title: krb5.conf(5)

summary: Kerberos configuration file

text:
# krb5.conf(5)

## NAME
krb5.conf - Kerberos configuration file

The krb5.conf file contains Kerberos configuration information, including the locations of KDCs and admin servers for the Kerberos realms of interest, defaults for the current realm and for Kerberos applications, and mappings of hostnames onto Kerberos realms. Normally, you should install your krb5.conf file in the directory /etc. You can override the default location by setting the environment variable KRB5_CONFIG. Multiple colon-separated filenames may be specified in KRB5_CONFIG; all files which are present will be read. Starting in release 1.14, directory names can also be specified in KRB5_CONFIG; all files within the directory whose names consist solely of alphanumeric characters, dashes, or underscores will be read.

## STRUCTURE
The krb5.conf file is set up in the style of a Windows INI file. Lines beginning with '#' or ';' (possibly after initial whitespace) are ignored as comments. Sections are headed by the section name, in square brackets. Each section may contain zero or more relations, of the form:

```
foo = bar
```

or:

```
fubar = {

    foo = bar

    baz = quux
}
```

Placing a '*' after the closing bracket of a section name indicates that the section is final, meaning that if the same section appears within a later file specified in KRB5_CONFIG, it will be ignored. A subsection can be marked as final by placing a '*' after either the tag name or the closing brace.

The krb5.conf file can include other files using either of the following directives at the beginning of a line:

```
include FILENAME
includedir DIRNAME
```

FILENAME or DIRNAME should be an absolute path. The named file or directory must exist and be readable. Including a directory includes all files within the directory whose names consist solely of alphanumeric characters, dashes, or underscores. Starting in release 1.15, files with names ending in ".conf" are also included, unless the name begins with ".". Included profile files are syntactically independent of their parents, so each included file must begin with a section header. Starting in release 1.17, files are read in alphanumeric order; in previous releases, they may be read in any order.

The krb5.conf file can specify that configuration should be obtained from a loadable module, rather than the file itself, using the following directive at the beginning of a line before any section headers:

```
module MODULEPATH:RESIDUAL
```

MODULEPATH may be relative to the library path of the krb5 installation, or it may be an absolute path. RESIDUAL is provided to the module at initialization time. If krb5.conf uses a module directive, kdc.conf(5) should also use one if it exists.

## SECTIONS
The krb5.conf file may contain the following sections:

[libdefaults]

Settings used by the Kerberos V5 library

[realms]

Realm-specific contact information and settings

[domain_realm]

Maps server hostnames to Kerberos realms

[capaths]

Authentication paths for non-hierarchical cross-realm

[appdefaults]

Settings used by some Kerberos V5 applications

[plugins]

Controls plugin module registration

Additionally, krb5.conf may include any of the relations described in kdc.conf(5), but it is not a recommended practice.

### [libdefaults]
The libdefaults section may contain any of the following relations:

allow_des3

Permit the KDC to issue tickets with des3-cbc-sha1 session keys. In future releases, this flag will allow des3-cbc-sha1 to be used at all. The default value for this tag is false. (Added in release 1.21.)

allow_rc4

Permit the KDC to issue tickets with arcfour-hmac session keys. In future releases, this flag will allow arcfour-hmac to be used at all. The default value for this tag is false. (Added in release 1.21.)

allow_weak_crypto

If this flag is set to false, then weak encryption types (as noted in Encryption_types in kdc.conf(5)) will be filtered out of the lists default_tgs_enctypes, default_tkt_enctypes, and permitted_enctypes. The default value for this tag is false.

canonicalize

If this flag is set to true, initial ticket requests to the KDC will request canonicalization of the client principal name, and answers with different client principals than the requested principal will be accepted. The default value is false.

ccache_type

This parameter determines the format of credential cache types created by kinit(1) or other programs. The default value is 4, which represents the most current format. Smaller values can be used for compatibility with very old implementations of Kerberos which interact with credential caches on the same host.

clockskew

Sets the maximum allowable amount of clockskew in seconds that the library will tolerate before assuming that a Kerberos message is invalid. The default value is 300 seconds, or five minutes. The clockskew setting is also used when evaluating ticket start and expiration times. For example, tickets that have reached their expiration time can still be used (and renewed if they are renewable tickets) if they have been expired for a shorter duration than the clockskew setting.

default_ccache_name

This relation specifies the name of the default credential cache. The default is FILE:/tmp/krb5cc_%{uid}. This relation is subject to parameter expansion (see below). New in release 1.11.

default_client_keytab_name

This relation specifies the name of the default keytab for obtaining client credentials. The default is FILE:/var/lib/kerberos/krb5/user/%{euid}/client.keytab. This relation is subject to parameter expansion (see below). New in release 1.11.

default_keytab_name

This relation specifies the default keytab name to be used by application servers such as sshd. The default is FILE:/etc/krb5.keytab. This relation is subject to parameter expansion (see below).

default_rcache_name

This relation specifies the name of the default replay cache. The default is dfl:. This relation is subject to parameter expansion (see below). New in release 1.18.

default_realm

Identifies the default Kerberos realm for the client. Set its value to your Kerberos realm. If this value is not set, then a realm must be specified with every Kerberos principal when invoking programs such as kinit(1).

default_tgs_enctypes

Identifies the supported list of session key encryption types that the client should request when making a TGS-REQ, in order of preference from highest to lowest. The list may be delimited with commas or whitespace. See Encryption_types in kdc.conf(5) for a list of the accepted values for this tag. Starting in release 1.18, the default value is the value of permitted_enctypes. For previous releases or if permitted_enctypes is not set, the default value is aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac. Do not set this unless required for specific backward compatibility purposes; stale values of this setting can prevent clients from taking advantage of new stronger enctypes when the libraries are upgraded.

default_tkt_enctypes

Identifies the supported list of session key encryption types that the client should request when making an AS-REQ, in order of preference from highest to lowest. The format is the same as for default_tgs_enctypes. Starting in release 1.18, the default value is the value of permitted_enctypes. For previous releases or if permitted_enctypes is not set, the default value is aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac. Do not set this unless required for specific backward compatibility purposes; stale values of this setting can prevent clients from taking advantage of new stronger enctypes when the libraries are upgraded.

dns_canonicalize_hostname

Indicate whether name lookups will be used to canonicalize hostnames for use in service principal names. Setting this flag to false can improve security by reducing reliance on DNS, but means that short hostnames will not be canonicalized to fully-qualified hostnames. If this option is set to fallback (new in release 1.18), DNS canonicalization will only be performed the server hostname is not found with the original name when requesting credentials. The default value is true.

dns_lookup_kdc

Indicate whether DNS SRV records should be used to locate the KDCs and other servers for a realm, if they are not listed in the krb5.conf information for the realm. (Note that the admin_server entry must be in the krb5.conf realm information in order to contact kadmind, because the DNS implementation for kadmin is incomplete.) Enabling this option does open up a type of denial-of-service attack, if someone spoofs the DNS records and redirects you to another server. However, it's no worse than a denial of service, because that fake KDC will be unable to decode anything you send it (besides the initial ticket request, which has no encrypted data), and anything the fake KDC sends will not be trusted without verification using some secret that it won't know.

dns_uri_lookup

Indicate whether DNS URI records should be used to locate the KDCs and other servers for a realm, if they are not listed in the krb5.conf information for the realm. SRV records are used as a fallback if no URI records were found. The default value is true. New in release 1.15.

enforce_ok_as_delegate

If this flag to true, GSSAPI credential delegation will be disabled when the ok-as-delegate flag is not set in the service ticket. If this flag is false, the ok-as-delegate ticket flag is only enforced when an application specifically requests enforcement. The default value is false.

err_fmt

This relation allows for custom error message formatting. If a value is set, error messages will be formatted by substituting a normal error message for %M and an error code for %C in the value.

extra_addresses

This allows a computer to use multiple local addresses, in order to allow Kerberos to work in a network that uses NATs while still using address-restricted tickets. The addresses should be in a comma-separated list. This option has no effect if noaddresses is true.

forwardable

If this flag is true, initial tickets will be forwardable by default, if allowed by the KDC. The default value is false.

ignore_acceptor_hostname

When accepting GSSAPI or krb5 security contexts for host-based service principals, ignore any hostname passed by the calling application, and allow clients to authenticate to any service principal in the keytab matching the service name and realm name (if given). This option can improve the administrative flexibility of server applications on multihomed hosts, but could compromise the security of virtual hosting environments. The default value is false. New in release 1.10.

k5login_authoritative

If this flag is true, principals must be listed in a local user's k5login file to be granted login access, if a .k5login(5) file exists. If this flag is false, a principal may still be granted login access through other mechanisms even if a k5login file exists but does not list the principal. The default value is true.

k5login_directory

If set, the library will look for a local user's k5login file within the named directory, with a filename corresponding to the local username. If not set, the library will look for k5login files in the user's home directory, with the filename .k5login. For security reasons, .k5login files must be owned by the local user or by root.

kcm_mach_service

On macOS only, determines the name of the bootstrap service used to contact the KCM daemon for the KCM credential cache type. If the value is -, Mach RPC will not be used to contact the KCM daemon. The default value is org.h5l.kcm.

kcm_socket

Determines the path to the Unix domain socket used to access the KCM daemon for the KCM credential cache type. If the value is -, Unix domain sockets will not be used to contact the KCM daemon. The default value is /var/run/.heim_org.h5l.kcm-socket.

kdc_default_options

Default KDC options (Xored for multiple values) when requesting initial tickets. By default it is set to 0x00000010 (KDC_OPT_RENEWABLE_OK).

kdc_timesync

Accepted values for this relation are 1 or 0. If it is nonzero, client machines will compute the difference between their time and the time returned by the KDC in the timestamps in the tickets and use this value to correct for an inaccurate system clock when requesting service tickets or authenticating to services. This corrective factor is only used by the Kerberos library; it is not used to change the system clock. The default value is 1.

noaddresses

If this flag is true, requests for initial tickets will not be made with address restrictions set, allowing the tickets to be used across NATs. The default value is true.

permitted_enctypes

Identifies the encryption types that servers will permit for session keys and for ticket and authenticator encryption, ordered by preference from highest to lowest. Starting in release 1.18, this tag also acts as the default value for default_tgs_enctypes and default_tkt_enctypes. The default value for this tag is aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac.

plugin_base_dir

If set, determines the base directory where krb5 plugins are located. The default value is the krb5/plugins subdirectory of the krb5 library directory. This relation is subject to parameter expansion (see below) in release 1.17 and later.

preferred_preauth_types

This allows you to set the preferred preauthentication types which the client will attempt before others which may be advertised by a KDC. The default value for this setting is "17, 16, 15, 14", which forces libkrb5 to attempt to use PKINIT if it is supported.

proxiable

If this flag is true, initial tickets will be proxiable by default, if allowed by the KDC. The default value is false.

