# meta protocol { ip, arp, ip6, vlan }
[
{
"match": {
"left": {
"meta": { "key": "protocol" }
},
"op": "==",
"right": {
"set": [
"ip",
"arp",
"vlan",
"ip6"
]
}
}
}
]
# meta protocol != {ip, arp, ip6, vlan}
[
{
"match": {
"left": {
"meta": { "key": "protocol" }
},
"op": "!=",
"right": {
"set": [
"ip",
"arp",
"vlan",
"ip6"
]
}
}
}
]
# meta priority 0x87654321
[
{
"match": {
"left": {
"meta": { "key": "priority" }
},
"op": "==",
"right": "8765:4321"
}
}
]
# meta priority 2271560481
[
{
"match": {
"left": {
"meta": { "key": "priority" }
},
"op": "==",
"right": "8765:4321"
}
}
]
# meta priority {bcad:dada, bcad:dadc, aaaa:bbbb}
[
{
"match": {
"left": {
"meta": { "key": "priority" }
},
"op": "==",
"right": {
"set": [
"aaaa:bbbb",
"bcad:dada",
"bcad:dadc"
]
}
}
}
]
# meta mark 0x4
[
{
"match": {
"left": {
"meta": { "key": "mark" }
},
"op": "==",
"right": 4
}
}
]
# meta mark 0x32
[
{
"match": {
"left": {
"meta": { "key": "mark" }
},
"op": "==",
"right": 50
}
}
]
# meta mark and 0x03 == 0x01
[
{
"match": {
"left": {
"&": [
{
"meta": { "key": "mark" }
},
3
]
},
"op": "==",
"right": 1
}
}
]
# meta mark and 0x03 != 0x01
[
{
"match": {
"left": {
"&": [
{
"meta": { "key": "mark" }
},
3
]
},
"op": "!=",
"right": 1
}
}
]
# meta mark 0x10
[
{
"match": {
"left": {
"meta": { "key": "mark" }
},
"op": "==",
"right": 16
}
}
]
# meta mark != 0x10
[
{
"match": {
"left": {
"meta": { "key": "mark" }
},
"op": "!=",
"right": 16
}
}
]
# meta mark or 0x03 == 0x01
[
{
"match": {
"left": {
"|": [
{
"meta": { "key": "mark" }
},
3
]
},
"op": "==",
"right": 1
}
}
]
# meta mark or 0x03 != 0x01
[
{
"match": {
"left": {
"|": [
{
"meta": { "key": "mark" }
},
3
]
},
"op": "!=",
"right": 1
}
}
]
# meta mark xor 0x03 == 0x01
[
{
"match": {
"left": {
"meta": { "key": "mark" }
},
"op": "==",
"right": 2
}
}
]
# meta mark xor 0x03 != 0x01
[
{
"match": {
"left": {
"meta": { "key": "mark" }
},
"op": "!=",
"right": 2
}
}
]
# meta iifname {"dummy0", "lo"}
[
{
"match": {
"left": {
"meta": { "key": "iifname" }
},
"op": "==",
"right": {
"set": [
"lo",
"dummy0"
]
}
}
}
]
# meta iifname != {"dummy0", "lo"}
[
{
"match": {
"left": {
"meta": { "key": "iifname" }
},
"op": "!=",
"right": {
"set": [
"lo",
"dummy0"
]
}
}
}
]
# meta oifname { "dummy0", "lo"}
[
{
"match": {
"left": {
"meta": { "key": "oifname" }
},
"op": "==",
"right": {
"set": [
"lo",
"dummy0"
]
}
}
}
]
# meta skuid {"bin", "root", "daemon"} accept
[
{
"match": {
"left": {
"meta": { "key": "skuid" }
},
"op": "==",
"right": {
"set": [ 0, 1, 2 ]
}
}
},
{
"accept": null
}
]
# meta skuid != {"bin", "root", "daemon"} accept
[
{
"match": {
"left": {
"meta": { "key": "skuid" }
},
"op": "!=",
"right": {
"set": [ 0, 1, 2 ]
}
}
},
{
"accept": null
}
]
# meta skuid "root"
[
{
"match": {
"left": {
"meta": { "key": "skuid" }
},
"op": "==",
"right": 0
}
}
]
# meta skuid != "root"
[
{
"match": {
"left": {
"meta": { "key": "skuid" }
},
"op": "!=",
"right": 0
}
}
]
# meta skgid {"bin", "root", "daemon"} accept
[
{
"match": {
"left": {
"meta": { "key": "skgid" }
},
"op": "==",
"right": {
"set": [ 0, 1, 2 ]
}
}
},
{
"accept": null
}
]
# meta skgid != {"bin", "root", "daemon"} accept
[
{
"match": {
"left": {
"meta": { "key": "skgid" }
},
"op": "!=",
"right": {
"set": [ 0, 1, 2 ]
}
}
},
{
"accept": null
}
]
# meta skgid "root"
[
{
"match": {
"left": {
"meta": { "key": "skgid" }
},
"op": "==",
"right": 0
}
}
]
# meta skgid != "root"
[
{
"match": {
"left": {
"meta": { "key": "skgid" }
},
"op": "!=",
