_queue — the send queue length

Want the full list? Just run this and it'll spill all the tea:

# tc filter add dev eth1 basic match 'meta(list)'

🎀 nbyte

Matches a packet data byte sequence. Basically you hunt for a specific string of bytes 🔍

nbyte( NEEDLE at OFFSET [ layer LAYER ] )

NEEDLE := { string | c-escape-sequence  }

OFFSET := int

LAYER := { link | network | transport | 0..2 }

🫶 u32

The u32 ematch, bestie. Pretty straightforward 💅

u32( ALIGN VALUE MASK at [ nexthdr+ ] OFFSET )

ALIGN := { u8 | u16 | u32 }

🌈 ipset

Tests a packet for ipset membership ✨

ipset( SETNAME FLAGS )

SETNAME := string

FLAGS := { FLAG [, FLAGS] }

The flag options are the same ones you'd use with the iptables "set" match, so if you already know that, you're set 🙈

When you use the ipset ematch with the "ip_set_hash:net,iface" set type, you can query the interface with "src,dst" (source ip address, outgoing interface) or "src,src" (source ip address, incoming interface) syntax 🦋

👑 ipt

Tests a packet against xtables matches 👑

ipt( [-6] -m MATCH_NAME FLAGS )

MATCH_NAME := string

FLAGS := { FLAG [, FLAGS] }

The flag options are the same ones the xtables match you picked uses. So check that match's flags and you're golden ⭐

🧚 canid

ematch rule to match CAN frames 🚗

canid( IDLIST )

IDLIST :=  IDSPEC[IDLIST]

IDSPEC := { ’sff’ CANID | ’eff’ CANID }

CANID := ID[:MASK]

ID, MASK := hexadecimal number (i.e. 0x123)

✨ CAVEATS ✨

bestie, read this part carefully 😭 The ematch syntax uses '(' and ')' to group expressions. All braces need to be escaped properly so the shell commandline doesn't grab them and mess everything up 💀

When you use the ipset ematch with the "ifb" device, the outgoing device will be the ifb device itself, e.g. "ifb0". The original interface (i.e. the device the packet arrived on) is treated as the incoming interface.

✨ EXAMPLE & USAGE ✨

Here's the vibe. You start every one of these with the usual filter command 💖

# tc filter add .. basic match ...

# 'cmp(u16 at 3 layer 2 mask 0xff00 gt 20)'

# 'meta(nfmark gt 24)' and 'meta(tcindex mask 0xf0 eq 0xf0)'

# 'nbyte("ababa" at 12 layer 1)'

# 'u32(u16 0x1122 0xffff at nexthdr+4)'

Check if the packet's source ip address is a member of the set named bulk:

# 'ipset(bulk src)'

Check if the packet's source ip and the interface it arrived on are a member of the "hash:net,iface" set named interactive:

# 'ipset(interactive src,src)'

Check if the packet matches an IPSec state with reqid 1:

# 'ipt(-m policy --dir in --pol ipsec --reqid 1)'

✨ AUTHOR ✨

The extended match infrastructure was added by Thomas Graf. Iconic behavior 👑

---

that's the whole page, bestie 🫶 it's from iproute2, dated 6 August 2012, and the manual is ematch(8). stay iconic 💅✨