qualify_shortname

If this string is set, it determines the domain suffix for single-component hostnames when DNS canonicalization is not used (either because dns_canonicalize_hostname is false or because forward canonicalization failed). The default value is the first search domain of the system's DNS configuration. To disable qualification of shortnames, set this relation to the empty string with qualify_shortname = "". (New in release 1.18.)

rdns

If this flag is true, reverse name lookup will be used in addition to forward name lookup to canonicalizing hostnames for use in service principal names. If dns_canonicalize_hostname is set to false, this flag has no effect. The default value is true.

realm_try_domains

Indicate whether a host's domain components should be used to determine the Kerberos realm of the host. The value of this variable is an integer: -1 means not to search, 0 means to try the host's domain itself, 1 means to also try the domain's immediate parent, and so forth. The library's usual mechanism for locating Kerberos realms is used to determine whether a domain is a valid realm, which may involve consulting DNS if dns_lookup_kdc is set. The default is not to search domain components.

renew_lifetime

(duration string.) Sets the default renewable lifetime for initial ticket requests. The default value is 0.

spake_preauth_groups

A whitespace or comma-separated list of words which specifies the groups allowed for SPAKE preauthentication. The possible values are: edwards25519

Edwards25519 curve (RFC 7748)

P-256

NIST P-256 curve (RFC 5480)

P-384

NIST P-384 curve (RFC 5480)

P-521

NIST P-521 curve (RFC 5480)

The default value for the client is edwards25519. The default value for the KDC is empty. New in release 1.17.

ticket_lifetime

(duration string.) Sets the default lifetime for initial ticket requests. The default value is 1 day.

udp_preference_limit

When sending a message to the KDC, the library will try using TCP before UDP if the size of the message is above udp_preference_limit. If the message is smaller than udp_preference_limit, then UDP will be tried before TCP. Regardless of the size, both protocols will be tried if the first attempt fails.

verify_ap_req_nofail

If this flag is true, then an attempt to verify initial credentials will fail if the client machine does not have a keytab. The default value is false.

client_aware_channel_bindings

If this flag is true, then all application protocol authentication requests will be flagged to indicate that the application supports channel bindings when operating over a secure channel. The default value is false.

### [realms]
Each tag in the [realms] section of the file is the name of a Kerberos realm. The value of the tag is a subsection with relations that define the properties of that particular realm. For each realm, the following tags may be specified in the realm's subsection:

admin_server

Identifies the host where the administration server is running. Typically, this is the primary Kerberos server. This tag must be given a value in order to communicate with the kadmind(8) server for the realm.

auth_to_local

This tag allows you to set a general rule for mapping principal names to local user names. It will be used if there is not an explicit mapping for the principal name that is being translated. The possible values are:

RULE:exp

The local name will be formulated from exp. The format for exp is [n:string](regexp)s/pattern/replacement/g. The integer n indicates how many components the target principal should have. If this matches, then a string will be formed from string, substituting the realm of the principal for $0 and the n'th component of the principal for $n (e.g., if the principal was johndoe/admin then [2:$2$1foo] would result in the string adminjohndoefoo). If this string matches regexp, then the s//[g] substitution command will be run over the string. The optional g will cause the substitution to be global over the string, instead of replacing only the first match in the string.

DEFAULT

The principal name will be used as the local user name. If the principal has more than one component or is not in the default realm, this rule is not applicable and the conversion will fail.

For example:

```
[realms]

    ATHENA.MIT.EDU = {

        auth_to_local = RULE:[2:$1](johndoe)s/^.*$/guest/

        auth_to_local = RULE:[2:$1;$2](^.*;admin$)s/;admin$//

        auth_to_local = RULE:[2:$2](^.*;root)s/^.*$/root/

        auth_to_local = DEFAULT

    }
```

would result in any principal without root or admin as the second component to be translated with the default rule. A principal with a second component of admin will become its first component. root will be used as the local name for any principal with a second component of root. The exception to these two rules are any principals johndoe/*, which will always get the local name guest.

auth_to_local_names

This subsection allows you to set explicit mappings from principal names to local user names. The tag is the mapping name, and the value is the corresponding local user name.

default_domain

This tag specifies the domain used to expand hostnames when translating Kerberos 4 service principals to Kerberos 5 principals (for example, when converting rcmd.hostname to host/hostname.domain).

disable_encrypted_timestamp

If this flag is true, the client will not perform encrypted timestamp preauthentication if requested by the KDC. Setting this flag can help to prevent dictionary attacks by active attackers, if the realm's KDCs support SPAKE preauthentication or if initial authentication always uses another mechanism or always uses FAST. This flag persists across client referrals during initial authentication. This flag does not prevent the KDC from offering encrypted timestamp. New in release 1.17.

http_anchors

When KDCs and kpasswd servers are accessed through HTTPS proxies, this tag can be used to specify the location of the CA certificate which should be trusted to issue the certificate for a proxy server. If left unspecified, the system-wide default set of CA certificates is used. The syntax for values is similar to that of values for the pkinit_anchors tag:

FILE: filename

filename is assumed to be the name of an OpenSSL-style ca-bundle file.

DIR: dirname

dirname is assumed to be an directory which contains CA certificates. All files in the directory will be examined; if they contain certificates (in PEM format), they will be used.

ENV: envvar

envvar specifies the name of an environment variable which has been set to a value conforming to one of the previous values. For example, ENV:X509_PROXY_CA, where environment variable X509_PROXY_CA has been set to FILE:/tmp/my_proxy.pem.

kdc

The name or address of a host running a KDC for that realm. An optional port number, separated from the hostname by a colon, may be included. If the name or address contains colons (for example, if it is an IPv6 address), enclose it in square brackets to distinguish the colon from a port separator. For your computer to be able to communicate with the KDC for each realm, this tag must be given a value in each realm subsection in the configuration file, or there must be DNS SRV records specifying the KDCs.

kpasswd_server

Points to the server where all the password changes are performed. If there is no such entry, DNS will be queried (unless forbidden by dns_lookup_kdc). Finally, port 464 on the admin_server host will be tried.

master_kdc

The name for primary_kdc prior to release 1.19. Its value is used as a fallback if primary_kdc is not specified.

primary_kdc

Identifies the primary KDC(s). Currently, this tag is used in only one case: If an attempt to get credentials fails because of an invalid password, the client software will attempt to contact the primary KDC, in case the user's password has just been changed, and the updated database has not been propagated to the replica servers yet. New in release 1.19.

v4_instance_convert

This subsection allows the administrator to configure exceptions to the default_domain mapping rule. It contains V4 instances (the tag name) which should be translated to some specific hostname (the tag value) as the second component in a Kerberos V5 principal name.

v4_realm

This relation is used by the krb524 library routines when converting a V5 principal name to a V4 principal name. It is used when the V4 realm name and the V5 realm name are not the same, but still share the same principal names and passwords. The tag value is the Kerberos V4 realm name.

### [domain_realm]
The [domain_realm] section provides a translation from hostnames to Kerberos realms. Each tag is a domain name, providing the mapping for that domain and all subdomains. If the tag begins with a period (.) then it applies only to subdomains. The Kerberos realm may be identified either in the realms section or using DNS SRV records. Tag names should be in lower case. For example:

```
[domain_realm]

    crash.mit.edu = TEST.ATHENA.MIT.EDU

    .dev.mit.edu = TEST.ATHENA.MIT.EDU

    mit.edu = ATHENA.MIT.EDU
```

maps the host with the name crash.mit.edu into the TEST.ATHENA.MIT.EDU realm. The second entry maps all hosts under the domain dev.mit.edu into the TEST.ATHENA.MIT.EDU realm, but not the host with the name dev.mit.edu. That host is matched by the third entry, which maps the host mit.edu and all hosts under the domain mit.edu that do not match a preceding rule into the realm ATHENA.MIT.EDU.

If no translation entry applies to a hostname used for a service principal for a service ticket request, the library will try to get a referral to the appropriate realm from the client realm's KDC. If that does not succeed, the host's realm is considered to be the hostname's domain portion converted to uppercase, unless the realm_try_domains setting in [libdefaults] causes a different parent domain to be used.

### [capaths]
In order to perform direct (non-hierarchical) cross-realm authentication, configuration is needed to determine the authentication paths between realms.

A client will use this section to find the authentication path between its realm and the realm of the server. The server will use this section to verify the authentication path used by the client, by checking the transited field of the received ticket.

There is a tag for each participating client realm, and each tag has subtags for each of the server realms. The value of the subtags is an intermediate realm which may participate in the cross-realm authentication. The subtags may be repeated if there is more then one intermediate realm. A value of "." means that the two realms share keys directly, and no intermediate realms should be allowed to participate.

Only those entries which will be needed on the client or the server need to be present. A client needs a tag for its local realm with subtags for all the realms of servers it will need to authenticate to. A server needs a tag for each realm of the clients it will serve, with a subtag of the server realm.

For example, ANL.GOV, PNL.GOV, and NERSC.GOV all wish to use the ES.NET realm as an intermediate realm. ANL has a sub realm of TEST.ANL.GOV which will authenticate with NERSC.GOV but not PNL.GOV. The [capaths] section for ANL.GOV systems would look like this:

```
[capaths]

    ANL.GOV = {

        TEST.ANL.GOV = .

        PNL.GOV = ES.NET

        NERSC.GOV = ES.NET

        ES.NET = .

    }

    TEST.ANL.GOV = {

        ANL.GOV = .

    }

    PNL.GOV = {

        ANL.GOV = ES.NET

    }

    NERSC.GOV = {

        ANL.GOV = ES.NET

    }

    ES.NET = {

        ANL.GOV = .

    }
```

The [capaths] section of the configuration file used on NERSC.GOV systems would look like this:

```
[capaths]

    NERSC.GOV = {

        ANL.GOV = ES.NET

        TEST.ANL.GOV = ES.NET

        TEST.ANL.GOV = ANL.GOV

        PNL.GOV = ES.NET

        ES.NET = .

    }

    ANL.GOV = {

        NERSC.GOV = ES.NET

    }

    PNL.GOV = {

        NERSC.GOV = ES.NET

    }

    ES.NET = {

        NERSC.GOV = .

    }

    TEST.ANL.GOV = {

        NERSC.GOV = ANL.GOV

        NERSC.GOV = ES.NET

    }
```

When a subtag is used more than once within a tag, clients will use the order of values to determine the path. The order of values is not important to servers.

### [appdefaults]
Each tag in the [appdefaults] section names a Kerberos V5 application or an option that is used by some Kerberos V5 application[s]. The value of the tag defines the default behaviors for that application.

