Module parse 

From a captured netlink message to the changes it makes (§12d). Read-only requests (RTM_GET*, dumps) change nothing. A message this module cannot fully read but that may change how traffic leaves is not guessed at: it is reported as Parsed::Unreadable, which marks the sender’s footprint unattributed (fail closed).

Enums

Parsed

Scope

Which network namespace a request acts on, against netwatch’s own (crate docs, “Namespaces”).

Constants

FRA_PRIORITY 🔒

FRA_TABLE 🔒

FR_ACT_TO_TBL 🔒

IFINFOMSG_LEN 🔒

IFLA_IFNAME 🔒

IFLA_NET_NS_FD 🔒

IFLA_NET_NS_PID 🔒

IFLA_TARGET_NETNSID 🔒

NFNL_SUBSYS_NFTABLES 🔒

nfnetlink’s nftables subsystem (NFNL_SUBSYS_NFTABLES).

NFT_READS 🔒

The nftables messages that only read (enum nf_tables_msg_types): GETTABLE 1, GETCHAIN 4, GETRULE 7, GETSET 10, GETSETELEM 13, GETGEN 16, GETOBJ 19, GETFLOWTABLE 23. Listed, not computed: the numbering stopped following a pattern at NFT_MSG_GETOBJ_RESET. Any other type, a later kernel’s included, is a change (fail closed). The resets (GETOBJ_RESET 21, GETRULE_RESET 25, GETSETELEM_RESET 33) are changes too: zeroing a quota or limit can flip a verdict (reviewer, coordinator, Nov 3). vm-netwatch (n) found GETFLOWTABLE read as a change: nft list made its caller protecting.

NLMSG_HDRLEN 🔒

NLM_F_CREATE 🔒

RTA_DST 🔒

RTA_OIF 🔒

RTA_PRIORITY 🔒

RTA_TABLE 🔒

RTM_DELLINK 🔒

RTM_DELROUTE 🔒

RTM_DELRULE 🔒

RTM_NEWLINK 🔒

RTM_NEWROUTE 🔒

RTM_NEWRULE 🔒

RTM_SETLINK 🔒

Functions

attrs 🔒

The attributes after a fixed header, as (type, payload); None if one runs past the captured bytes.

cstr 🔒

hex 🔒

parse

The changes in ev, made by owner. ifname names an interface index.

scope

take

One event as the loop takes it: ignored if it acts in another netns, a loss nothing can place if the netns is unknown, else parsed and applied to t for the unit unit() finds (unattributed if none).

u16_at 🔒

u32_at 🔒