"right": 0
}
}
]
# meta mark set 0xffffffc8 xor 0x16
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 4294967262
}
}
]
# meta mark set 0x16 and 0x16
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 22
}
}
]
# meta mark set 0xffffffe9 or 0x16
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 4294967295
}
}
]
# meta mark set 0xffffffde and 0x16
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 22
}
}
]
# meta mark set 0xf045ffde or 0x10
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 4031119326
}
}
]
# meta mark set 0xffffffde or 0x16
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 4294967262
}
}
]
# meta mark set 0x32 or 0xfffff
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 1048575
}
}
]
# meta mark set 0xfffe xor 0x16
[
{
"mangle": {
"key": {
"meta": { "key": "mark" }
},
"value": 65512
}
}
]
# meta iifgroup 0
[
{
"match": {
"left": {
"meta": { "key": "iifgroup" }
},
"op": "==",
"right": "default"
}
}
]
# meta iifgroup != 0
[
{
"match": {
"left": {
"meta": { "key": "iifgroup" }
},
"op": "!=",
"right": "default"
}
}
]
# meta oifgroup 0
[
{
"match": {
"left": {
"meta": { "key": "oifgroup" }
},
"op": "==",
"right": "default"
}
}
]
# meta oifgroup != 0
[
{
"match": {
"left": {
"meta": { "key": "oifgroup" }
},
"op": "!=",
"right": "default"
}
}
]
# meta iif . meta oif . meta mark { "lo" . "lo" . 0x0000000a }
[
{
"match": {
"left": {
"concat": [
{
"meta": { "key": "iif" }
},
{
"meta": { "key": "oif" }
},
{
"meta": { "key": "mark" }
}
]
},
"op": "==",
"right": {
"set": [
{
"concat": [
"lo",
"lo",
10
]
}
]
}
}
}
]
# meta time "1970-05-23 21:07:14" drop
[
{
"match": {
"left": {
"meta": {
"key": "time"
}
},
"op": "==",
"right": "1970-05-23 21:07:14"
}
},
{
"drop": null
}
]
# meta time 12341234 drop
[
{
"match": {
"left": {
"meta": {
"key": "time"
}
},
"op": "==",
"right": "1970-05-23 21:07:14"
}
},
{
"drop": null
}
]
# meta time "2019-06-21 17:00:00" drop
[
{
"match": {
"left": {
"meta": {
"key": "time"
}
},
"op": "==",
"right": "2019-06-21 17:00:00"
}
},
{
"drop": null
}
]
# meta time "2019-07-01 00:00:00" drop
[
{
"match": {
"left": {
"meta": {
"key": "time"
}
},
"op": "==",
"right": "2019-07-01 00:00:00"
}
},
{
"drop": null
}
]
# meta time "2019-07-01 00:01:00" drop
[
{
"match": {
"left": {
"meta": {
"key": "time"
}
},
"op": "==",
"right": "2019-07-01 00:01:00"
}
},
{
"drop": null
}
]
# meta time "2019-07-01 00:00:01" drop
[
{
"match": {
"left": {
"meta": {
"key": "time"
}
},
"op": "==",
"right": "2019-07-01 00:00:01"
}
},
{
"drop": null
}
]
# meta day "Saturday" drop
[
{
"match": {
"left": {
"meta": {
"key": "day"
}
},
"op": "==",
"right": "Saturday"
}
},
{
"drop": null
}
]
# meta day 6 drop
[
{
"match": {
"left": {
"meta": {
"key": "day"
}
},
"op": "==",
"right": "Saturday"
}
},
{
"drop": null
}
]
# meta hour "17:00" drop
[
{
"match": {
"left": {
"meta": {
"key": "hour"
}
},
"op": "==",
"right": "17:00"
}
},
{
"drop": null
}
]
# meta hour "17:00:00" drop
[
{
"match": {
"left": {
"meta": {
"key": "hour"
}
},
"op": "==",
"right": "17:00"
}
},
{
"drop": null
}
]
# meta hour "17:00:01" drop
[
{
"match": {
"left": {
"meta": {
"key": "hour"
}
},
"op": "==",
"right": "17:00:01"
}
},
{
"drop": null
}
]
# meta hour "00:00" drop
[
{
"match": {
"left": {
"meta": {
"key": "hour"
}
},
"op": "==",
"right": "00:00"
}
},
{
"drop": null
}
]
# meta hour "00:01" drop
[
{
"match": {
"left": {
"meta": {
"key": "hour"
}
},
"op": "==",
"right": "00:01"
}
},
{
"drop": null
}
]