For example:

```
[appdefaults]

    telnet = {

        ATHENA.MIT.EDU = {

            option1 = false

        }

    }

    telnet = {

        option1 = true

        option2 = true

    }

    ATHENA.MIT.EDU = {

        option2 = false

    }

    option2 = true
```

The above four ways of specifying the value of an option are shown in order of decreasing precedence. In this example, if telnet is running in the realm EXAMPLE.COM, it should, by default, have option1 and option2 set to true. However, a telnet program in the realm ATHENA.MIT.EDU should have option1 set to false and option2 set to true. Any other programs in ATHENA.MIT.EDU should have option2 set to false by default. Any programs running in other realms should have option2 set to true.

The list of specifiable options for each application may be found in that application's man pages. The application defaults specified here are overridden by those specified in the realms section.

### [plugins]

- pwqual interface

- kadm5_hook interface

- clpreauth and kdcpreauth interfaces

Tags in the [plugins] section can be used to register dynamic plugin modules and to turn modules on and off. Not every krb5 pluggable interface uses the [plugins] section; the ones that do are documented here.

New in release 1.9.

Each pluggable interface corresponds to a subsection of [plugins]. All subsections support the same tags:

disable

This tag may have multiple values. If there are values for this tag, then the named modules will be disabled for the pluggable interface.

enable_only

This tag may have multiple values. If there are values for this tag, then only the named modules will be enabled for the pluggable interface.

module

This tag may have multiple values. Each value is a string of the form modulename:pathname, which causes the shared object located at pathname to be registered as a dynamic module named modulename for the pluggable interface. If pathname is not an absolute path, it will be treated as relative to the plugin_base_dir value from [libdefaults].

For pluggable interfaces where module order matters, modules registered with a module tag normally come first, in the order they are registered, followed by built-in modules in the order they are documented below. If enable_only tags are used, then the order of those tags overrides the normal module order.

The following subsections are currently supported within the [plugins] section:

### ccselect interface
The ccselect subsection controls modules for credential cache selection within a cache collection. In addition to any registered dynamic modules, the following built-in modules exist (and may be disabled with the disable tag):

k5identity

Uses a .k5identity file in the user's home directory to select a client principal

realm

Uses the service realm to guess an appropriate cache from the collection

hostname

If the service principal is host-based, uses the service hostname to guess an appropriate cache from the collection

### pwqual interface
The pwqual subsection controls modules for the password quality interface, which is used to reject weak passwords when passwords are changed. The following built-in modules exist for this interface:

dict

Checks against the realm dictionary file

empty

Rejects empty passwords

hesiod

Checks against user information stored in Hesiod (only if Kerberos was built with Hesiod support)

princ

Checks against components of the principal name

### kadm5_hook interface
The kadm5_hook interface provides plugins with information on principal creation, modification, password changes and deletion. This interface can be used to write a plugin to synchronize MIT Kerberos with another database such as Active Directory. No plugins are built in for this interface.

### kadm5_auth interface
The kadm5_auth section (introduced in release 1.16) controls modules for the kadmin authorization interface, which determines whether a client principal is allowed to perform a kadmin operation. The following built-in modules exist for this interface:

acl

This module reads the kadm5.acl(5) file, and authorizes operations which are allowed according to the rules in the file.

self

This module authorizes self-service operations including password changes, creation of new random keys, fetching the client's principal record or string attributes, and fetching the policy record associated with the client principal.

### clpreauth and kdcpreauth interfaces
The clpreauth and kdcpreauth interfaces allow plugin modules to provide client and KDC preauthentication mechanisms. The following built-in modules exist for these interfaces:

pkinit

This module implements the PKINIT preauthentication mechanism.

encrypted_challenge

This module implements the encrypted challenge FAST factor.

encrypted_timestamp

This module implements the encrypted timestamp mechanism.

### hostrealm interface
The hostrealm section (introduced in release 1.12) controls modules for the host-to-realm interface, which affects the local mapping of hostnames to realm names and the choice of default realm. The following built-in modules exist for this interface:

profile

This module consults the [domain_realm] section of the profile for authoritative host-to-realm mappings, and the default_realm variable for the default realm.

dns

This module looks for DNS records for fallback host-to-realm mappings and the default realm. It only operates if the dns_lookup_realm variable is set to true.

domain

This module applies heuristics for fallback host-to-realm mappings. It implements the realm_try_domains variable, and uses the uppercased parent domain of the hostname if that does not produce a result.

### localauth interface
The localauth section (introduced in release 1.12) controls modules for the local authorization interface, which affects the relationship between Kerberos principals and local system accounts. The following built-in modules exist for this interface:

default

This module implements the DEFAULT type for auth_to_local values.

rule

This module implements the RULE type for auth_to_local values.

names

This module looks for an auth_to_local_names mapping for the principal name.

auth_to_local

This module processes auth_to_local values in the default realm's section, and applies the default method if no auth_to_local values exist.

k5login

This module authorizes a principal to a local account according to the account's .k5login(5) file.

an2ln

This module authorizes a principal to a local account if the principal name maps to the local account name.

### certauth interface
The certauth section (introduced in release 1.16) controls modules for the certificate authorization interface, which determines whether a certificate is allowed to preauthenticate a user via PKINIT. The following built-in modules exist for this interface:

pkinit_san

This module authorizes the certificate if it contains a PKINIT Subject Alternative Name for the requested client principal, or a Microsoft UPN SAN matching the principal if pkinit_allow_upn is set to true for the realm.

pkinit_eku

This module rejects the certificate if it does not contain an Extended Key Usage attribute consistent with the pkinit_eku_checking value for the realm.

dbmatch

This module authorizes or rejects the certificate according to whether it matches the pkinit_cert_match string attribute on the client principal, if that attribute is present.

## PKINIT OPTIONS
NOTE:

The following are PKINIT-specific options. These values may be specified in [libdefaults] as global defaults, or within a realm-specific subsection of [libdefaults], or may be specified as realm-specific values in the [realms] section. A realm-specific value overrides, not adds to, a generic [libdefaults] specification. The search order is:

1.

realm-specific subsection of [libdefaults]:

```
[libdefaults]

    EXAMPLE.COM = {

        pkinit_anchors = FILE:/usr/local/example.com.crt

    }
```

2.

realm-specific value in the [realms] section:

```
[realms]

    OTHERREALM.ORG = {

        pkinit_anchors = FILE:/usr/local/otherrealm.org.crt

    }
```

3.

generic value in the [libdefaults] section:

```
[libdefaults]

    pkinit_anchors = DIR:/usr/local/generic_trusted_cas/
```

### Specifying PKINIT identity information
The syntax for specifying Public Key identity, trust, and revocation information for PKINIT is as follows:

FILE:filename[,keyfilename]

This option has context-specific behavior. In pkinit_identity or pkinit_identities, filename specifies the name of a PEM-format file containing the user's certificate. If keyfilename is not specified, the user's private key is expected to be in filename as well. Otherwise, keyfilename is the name of the file containing the private key.

In pkinit_anchors or pkinit_pool, filename is assumed to be the name of an OpenSSL-style ca-bundle file.

DIR:dirname

This option has context-specific behavior. In pkinit_identity or pkinit_identities, dirname specifies a directory with files named *.crt and *.key where the first part of the file name is the same for matching pairs of certificate and private key files. When a file with a name ending with .crt is found, a matching file ending with .key is assumed to contain the private key. If no such file is found, then the certificate in the .crt is not used.

In pkinit_anchors or pkinit_pool, dirname is assumed to be an OpenSSL-style hashed CA directory where each CA cert is stored in a file named hash-of-ca-cert.#. This infrastructure is encouraged, but all files in the directory will be examined and if they contain certificates (in PEM format), they will be used.

In pkinit_revoke, dirname is assumed to be an OpenSSL-style hashed CA directory where each revocation list is stored in a file named hash-of-ca-cert.r#. This infrastructure is encouraged, but all files in the directory will be examined and if they contain a revocation list (in PEM format), they will be used.

PKCS12:filename

filename is the name of a PKCS #12 format file, containing the user's certificate and private key.

PKCS11:[module_name=]modname[:slotid=slot-id][:token=token-label][:certid=cert-id][:certlabel=cert-label]

All keyword/values are optional. modname specifies the location of a library implementing PKCS #11. If a value is encountered with no keyword, it is assumed to be the modname. If no module-name is specified, the default is opensc-pkcs11.so. slotid= and/or token= may be specified to force the use of a particular smard card reader or token if there is more than one available. certid= and/or certlabel= may be specified to force the selection of a particular certificate on the device. See the pkinit_cert_match configuration option for more ways to select a particular certificate to use for PKINIT.

ENV:envvar

envvar specifies the name of an environment variable which has been set to a value conforming to one of the previous values. For example, ENV:X509_PROXY, where environment variable X509_PROXY has been set to FILE:/tmp/my_proxy.pem.

### PKINIT krb5.conf options
pkinit_anchors

Specifies the location of trusted anchor (root) certificates which the client trusts to sign KDC certificates. This option may be specified multiple times. These values from the config file are not used if the user specifies X509_anchors on the command line.

pkinit_cert_match

Specifies matching rules that the client certificate must match before it is used to attempt PKINIT authentication. If a user has multiple certificates available (on a smart card, or via other media), there must be exactly one certificate chosen before attempting PKINIT authentication. This option may be specified multiple times. All the available certificates are checked against each rule in order until there is a match of exactly one certificate. The Subject and Issuer comparison strings are the RFC 2253 string representations from the certificate Subject DN and Issuer DN values.

The syntax of the matching rules is:

[relation-operator]component-rule ...

where:

relation-operator

can be either &&, meaning all component rules must match, or ||, meaning only one component rule must match. The default is &&.

component-rule

can be one of the following. Note that there is no punctuation or whitespace between component rules.

```
<SUBJECT>regular-expression
<ISSUER>regular-expression
<SAN>regular-expression
<EKU>extended-key-usage-list
<KU>key-usage-list
```

extended-key-usage-list is a comma-separated list of required Extended Key Usage values. All values in the list must be present in the certificate. Extended Key Usage values can be:

- pkinit

- msScLogin

- clientAuth

- emailProtection

key-usage-list is a comma-separated list of required Key Usage values. All values in the list must be present in the certificate. Key Usage values can be:

- digitalSignature

- keyEncipherment

Examples:

```
pkinit_cert_match = ||<SUBJECT>.*DoE.*<SAN>.*@EXAMPLE.COM
pkinit_cert_match = &&<EKU>msScLogin,clientAuth<ISSUER>.*DoE.*
pkinit_cert_match = <EKU>msScLogin,clientAuth<KU>digitalSignature
```

pkinit_eku_checking

This option specifies what Extended Key Usage value the KDC certificate presented to the client must contain. (Note that if the KDC certificate has the pkinit SubjectAlternativeName encoded as the Kerberos TGS name, EKU checking is not necessary since the issuing CA has certified this as a KDC certificate.) The values recognized in the krb5.conf file are:

kpKDC

This is the default value and specifies that the KDC must have the id-pkinit-KPKdc EKU as defined in RFC 4556.

kpServerAuth

If kpServerAuth is specified, a KDC certificate with the id-kp-serverAuth EKU will be accepted. This key usage value is used in most commercially issued server certificates.

none

If none is specified, then the KDC certificate will not be checked to verify it has an acceptable EKU. The use of this option is not recommended.

pkinit_dh_min_bits

Specifies the size of the Diffie-Hellman key the client will attempt to use. The acceptable values are 1024, 2048, and 4096. The default is 2048.

pkinit_identities

Specifies the location(s) to be used to find the user's X.509 identity information. If this option is specified multiple times, each value is attempted in order until certificates are found. Note that these values are not used if the user specifies X509_user_identity on the command line.

pkinit_kdc_hostname

The presence of this option indicates that the client is willing to accept a KDC certificate with a dNSName SAN (Subject Alternative Name) rather than requiring the id-pkinit-san as defined in RFC 4556. This option may be specified multiple times. Its value should contain the acceptable hostname for the KDC (as contained in its certificate).

pkinit_pool

Specifies the location of intermediate certificates which may be used by the client to complete the trust chain between a KDC certificate and a trusted anchor. This option may be specified multiple times.

pkinit_require_crl_checking

The default certificate verification process will always check the available revocation information to see if a certificate has been revoked. If a match is found for the certificate in a CRL, verification fails. If the certificate being verified is not listed in a CRL, or there is no CRL present for its issuing CA, and pkinit_require_crl_checking is false, then verification succeeds. However, if pkinit_require_crl_checking is true and there is no CRL information available for the issuing CA, then verification fails.

pkinit_require_crl_checking should be set to true if the policy is such that up-to-date CRLs must be present for every CA.

pkinit_revoke

Specifies the location of Certificate Revocation List (CRL) information to be used by the client when verifying the validity of the KDC certificate presented. This option may be specified multiple times.

## PARAMETER EXPANSION
Starting with release 1.11, several variables, such as default_keytab_name, allow parameters to be expanded. Valid parameters are:

%{TEMP}

Temporary directory

%{uid}

Unix real UID or Windows SID

%{euid}

Unix effective user ID or Windows SID

%{USERID}

Same as %{uid}

%{null}

Empty string

%{LIBDIR}

Installation library directory

%{BINDIR}

Installation binary directory

%{SBINDIR}

Installation admin binary directory

%{username}

(Unix) Username of effective user ID

%{APPDATA}

(Windows) Roaming application data for current user

%{COMMON_APPDATA}

(Windows) Application data for all users

%{LOCAL_APPDATA}

(Windows) Local application data for current user

%{SYSTEM}

(Windows) Windows system folder

%{WINDOWS}

(Windows) Windows folder

%{USERCONFIG}

(Windows) Per-user MIT krb5 config file directory

%{COMMONCONFIG}

(Windows) Common MIT krb5 config file directory

## SAMPLE KRB5.CONF FILE
Here is an example of a generic krb5.conf file:

```
[libdefaults]

    default_realm = ATHENA.MIT.EDU

    dns_lookup_kdc = true

    dns_lookup_realm = false
[realms]

    ATHENA.MIT.EDU = {

        kdc = kerberos.mit.edu

        kdc = kerberos-1.mit.edu

        kdc = kerberos-2.mit.edu

        admin_server = kerberos.mit.edu

        primary_kdc = kerberos.mit.edu

    }

    EXAMPLE.COM = {

        kdc = kerberos.example.com

        kdc = kerberos-1.example.com

        admin_server = kerberos.example.com

    }
[domain_realm]

    mit.edu = ATHENA.MIT.EDU
[capaths]

    ATHENA.MIT.EDU = {

           EXAMPLE.COM = .

    }

    EXAMPLE.COM = {

           ATHENA.MIT.EDU = .

    }
```

## FILES
/etc/krb5.conf

## SEE ALSO
syslog(3)

## AUTHOR
MIT

## COPYRIGHT
1985-2024, MIT


package: libmjpegtools-devel

title: yuv4mpeg(5)

text:
# yuv4mpeg(5)

## NAME
YUV4MPEG2 - video stream format used by pipe-based MJPEGtools

## DESCRIPTION
Many of the MJPEGtools communicate via pipes and act as filters (or sources or sinks). The format of video data used in the pipes is referred to as "YUV4MPEG", or, more precisely, "YUV4MPEG2". (The format was extended and codified during v1.5.x of the tools.)

The basic structure is a stream header followed by an unlimited number of frames. Each frame itself consists of a header followed by video data. The headers are vaguely human-readable ASCII, but the video data is simple byte-size binary.

The MJPEGtools distribution has a C library (libmjpegutils) which contains functions for manipulating YUV4MPEG2 streams. We recommend that you use this library rather than writing your own code if possible. See the header file "yuv4mpeg.h" for a description of these functions.

Design Goals:

o

Easy to parse both via C or sh.

o

Extensible; easy to add new parameters while maintaining backwards compatibility.

o

Simple upgrade from original "YUV4MPEG" format.

Drawbacks:

o

Frame headers do not have constant size, so streams are not seekable.

## GRAMMAR
The precise description of the the YUV4MPEG2 stream format is as follows:

STREAM consists of

-

one STREAM-HEADER

-

unlimited number of FRAMEs

STREAM-HEADER consists of

-

magic string "YUV4MPEG2"

-

unlimited number of TAGGED-FIELDs, each preceeded by a ' ' (single space) separator

-

single '\n' line terminator

FRAME consists of

-

one FRAME-HEADER

-

"length" octets of planar YCbCr 4:2:0 image data (If the stream is interlaced, then the two fields per frame are interleaved, with proper spatial ordering.)

FRAME-HEADER consists of

-

magic string "FRAME"

-

unlimited number of TAGGED-FIELDs, each preceeded by a ' ' (single space) separator

-

single '\n' line terminator

TAGGED-FIELD consists of

-

single ASCII character tag

-

VALUE (which does not contain whitespace)

VALUE consists of

-

RATIO, or

-

integer (base 10 ASCII representation), or

-

single ascii character, or

-

string (multiple ASCII characters)

RATIO consists of

-

numerator (base 10 ASCII integer)

-

':' (a colon)

-

denominator (base 10 ASCII integer)

Header tags fall into three categories: optional, required and has-default. Optional tags are completely optional and may be omitted from a header. Required tags must be present in a header. Has-Default tags have a default value which is implied if the tag is not present. Independent of these categories, some tags allow an "unknown" value and some do not.

The supported tags for the STREAM-HEADER:

W[integer] - frame width in pixels, must be > 0 (required)

H[integer] - frame height in pixels, must be > 0 (required)

C[string] - chroma subsampling, image data format (has default)

420jpeg - 4:2:0 with JPEG/MPEG-1 siting (default)

420mpeg2 - 4:2:0 with MPEG-2 siting

420paldv - 4:2:0 with PAL-DV siting

411 - 4:1:1, cosited

422 - 4:2:2, cosited

444 - 4:4:4 (no subsampling)

444alpha - 4:4:4 with an alpha channel

mono - luma (Y') plane only

I[char] - interlacing specification: (has default)

? - unknown (default)

p - progressive/none

t - top-field-first

b - bottom-field-first

m - mixed-mode: refer to 'I' tag in frame header

F[ratio] - frame-rate (has default of 0:0 == unknown)

A[ratio] - sample aspect ratio (has default of 0:0 == unknown)

X[string] - 'metadata' (optional; unparsed, but passed around)

The currently supported tags for the FRAME-HEADER:

I[string] - framing and sampling (required if-and-only-if Im is present in stream header). Value is a string of three characters "xyz" which have the following meanings:

x: frame presentation

t - top-field-first

T - top-field-first and repeat

b - bottom-field-first

B - bottom-field-first and repeat

1 - single progressive frame

2 - double progressive frame (repeat)

3 - triple progressive frame (repeat)

y: frame temporal sampling

p - progressive (fields sampled at same time)

i - interlaced (fields sampled at different times)

z: frame chroma-subsampling

p - progressive (subsampling over whole frame)

i - interlaced (each field subsampled independently)

? - unknown (allowed only for non-4:2:0 subsampling)

X[string] - 'metadata' (optional; unparsed, but passed around)

Note that a filter application must faithfully forward all "X" tags from input pipe to output pipe (unless it uses one of those tags, of course). The supplied library will do this automatically if the functions y4m_copy_stream_info() and y4m_copy_frame_info() are used appropriately.

## NOTES ON IMAGE DATA
All image data is in the CCIR-601 Y'CbCr colorspace, presented plane-by-plane in row-major order. Each sample within each plane is one octet (8-bits) in size. When all planes are present, they are transmitted in the order Y', Cb, Cr, potentially followed by an alpha/transparency mask plane (for the 444alpha chroma format). The alpha channel data is follows the same range as the Y' luma channel: full transparency is at 16 and full opacity is at 235.

All Y' and alpha planes consist of (height X width) octets. The size of the chroma planes depends on the subsampling mode:

-

4:4:4 - (height X width) octets

-

4:2:2 - (height X width) / 2 octets

-

4:1:1 - (height X width) / 4 octets

-

4:2:0 - (height X width) / 4 octets

## NOTES ON FRAMING
For more details about reading and writing yuv4mpeg files read the sources - there are many utility programs, some simple, some complex that can serve as guides.

## SEE ALSO
mjpegtools(1), yuv4mpeg.h

## AUTHOR
This manual page Copyright 2004 Matthew J. Marjanovic.


jng

package: libmng

title: jng(5)

summary: JPEG Network Graphics (JNG) sub-format

text:
# jng(5)

## NAME
jng - JPEG Network Graphics (JNG) sub-format

## DESCRIPTION
JNG (JPEG Network Graphics) is a sub-format of the MNG (Multiple-image Network Graphics) format. As with MNG it extends on the features of the popular PNG (Portable Network Graphics) image-format.

This sub-format was designed to support a lossy compression-method. It is based completely on the JPEG specification. It adds the high-compression ratios of JPEG for photographic images.

As a member of the Network Graphics family, JNG was deemed adequate as a stand-alone format as it extends the JPEG format with color-correction and transparency features.

## SEE ALSO
png(5), mng(5), libmng(3)

MNG 1.00, February 9, 2001:

http://www.libpng.org/pub/mng

## AUTHORS
This man page: Gerard Juyn

Multiple-image Network Graphics (MNG) Specification Version 1.00 (Februari 9, 2001): Glenn Randers-Pehrson and others (png-list@ccrc.wustl.edu).

## COPYRIGHT NOTICE
The MNG-1.00 specification is copyright (c) 1998-2001 Glenn Randers-Pehrson. See the specification for conditions of use and distribution.


mng

title: mng(5)

text:
# mng(5)

## NAME
mng - Multiple-image Network Graphics (MNG) format

## DESCRIPTION
MNG (Multiple-image Network Graphics) is the animation extension of the popular PNG image-format. PNG (Portable Network Graphics) is an extensible file format for the lossless, portable, well-compressed storage of raster images.

MNG has advanced animation features which make it very useful as a full replacement for GIF animations. These features allow animations that are impossible with GIF or result in much smaller files as GIF.

As MNG builds on the same structure as PNG, it is robust, extensible and free of patents. It retains the same clever file integrity checks as in PNG.

MNG also embraces the lossy JPEG image-format in a sub-format named JNG, which allows for alpha-transparency and color-correction on highly compressed (photographic) images.

## SEE ALSO
png(5), jng(5), libmng(3), libpng(3), zlib(3), deflate(5) ", " zlib(5) ", " jpeg(5)

MNG 1.00, Februari 9, 2001:

http://www.libpng.org/pub/mng

## AUTHORS
This man page: Gerard Juyn

Multiple-image Network Graphics (MNG) Specification Version 1.00 (Februari 9, 2001): Glenn Randers-Pehrson and others (png-list@ccrc.wustl.edu).

## COPYRIGHT NOTICE
The MNG-1.00 specification is copyright (c) 1998-2001 Glenn Randers-Pehrson. See the specification for conditions of use and distribution.


idmapd.conf

package: libnfsidmap

title: idmapd.conf(5)

summary: configuration file for libnfsidmap

text:
# idmapd.conf(5)

## NAME
idmapd.conf - configuration file for libnfsidmap

## SYNOPSIS
Configuration file for libnfsidmap. Used by idmapd and svcgssd to map NFSv4 name to and from ids.

## DESCRIPTION
The idmapd.conf configuration files consists of several sections, initiated by strings of the form [General] and [Mapping]. Each section may contain lines of the form

```
  variable = value
```

The recognized sections and their recognized variables are as follows:

### [General] section variables

```

```

Verbosity

Verbosity level of debugging (Default: 0)

Domain

The local NFSv4 domain name. An NFSv4 domain is a namespace with a unique username<->UID and groupname<->GID mapping. (Default: Host's fully-qualified DNS domain name)

No-Strip

In multi-domain environments, some NFS servers will append the identity management domain to the owner and owner_group in lieu of a true NFSv4 domain. This option can facilitate lookups in such environments. If set to a value other than "none", the nsswitch plugin will first pass the name to the password/group lookup function without stripping the domain off. If that mapping fails then the plugin will try again using the old method (comparing the domain in the string to the Domain value, stripping it if it matches, and passing the resulting short name to the lookup function). Valid values are "user", "group", "both", and "none". (Default: "none")

Reformat-Group

Winbind has a quirk whereby doing a group lookup in UPN format (e.g. staff@americas.example.com) will cause the group to be displayed prefixed with the full domain in uppercase (e.g. AMERICAS.EXAMPLE.COM\staff) instead of in the familiar netbios name format (e.g. AMERICAS\staff). Setting this option to true causes the name to be reformatted before passing it to the group lookup function in order to work around this. This setting is ignored unless No-Strip is set to either "both" or "group". (Default: "false")

Local-Realms

A comma-separated list of Kerberos realm names that may be considered equivalent to the local realm name. For example, users juser@ORDER.EDU and juser@MAIL.ORDER.EDU may be considered to be the same user in the specified Domain. (Default: the host's default realm name)

Note: If a value is specified here, the default local realm must be included as well.

### [Mapping] section variables

```

```

Nobody-User

Local user name to be used when a mapping cannot be completed.

Nobody-Group

Local group name to be used when a mapping cannot be completed.

### [Translation] section variables

```

```

Method

A comma-separated, ordered list of mapping methods (plug-ins) to use when mapping between NFSv4 names and local IDs. Each specified method is tried in order until a mapping is found, or there are no more methods to try. The methods included in the default distribution include "nsswitch", "umich_ldap", and "static". (Default: nsswitch)

GSS-Methods

An optional comma-separated, ordered list of mapping methods (plug-ins) to use when mapping between GSS Authenticated names and local IDs. (Default: the same list as specified for Method)

### [Static] section variables

```

```

The "static" translation method uses a static list of GSS-Authenticated names to local user names. Entries in the list are of the form:

```
 principal@REALM = localusername
```

### [REGEX] section variables

```

```

If the "regex" translation method is specified, the following variables within the [REGEX] section are used to map between NFS4 names and local IDs.

User-Regex

Case-insensitive regular expression that extracts the local user name from an NFSv4 name. Multiple expressions may be concatenated with '|'. The first match will be used. There is no default. A basic regular expression for domain DOMAIN.ORG and realm MY.DOMAIN.ORG would be:

```
^DOMAIN\([^@]+)@MY.DOMAIN.ORG$
```

Group-Regex

Case-insensitive regular expression that extracts the local group name from an NFSv4 name. Multiple expressions may be concatenated with '|'. The first match will be used. There is no default. A basic regular expression for domain DOMAIN.ORG and realm MY.DOMAIN.ORG would be:

```
^([^@]+)@DOMAIN.ORG@MY.DOMAIN.ORG$|^DOMAIN\([^@]+)@MY.DOMAIN.ORG$
```

Prepend-Before-User

Constant string to put before a local user name when building an NFSv4 name. Usually this is the short domain name followed by '´. (Default: none)

Append-After-User

Constant string to put after a local user name when building an NFSv4 name. Usually this is '@' followed by the default realm. (Default: none)

Prepend-Before-Group

Constant string to put before a local group name when building an NFSv4 name. Usually not used. (Default: none)

Append-After-Group

Constant string to put before a local group name when building an NFSv4 name. Usually this is '@' followed by the domain name followed by another '@' and the default realm. (Default: none)

Group-Name-Prefix

Constant string that is prepended to a local group name when converting it to an NFSv4 name. If an NFSv4 group name has this prefix it is removed when converting it to a local group name. With this group names of a central directory can be shortened for an isolated organizational unit if all groups have a common prefix. (Default: none)

Group-Name-No-Prefix-Regex

Case-insensitive regular expression to exclude groups from adding and removing the prefix set by Group-Name-Prefix. The regular expression must match both the remote and local group names. Multiple expressions may be concatenated with '|'. (Default: none)

### [UMICH_SCHEMA] section variables

```

```

If the "umich_ldap" translation method is specified, the following variables within the [UMICH_SCHEMA] section are used.

LDAP_server

LDAP server name or address (Required if using UMICH_LDAP)

LDAP_base

Absolute LDAP search base. (Required if using UMICH_LDAP)

LDAP_people_base

Absolute LDAP search base for people accounts. (Default: The LDAP_base value)

LDAP_group_base

Absolute LDAP search base for group accounts. (Default: The LDAP_base value)

LDAP_canonicalize_name

Whether or not to perform name canonicalization on the name given as LDAP_server (Default: "true")

LDAP_follow_referrals

Whether or not to follow ldap referrals. (Default: "true")

LDAP_use_ssl

Set to "true" to enable SSL communication with the LDAP server. (Default: "false")

LDAP_ca_cert

Location of a trusted CA certificate used when SSL is enabled (Required if LDAP_use_ssl is true and LDAP_tls_reqcert is not set to never)

LDAP_tls_reqcert

Controls the LDAP server certificate validation behavior. It can take the same values as ldap.conf(5)'s TLS_REQCERT tunable. (Default: "hard")

LDAP_timeout_seconds

Number of seconds before timing out an LDAP request (Default: 4)

LDAP_sasl_mech

SASL mechanism to be used for sasl authentication. Required if SASL auth is to be used (Default: None)

LDAP_realm

SASL realm to be used for sasl authentication. (Default: None)

LDAP_sasl_authcid

Authentication identity to be used for sasl authentication. (Default: None)

LDAP_sasl_authzid

Authorization identity to be used for sasl authentication. (Default: None)

LDAP_sasl_secprops

Cyrus SASL security properties. It can the same values as ldap.conf(5)'s sasl_secprops.

LDAP_sasl_canonicalize

Specifies whether the LDAP server hostname should be canonicalised. If set to yes LDAP lib with do a reverse hostname lookup. If this is not set the LDAP library's default will be used. (Default: None)

LDAP_sasl_krb5_ccname

Path to kerberos credential cache. If it is not set then the value of environment variable KRB5CCNAME will be used. If the environment variable is not set then the default mechanism of kerberos library will be used.

NFSv4_person_objectclass

The object class name for people accounts in your local LDAP schema (Default: NFSv4RemotePerson)

NFSv4_name_attr

Your local schema's attribute name to be used for NFSv4 user names (Default: NFSv4Name)

NFSv4_uid_attr

Your local schema's attribute name to be used for uidNumber (Default: uidNumber)

GSS_principal_attr

Your local schema's attribute name for GSSAPI Principal names (Default: GSSAuthName)

NFSv4_acctname_attr

Your local schema's attribute name to be used for account names (Default: uid)

NFSv4_group_objectclass

The object class name for group accounts in your local LDAP schema (Default: NFSv4RemoteGroup)

NFSv4_gid_attr

Your local schema's attribute name to be used for gidNumber (Default: gidNumber)

NFSv4_group_attr

Your local schema's attribute name to be used for NFSv4 group names (Default: NFSv4Name)

LDAP_use_memberof_for_groups

Some LDAP servers do a better job with indexing where searching through all the groups searching for the user in the memberuid list. Others like SunOne directory that search can takes minutes if there are thousands of groups. So setting LDAP_use_memberof_for_groups to true in the configuration file will use the memberof lists of the account and search through only those groups to obtain gids. (Default: false)

NFSv4_member_attr

If LDAP_use_memberof_for_groups is true, this is the attribute to be searched for. (Default: memberUid)

NFSv4_grouplist_filter

An optional search filter for determining group membership. (No Default)

## EXAMPLES
An example /etc/idmapd.conf file:

```
[General]
Verbosity = 0
Domain = domain.org
Local-Realms = DOMAIN.ORG,MY.DOMAIN.ORG,YOUR.DOMAIN.ORG
[Mapping]
Nobody-User = nfsnobody
Nobody-Group = nfsnobody
[Translation]
Method = umich_ldap,regex,nsswitch
GSS-Methods = umich_ldap,regex,static
[Static]
johndoe@OTHER.DOMAIN.ORG = johnny
[Regex]
User-Regex = ^DOMAIN\([^@]+)@DOMAIN.ORG$
Group-Regex = ^([^@]+)@DOMAIN.ORG@DOMAIN.ORG$|^DOMAIN\([^@]+)@DOMAIN.ORG$
Prepend-Before-User = DOMAIN
Append-After-User = @DOMAIN.ORG
Append-After-Group = @domain.org@domain.org
Group-Name-Prefix = sales-
Group-Name-No-Prefix-Regex = -personal-group$
[UMICH_SCHEMA]
LDAP_server = ldap.domain.org
LDAP_base = dc=org,dc=domain
```

## FILES
/usr/etc/idmapd.conf

/usr/etc/idmapd.conf.d/*.conf

/etc/idmapd.conf

/etc/idmapd.conf.d/*.conf

Files are read in the order listed. Later settings override earlier settings.

## SEE ALSO
idmapd(8) svcgssd(8)

## BUGS
Report bugs to <nfsv4@linux-nfs.org>


libnftables-json

package: libnftables-devel

title: libnftables-json(5)

summary: Supported JSON schema by libnftables

text:
# libnftables-json(5)

## NAME
libnftables-json - Supported JSON schema by libnftables

## SYNOPSIS
{ "nftables": [ OBJECTS ] }

OBJECTS := LIST_OBJECTS | CMD_OBJECTS

LIST_OBJECTS := LIST_OBJECT [ , LIST_OBJECTS ]

CMD_OBJECTS := CMD_OBJECT [ , CMD_OBJECTS ]

CMD_OBJECT := { CMD: LIST_OBJECT } | METAINFO_OBJECT

CMD := "add" | "replace" | "create" | "insert" | "delete" | "list" | "reset" | "flush" | "rename"

LIST_OBJECT := TABLE | CHAIN | RULE | SET | MAP | ELEMENT | FLOWTABLE | COUNTER | QUOTA | CT_HELPER | LIMIT | METAINFO_OBJECT | CT_TIMEOUT | CT_EXPECTATION

## DESCRIPTION
libnftables supports JSON formatted input and output. This is implemented as an alternative frontend to the standard CLI syntax parser, therefore basic behaviour is identical and, for (almost) any operation available in standard syntax, there should be an equivalent one in JSON.

JSON input may be provided in a single string as parameter to nft_run_cmd_from_buffer() or in a file identified by the filename parameter of the nft_run_cmd_from_filename() function.

JSON output has to be enabled via the nft_ctx_output_set_json() function, turning library standard output into JSON format. Error output remains unaffected.

## GLOBAL STRUCTURE
In general, any JSON input or output is enclosed in an object with a single property named nftables. Its value is an array containing commands (for input) or ruleset elements (for output).

A command is an object with a single property whose name identifies the command. Its value is a ruleset element - basically identical to output elements, apart from certain properties which may be interpreted differently or are required when output generally omits them.

## METAINFO OBJECT
In output, the first object in an nftables array is a special one containing library information. Its content is as follows:

```
{ "metainfo": {

        "version": STRING,

        "release_name": STRING,

        "json_schema_version": NUMBER
}}
```

The values of version and release_name properties are equal to the package version and release name as printed by nft -v. The value of the json_schema_version property is an integer indicating the schema version.

If supplied in library input, the parser will verify the json_schema_version value to not exceed the internally hardcoded one (to make sure the given schema is fully understood). In future, a lower number than the internal one may activate compatibility mode to parse outdated and incompatible JSON input.

## COMMAND OBJECTS
The structure accepts an arbitrary amount of commands which are interpreted in order of appearance. For instance, the following standard syntax input:

```
flush ruleset
add table inet mytable
add chain inet mytable mychain
add rule inet mytable mychain tcp dport 22 accept
```

translates into JSON as such:

```
{ "nftables": [

        { "flush": { "ruleset": null }},

        { "add": { "table": {

                        "family": "inet",

                        "name": "mytable"

        }}},

        { "add": { "chain": {

                        "family": "inet",

                        "table": "mytable",

                        "name": "mychain"

        }}},

        { "add": { "rule": {

                        "family": "inet",

                        "table": "mytable",

                        "chain": "mychain",

                        "expr": [

                                { "match": {

                                        "op": "==",

                                        "left": { "payload": {

                                                        "protocol": "tcp",

                                                        "field": "dport"

                                        }},

                                        "right": 22

                                }},

                                { "accept": null }

                        ]

        }}}
]}
```

### ADD

```
{ "add": ADD_OBJECT }
ADD_OBJECT := TABLE | CHAIN | RULE | SET | MAP | ELEMENT |

                FLOWTABLE | COUNTER | QUOTA | CT_HELPER | LIMIT |

                CT_TIMEOUT | CT_EXPECTATION
```

Add a new ruleset element to the kernel.

### REPLACE

```
{ "replace": RULE }
```

Replace a rule. In RULE, the handle property is mandatory and identifies the rule to be replaced.

### CREATE

```
{ "create": ADD_OBJECT }
```

Identical to add command, but returns an error if the object already exists.

### INSERT

```
{ "insert": RULE }
```

This command is identical to add for rules, but instead of appending the rule to the chain by default, it inserts at first position. If a handle or index property is given, the rule is inserted before the rule identified by those properties.

### DELETE

```
{ "delete": ADD_OBJECT }
```

Delete an object from the ruleset. Only the minimal number of properties required to uniquely identify an object is generally needed in ADD_OBJECT. For most ruleset elements, this is family and table plus either handle or name (except rules since they don’t have a name).

### LIST

```
{ "list": LIST_OBJECT }
LIST_OBJECT := TABLE | TABLES | CHAIN | CHAINS | SET | SETS |

                 MAP | MAPS | COUNTER | COUNTERS | QUOTA | QUOTAS |

                 CT_HELPER | CT_HELPERS | LIMIT | LIMITS | RULESET |

                 METER | METERS | FLOWTABLE | FLOWTABLES |

                 CT_TIMEOUT | CT_EXPECTATION
```

List ruleset elements. The plural forms are used to list all objects of that kind, optionally filtered by family and for some, also table.

### RESET

```
{ "reset": RESET_OBJECT }
RESET_OBJECT := COUNTER | COUNTERS | QUOTA | QUOTAS | RULE | RULES | SET | MAP | ELEMENT
```

Reset state in suitable objects, i.e. zero their internal counter.

### FLUSH

```
{ "flush": FLUSH_OBJECT }
FLUSH_OBJECT := TABLE | CHAIN | SET | MAP | METER | RULESET
```

Empty contents in given object, e.g. remove all chains from given table or remove all elements from given set.

### RENAME

```
{ "rename": CHAIN }
```

Rename a chain. The new name is expected in a dedicated property named newname.

## RULESET ELEMENTS

### RULESET

```
{ "ruleset": RULSET_PROPERTIES }
RULESET_PROPERTIES := null | { "family": STRING }
```

This is a special object for use with list and flush commands which will then operate on either the whole ruleset or the parts of it belonging to the given family.

### TABLE

```
{ "table": {

        "family": STRING,

        "name": STRING,

        "handle": NUMBER,

        "flags": TABLE_FLAGS
}}
TABLE_FLAGS := TABLE_FLAG | [ TABLE_FLAG_LIST ]
TABLE_FLAG_LIST := TABLE_FLAG [, TABLE_FLAG_LIST ]
TABLE_FLAG := "dormant" | "owner" | "persist"
```

This object describes a table.

family

The table’s family, e.g. "ip" or "ip6".

name

The table’s name.

handle

The table’s handle. In input, it is used only in delete command as alternative to name.

flags

The table’s flags.

### CHAIN

```
{ "chain": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "newname": STRING,

        "handle": NUMBER,

        "type": STRING,

        "hook": STRING,

        "prio": NUMBER,

        "dev": STRING,

        "policy": STRING
}}
```

This object describes a chain.

family

The table’s family.

table

The table’s name.

name

The chain’s name.

handle

The chain’s handle. In input, it is used only in delete command as alternative to name.

newname

A new name for the chain, only relevant in the rename command.

The following properties are required for base chains:

type

The chain’s type.

hook

The chain’s hook.

prio

The chain’s priority.

dev

The chain’s bound interface (if in the netdev family).

policy

The chain’s policy.

### RULE

```
{ "rule": {

        "family": STRING,

        "table": STRING,

        "chain": STRING,

        "expr": [ STATEMENTS ],

        "handle": NUMBER,

        "index": NUMBER,

        "comment": STRING
}}
STATEMENTS := STATEMENT [, STATEMENTS ]
```

This object describes a rule. Basic building blocks of rules are statements. Each rule consists of at least one.

family

The table’s family.

table

The table’s name.

chain

The chain’s name.

expr

An array of statements this rule consists of. In input, it is used in add/insert/replace commands only.

handle

The rule’s handle. In delete/replace commands, it serves as an identifier of the rule to delete/replace. In add/insert commands, it serves as an identifier of an existing rule to append/prepend the rule to.

index

The rule’s position for add/insert commands. It is used as an alternative to handle then.

comment

Optional rule comment.

### SET / MAP

```
{ "set": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "type": SET_TYPE,

        "policy": SET_POLICY,

        "flags": SET_FLAGS,

        "elem": SET_ELEMENTS,

        "timeout": NUMBER,

        "gc-interval": NUMBER,

        "size": NUMBER,

        "auto-merge": BOOLEAN
}}
{ "map": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "type": SET_TYPE,

        "map": STRING,

        "policy": SET_POLICY,

        "flags": SET_FLAGS,

        "elem": SET_ELEMENTS,

        "timeout": NUMBER,

        "gc-interval": NUMBER,

        "size": NUMBER,

        "auto-merge": BOOLEAN
}}
SET_TYPE := STRING | [ SET_TYPE_LIST ] | { "typeof": EXPRESSION }
SET_TYPE_LIST := STRING [, SET_TYPE_LIST ]
SET_POLICY := "performance" | "memory"
SET_FLAGS := SET_FLAG | [ SET_FLAG_LIST ]
SET_FLAG_LIST := SET_FLAG [, SET_FLAG_LIST ]
SET_FLAG := "constant" | "interval" | "timeout"
SET_ELEMENTS := EXPRESSION | [ EXPRESSION_LIST ]
EXPRESSION_LIST := EXPRESSION [, EXPRESSION_LIST ]
```

These objects describe a named set or map. Maps are a special form of sets in that they translate a unique key to a value.

family

The table’s family.

table

The table’s name.

name

The set’s name.

handle

The set’s handle. For input, it is used in the delete command only.

type

The set’s datatype, see below.

map

Type of values this set maps to (i.e. this set is a map).

policy

The set’s policy.

flags

The set’s flags.

elem

Initial set element(s), see below.

timeout

Element timeout in seconds.

gc-interval

Garbage collector interval in seconds.

size

Maximum number of elements supported.

auto-merge

Automatic merging of adjacent/overlapping set elements in interval sets.

TYPE

The set type might be a string, such as "ipv4_addr", an array consisting of strings (for concatenated types) or a typeof object containing an expression to extract the type from.

ELEM

A single set element might be given as string, integer or boolean value for simple cases. If additional properties are required, a formal elem object may be used.

Multiple elements may be given in an array.

### ELEMENT

```
{ "element": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "elem": SET_ELEM
}}
SET_ELEM := EXPRESSION | [ EXPRESSION_LIST ]
EXPRESSION_LIST := EXPRESSION [, EXPRESSION ]
```

Manipulate element(s) in a named set.

family

The table’s family.

table

The table’s name.

name

The set’s name.

elem

See elem property of set object.

### FLOWTABLE

```
{ "flowtable": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "hook": STRING,

        "prio": NUMBER,

        "dev": FT_INTERFACE
}}
FT_INTERFACE := STRING | [ FT_INTERFACE_LIST ]
FT_INTERFACE_LIST := STRING [, STRING ]
```

This object represents a named flowtable.

family

The table’s family.

table

The table’s name.

name

The flow table’s name.

handle

The flow table’s handle. In input, it is used by the delete command only.

hook

The flow table’s hook.

prio

The flow table’s priority.

dev

The flow table’s interface(s).

### COUNTER

```
{ "counter": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "packets": NUMBER,

        "bytes": NUMBER
}}
```

This object represents a named counter.

family

The table’s family.

table

The table’s name.

name

The counter’s name.

handle

The counter’s handle. In input, it is used by the delete command only.

packets

Packet counter value.

bytes

Byte counter value.

### QUOTA

```
{ "quota": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "bytes": NUMBER,

        "used": NUMBER,

        "inv": BOOLEAN
}}
```

This object represents a named quota.

family

The table’s family.

table

The table’s name.

name

The quota’s name.

handle

The quota’s handle. In input, it is used by the delete command only.

bytes

Quota threshold.

used

Quota used so far.

inv

If true, match if the quota has been exceeded.

### CT HELPER

```
{ "ct helper": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": ... ',

        "type": 'STRING,

        "protocol": CTH_PROTO,

        "l3proto": STRING
}}
CTH_PROTO := "tcp" | "udp"
```

This object represents a named conntrack helper.

family

The table’s family.

table

The table’s name.

name

The ct helper’s name.

handle

The ct helper’s handle. In input, it is used by the delete command only.

type

The ct helper type name, e.g. "ftp" or "tftp".

protocol

The ct helper’s layer 4 protocol.

l3proto

The ct helper’s layer 3 protocol, e.g. "ip" or "ip6".

### LIMIT

```
{ "limit": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "rate": NUMBER,

        "per": STRING,

        "burst": NUMBER,

        "unit": LIMIT_UNIT,

        "inv": BOOLEAN
}}
LIMIT_UNIT := "packets" | "bytes"
```

This object represents a named limit.

family

The table’s family.

table

The table’s name.

name

The limit’s name.

handle

The limit’s handle. In input, it is used by the delete command only.

rate

The limit’s rate value.

per

Time unit to apply the limit to, e.g. "week", "day", "hour", etc. If omitted, defaults to "second".

burst

The limit’s burst value. If omitted, defaults to 0.

unit

Unit of rate and burst values. If omitted, defaults to "packets".

inv

If true, match if limit was exceeded. If omitted, defaults to false.

### CT TIMEOUT

```
{ "ct timeout": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "protocol": CTH_PROTO,

        "state": STRING,

        "value: NUMBER,

        "l3proto": STRING
}}
CTH_PROTO := "tcp" | "udp" | "dccp" | "sctp" | "gre" | "icmpv6" | "icmp" | "generic"
```

This object represents a named conntrack timeout policy.

family

The table’s family.

table

The table’s name.

name

The ct timeout object’s name.

handle

The ct timeout object’s handle. In input, it is used by delete command only.

protocol

The ct timeout object’s layer 4 protocol.

state

The connection state name, e.g. "established", "syn_sent", "close" or "close_wait", for which the timeout value has to be updated.

value

The updated timeout value for the specified connection state.

l3proto

The ct timeout object’s layer 3 protocol, e.g. "ip" or "ip6".

### CT EXPECTATION

```
{ "ct expectation": {

        "family": STRING,

        "table": STRING,

        "name": STRING,

        "handle": NUMBER,

        "l3proto": STRING

        "protocol":* CTH_PROTO,

        "dport": NUMBER,

        "timeout: NUMBER,

        "size: NUMBER,
*}}
CTH_PROTO := "tcp" | "udp" | "dccp" | "sctp" | "gre" | "icmpv6" | "icmp" | "generic"
```

This object represents a named conntrack expectation.

family

The table’s family.

table

The table’s name.

name

The ct expectation object’s name.

handle

The ct expectation object’s handle. In input, it is used by delete command only.

l3proto

The ct expectation object’s layer 3 protocol, e.g. "ip" or "ip6".

protocol

The ct expectation object’s layer 4 protocol.

dport

The destination port of the expected connection.

timeout

The time in millisecond that this expectation will live.

size

The maximum count of expectations to be living in the same time.

## STATEMENTS
Statements are the building blocks for rules. Each rule consists of at least one.

### VERDICT

```
{ "accept": null }
{ "drop": null }
{ "continue": null }
{ "return": null }
{ "jump": { "target": * STRING *}}
{ "goto": { "target": * STRING *}}
```

A verdict either terminates packet traversal through the current chain or delegates to a different one.

jump and goto statements expect a target chain name.

### MATCH

```
{ "match": {

        "left": EXPRESSION,

        "right": EXPRESSION,

        "op": STRING
}}
```

This matches the expression on left hand side (typically a packet header or packet meta info) with the expression on right hand side (typically a constant value). If the statement evaluates to true, the next statement in this rule is considered. If not, processing continues with the next rule in the same chain.

left

Left hand side of this match.

right

Right hand side of this match.

op

Operator indicating the type of comparison.

OPERATORS

==

Equal

!=

Not equal

<

Less than

>

Greater than

⇐

Less than or equal to

>=

Greater than or equal to

in

Perform a lookup, i.e. test if bits on RHS are contained in LHS value

Unlike with the standard API, the operator is mandatory here. In the standard API, a missing operator may be resolved in two ways, depending on the type of expression on the RHS:

•If the RHS is a bitmask or a list of bitmasks, the expression resolves into a binary operation with the inequality operator, like this: LHS & RHS != 0.

•In any other case, the equality operator is simply inserted.

For the non-trivial first case, the JSON API supports the in operator.

### COUNTER

```
{ "counter": {

        "packets": NUMBER,

        "bytes": NUMBER
}}
{ "counter": STRING }
```

This object represents a byte/packet counter. In input, no properties are required. If given, they act as initial values for the counter.

The first form creates an anonymous counter which lives in the rule it appears in. The second form specifies a reference to a named counter object.

packets

Packets counted.

bytes

Bytes counted.

### MANGLE

```
{ "mangle": {

        "key": EXPRESSION,

        "value": EXPRESSION
}}
```

This changes the packet data or meta info.

key

The packet data to be changed, given as an exthdr, payload, meta, ct or ct helper expression.

value

Value to change data to.

### QUOTA

```
{ "quota": {

        "val": NUMBER,

        "val_unit": STRING,

        "used": NUMBER,

        "used_unit": STRING,

        "inv": BOOLEAN
}}
{ "quota": STRING }
```

The first form creates an anonymous quota which lives in the rule it appears in. The second form specifies a reference to a named quota object.

val

Quota value.

val_unit

Unit of val, e.g. "kbytes" or "mbytes". If omitted, defaults to "bytes".

used

Quota used so far. Optional on input. If given, serves as initial value.

used_unit

Unit of used. Defaults to "bytes".

inv

If true, will match if quota was exceeded. Defaults to false.

### LIMIT

```
{ "limit": {

        "rate": NUMBER,

        "rate_unit": STRING,

        "per": STRING,

        "burst": NUMBER,

        "burst_unit": STRING,

        "inv": BOOLEAN
}}
{ "limit": STRING }
```

The first form creates an anonymous limit which lives in the rule it appears in. The second form specifies a reference to a named limit object.

rate

Rate value to limit to.

rate_unit

Unit of rate, e.g. "packets" or "mbytes". Defaults to "packets".

per

Denominator of rate, e.g. "week" or "minutes".

burst

Burst value. Defaults to 0.

burst_unit

Unit of burst, ignored if rate_unit is "packets". Defaults to "bytes".

inv

If true, matches if the limit was exceeded. Defaults to false.

### FWD

```
{ "fwd": {

        "dev": EXPRESSION,

        "family": FWD_FAMILY,

        "addr": EXPRESSION
}}
FWD_FAMILY := "ip" | "ip6"
```

Forward a packet to a different destination.

dev

Interface to forward the packet on.

family

Family of addr.

addr

IP(v6) address to forward the packet to.

Both family and addr are optional, but if at least one is given, both must be present.

### NOTRACK

```
{ "notrack": null }
```

Disable connection tracking for the packet.

### DUP

```
{ "dup": {

        "addr": EXPRESSION,

        "dev": EXPRESSION
}}
```

Duplicate a packet to a different destination.

addr

Address to duplicate packet to.

dev

Interface to duplicate packet on. May be omitted to not specify an interface explicitly.

### NETWORK ADDRESS TRANSLATION

```
{ "snat": {

        "addr": EXPRESSION,

        "family": STRING,

        "port": EXPRESSION,

        "flags": FLAGS
}}
{ "dnat": {

        "addr": EXPRESSION,

        "family": STRING,

        "port": EXPRESSION,

        "flags": FLAGS
}}
{ "masquerade": {

        "port": EXPRESSION,

        "flags": FLAGS
}}
{ "redirect": {

        "port": EXPRESSION,

        "flags": FLAGS
}}
FLAGS := FLAG | [ FLAG_LIST ]
FLAG_LIST := FLAG [, FLAG_LIST ]
FLAG := "random" | "fully-random" | "persistent"
```

Perform Network Address Translation.

addr

Address to translate to.

family

Family of addr, either ip or ip6. Required in inet table family.

port

Port to translate to.

flags

Flag(s).

All properties are optional and default to none.

### REJECT

```
{ "reject": {

        "type": STRING,

        "expr": EXPRESSION
}}
```

Reject the packet and send the given error reply.

type

Type of reject, either "tcp reset", "icmpx", "icmp" or "icmpv6".

expr

ICMP code to reject with.

All properties are optional.

### SET

```
{ "set": {

        "op": STRING,

        "elem": EXPRESSION,

        "set": STRING
}}
```

Dynamically add/update elements to a set.

op

Operator on set, either "add" or "update".

elem

Set element to add or update.

set

Set reference.

### LOG

```
{ "log": {

        "prefix": STRING,

        "group": NUMBER,

        "snaplen": NUMBER,

        "queue-threshold": NUMBER,

        "level": LEVEL,

        "flags": FLAGS
}}
LEVEL := "emerg" | "alert" | "crit" | "err" | "warn" | "notice" |

           "info" | "debug" | "audit"
FLAGS := FLAG | [ FLAG_LIST ]
FLAG_LIST := FLAG [, FLAG_LIST ]
FLAG := "tcp sequence" | "tcp options" | "ip options" | "skuid" |

          "ether" | "all"
```

Log the packet.

prefix

Prefix for log entries.

group

Log group.

snaplen

Snaplen for logging.

queue-threshold

Queue threshold.

level

Log level. Defaults to "warn".

flags

Log flags.

All properties are optional.

### CT HELPER

```
{ "ct helper": EXPRESSION }
```

Enable the specified conntrack helper for this packet.

ct helper

CT helper reference.

### METER

```
{ "meter": {

        "name": STRING,

        "key": EXPRESSION,

        "stmt": STATEMENT
}}
```

Apply a given statement using a meter.

name

Meter name.

key

Meter key.

stmt

Meter statement.

### QUEUE

```
{ "queue": {

        "num": EXPRESSION,

        "flags": FLAGS
}}
FLAGS := FLAG | [ FLAG_LIST ]
FLAG_LIST := FLAG [, FLAG_LIST ]
FLAG := "bypass" | "fanout"
```

Queue the packet to userspace.

num

Queue number.

flags

Queue flags.

### VERDICT MAP

```
{ "vmap": {

        "key": EXPRESSION,

        "data": EXPRESSION
}}
```

Apply a verdict conditionally.

key

Map key.

data

Mapping expression consisting of value/verdict pairs.

### CT COUNT

```
{ "ct count": {

        "val": NUMBER,

        "inv": BOOLEAN
}}
```

Limit the number of connections using conntrack.

val

Connection count threshold.

inv

If true, match if val was exceeded. If omitted, defaults to false.

### CT TIMEOUT

```
{ "ct timeout": EXPRESSION }
```

Assign connection tracking timeout policy.

ct timeout

CT timeout reference.

### CT EXPECTATION

```
{ "ct expectation": EXPRESSION }
```

Assign connection tracking expectation.

ct expectation

CT expectation reference.

### XT

```
{ "xt": {

        "type": TYPENAME,

        "name": STRING
}}
TYPENAME := match | target | watcher
```

This represents an xt statement from xtables compat interface. It is a fallback if translation is not available or not complete.

Seeing this means the ruleset (or parts of it) were created by iptables-nft and one should use that to manage it.

BEWARE: nftables won’t restore these statements.

## EXPRESSIONS
Expressions are the building blocks of (most) statements. In their most basic form, they are just immediate values represented as a JSON string, integer or boolean type.

### IMMEDIATES

```
STRING
NUMBER
BOOLEAN
```

Immediate expressions are typically used for constant values. For strings, there are two special cases:

@STRING

The remaining part is taken as set name to create a set reference.

\*

Construct a wildcard expression.

### LISTS

```
ARRAY
```

List expressions are constructed by plain arrays containing of an arbitrary number of expressions.

### CONCAT

```
{ "concat": CONCAT }
CONCAT := [ EXPRESSION_LIST ]
EXPRESSION_LIST := EXPRESSION [, EXPRESSION_LIST ]
```

Concatenate several expressions.

### SET

```
{ "set": SET }
SET := EXPRESSION | [ EXPRESSION_LIST ]
```

This object constructs an anonymous set. For mappings, an array of arrays with exactly two elements is expected.

### MAP

```
{ "map": {

        "key": EXPRESSION,

        "data": EXPRESSION
}}
```

Map a key to a value.

key

Map key.

data

Mapping expression consisting of value/target pairs.

### PREFIX

```
{ "prefix": {

        "addr": EXPRESSION,

        "len": NUMBER
}}
```

Construct an IPv4 or IPv6 prefix consisting of address part in addr and prefix length in len.

### RANGE

```
{ "range": [ EXPRESSION , EXPRESSION ] }
```

Construct a range of values. The first array item denotes the lower boundary, the second one the upper boundary.

### PAYLOAD

```
{ "payload": {

        "base": BASE,

        "offset": NUMBER,

        "len": NUMBER
}}
{ "payload": {

        "protocol": STRING,

        "field": STRING
}}
BASE := "ll" | "nh" | "th"
```

Construct a payload expression, i.e. a reference to a certain part of packet data. The first form creates a raw payload expression to point at a random number (len) of bits at a certain offset (offset) from a given reference point (base). The following base values are accepted:

"ll"

The offset is relative to Link Layer header start offset.

"nh"

The offset is relative to Network Layer header start offset.

"th"

The offset is relative to Transport Layer header start offset.

The second form allows one to reference a field by name (field) in a named packet header (protocol).

### EXTHDR

```
{ "exthdr": {

        "name": STRING,

        "field": STRING,

        "offset": NUMBER
}}
```

Create a reference to a field (field) in an IPv6 extension header (name). offset is used only for rt0 protocol.

If the field property is not given, the expression is to be used as a header existence check in a match statement with a boolean on the right hand side.

### TCP OPTION

```
{ "tcp option": {

        "name": STRING,

        "field": STRING
}}
```

Create a reference to a field (field) of a TCP option header (name).

If the field property is not given, the expression is to be used as a TCP option existence check in a match statement with a boolean on the right hand side.

### SCTP CHUNK

```
{ "sctp chunk": {

        "name": STRING,

        "field": STRING
}}
```

Create a reference to a field (field) of an SCTP chunk (name).

If the field property is not given, the expression is to be used as an SCTP chunk existence check in a match statement with a boolean on the right hand side.

### DCCP OPTION

```
{ "dccp option": {

        "type": NUMBER*
}}
```

Create a reference to a DCCP option (type).

The expression is to be used as a DCCP option existence check in a match statement with a boolean on the right hand side.

### META

```
{ "meta": {

        "key": META_KEY
}}
META_KEY := "length" | "protocol" | "priority" | "random" | "mark" |

              "iif" | "iifname" | "iiftype" | "oif" | "oifname" |

              "oiftype" | "skuid" | "skgid" | "nftrace" |

              "rtclassid" | "ibriport" | "obriport" | "ibridgename" |

              "obridgename" | "pkttype" | "cpu" | "iifgroup" |

              "oifgroup" | "cgroup" | "nfproto" | "l4proto" |

              "secpath"
```

Create a reference to packet meta data.

### RT

```
{ "rt": {

        "key": RT_KEY,

        "family": RT_FAMILY
}}
RT_KEY := "classid" | "nexthop" | "mtu"
RT_FAMILY := "ip" | "ip6"
```

Create a reference to packet routing data.

The family property is optional and defaults to unspecified.

### CT

```
{ "ct": {

        "key": STRING,

        "family": CT_FAMILY,

        "dir": CT_DIRECTION
}}
CT_FAMILY := "ip" | "ip6"
CT_DIRECTION := "original" | "reply"
```

Create a reference to packet conntrack data.

Some CT keys do not support a direction. In this case, dir must not be given.

### NUMGEN

```
{ "numgen": {

        "mode": NG_MODE,

        "mod": NUMBER,

        "offset": NUMBER
}}
NG_MODE := "inc" | "random"
```

Create a number generator.

The offset property is optional and defaults to 0.

### HASH

```
{ "jhash": {

        "mod": NUMBER,

        "offset": NUMBER,

        "expr": EXPRESSION,

        "seed": NUMBER
}}
{ "symhash": {

        "mod": NUMBER,

        "offset": NUMBER
}}
```

Hash packet data.

The offset and seed properties are optional and default to 0.

### FIB

```
{ "fib": {

        "result": FIB_RESULT,

        "flags": FIB_FLAGS
}}
FIB_RESULT := "oif" | "oifname" | "type"
FIB_FLAGS := FIB_FLAG | [ FIB_FLAG_LIST ]
FIB_FLAG_LIST := FIB_FLAG [, FIB_FLAG_LIST ]
FIB_FLAG := "saddr" | "daddr" | "mark" | "iif" | "oif"
```

Perform kernel Forwarding Information Base lookups.

### BINARY OPERATION

```
{ "|": [ EXPRESSION, EXPRESSIONS ] }
{ "^": [ EXPRESSION, EXPRESSIONS ] }
{ "&": [ EXPRESSION, EXPRESSIONS ] }
{ "<<": [ EXPRESSION, EXPRESSIONS ] }
{ ">>": [ EXPRESSION, EXPRESSIONS ] }
EXPRESSIONS := EXPRESSION | EXPRESSION, EXPRESSIONS
```

All binary operations expect an array of at least two expressions, of which the first element denotes the left hand side and the second one the right hand side. Extra elements are accepted in the given array and appended to the term accordingly.

### VERDICT

```
{ "accept": null }
{ "drop": null }
{ "continue": null }
{ "return": null }
{ "jump": { "target": STRING }}
{ "goto": { "target": STRING }}
```

Same as the verdict statement, but for use in verdict maps.

jump and goto verdicts expect a target chain name.

### ELEM

```
{ "elem": {

        "val": EXPRESSION,

        "timeout": NUMBER,

        "expires": NUMBER,

        "comment": STRING
}}
```

Explicitly set element object, in case timeout, expires or comment are desired. Otherwise, it may be replaced by the value of val.

### SOCKET

```
{ "socket": {

        "key": SOCKET_KEY
}}
SOCKET_KEY := "transparent"
```

Construct a reference to packet’s socket.

### OSF

```
{ "osf": {

        "key": OSF_KEY,

        "ttl": OSF_TTL
}}
OSF_KEY := "name"
OSF_TTL := "loose" | "skip"
```

Perform OS fingerprinting. This expression is typically used in the LHS of a match statement.

key

Which part of the fingerprint info to match against. At this point, only the OS name is supported.

ttl

Define how the packet’s TTL value is to be matched. This property is optional. If omitted, the TTL value has to match exactly. A value of loose accepts TTL values less than the fingerprint one. A value of skip omits TTL value comparison entirely.

## AUTHOR
Phil Sutter <phil@nwl.cc>

Author.


package: libnng-devel

title: nng_aio(5)

summary: asynchronous I/O handle

text:
# nng_aio(5)

## NAME
nng_aio - asynchronous I/O handle

## SYNOPSIS

```
#include <nng/nng.h>
typedef struct nng_aio nng_aio;
```

## DESCRIPTION
An nng_aio is an opaque structure used in conjunction with asynchronous I/O operations. Every asynchronous operation uses one of these structures, each of which can only be used with a single operation at a time.

Asynchronous operations are performed without blocking calling application threads. Instead the application registers a callback function to be executed when the operation is complete (whether successfully or not). This callback will be executed exactly once.

The asynchronous I/O framework also supports cancellation of operations that are already in progress (see nng_aio_cancel()), as well setting a maximum timeout for them to complete within (see nng_aio_set_timeout()).

It is also possible to initiate an asynchronous operation, and wait for it to complete using nng_aio_wait().

These structures are created using the nng_aio_alloc(), and destroyed using nng_aio_free().

## SEE ALSO
nng_aio_abort(3), nng_aio_alloc(3), nng_aio_cancel(3), nng_aio_count(3), nng_aio_free(3), nng_aio_get_input(3), nng_aio_get_msg(3), nng_aio_get_output(3), nng_aio_result(3), nng_aio_set_input(3), nng_aio_set_iov(3), nng_aio_set_msg(3), nng_aio_set_timeout(3), nng_aio_stop(3), nng_aio_wait(3), nng_strerror(3), nng_aio(5), nng(7)