chore: import upstream snapshot with attribution

nftables/help/action.html

@@ -0,0 +1,7 @@
+<header>Action</header>
+<p>Verdict or control action for matching packets.</p>
+<ul>
+<li>Accept, Drop, Reject, Return</li>
+<li>Jump or Goto to another chain</li>
+</ul>
+<footer>nft(8)</footer>

nftables/help/chain_hook.html

@@ -0,0 +1,3 @@
+<header>Hook</header>
+<p>Base chain hook point, such as <tt>prerouting</tt>, <tt>input</tt>, <tt>forward</tt>, <tt>output</tt>, <tt>postrouting</tt>, or <tt>ingress</tt>.</p>
+<footer>nft(8)</footer>

nftables/help/chain_name.html

@@ -0,0 +1,3 @@
+<header>Chain name</header>
+<p>Unique name for the chain within this table. Use letters, numbers, underscores, and dashes.</p>
+<footer>nft(8)</footer>

nftables/help/chain_policy.html

@@ -0,0 +1,3 @@
+<header>Policy</header>
+<p>Default action for this base chain, such as <tt>accept</tt>, <tt>drop</tt>, <tt>reject</tt>, <tt>queue</tt>, or <tt>continue</tt>.</p>
+<footer>nft(8)</footer>

nftables/help/chain_priority.html

@@ -0,0 +1,3 @@
+<header>Priority</header>
+<p>Priority for this base chain. Lower values run earlier. Common values include <tt>-300</tt>, <tt>-150</tt>, <tt>0</tt>, or <tt>100</tt>.</p>
+<footer>nft(8)</footer>

nftables/help/chain_type.html

@@ -0,0 +1,3 @@
+<header>Chain type</header>
+<p>Base chain type, such as <tt>filter</tt>, <tt>nat</tt>, or <tt>route</tt>. Leave blank to create a regular chain with no hook.</p>
+<footer>nft(8)</footer>

nftables/help/comment.html

@@ -0,0 +1,6 @@
+<header>Comment</header>
+
+Optional note stored with the rule.<p>
+Saved as comment "text"; quotes and backslashes are escaped.<p>
+
+<footer>nft(8)</footer>

nftables/help/counter.html

@@ -0,0 +1,3 @@
+<header>Counter</header>
+<p>Add a counter to track packets and bytes.</p>
+<footer>nft(8)</footer>

nftables/help/counter_1.html

@@ -0,0 +1,3 @@
+<header>Counter</header>
+<p>Add a counter to track packets and bytes.</p>
+<footer>nft(8)</footer>

nftables/help/ct_state.html

@@ -0,0 +1,10 @@
+<header>Conntrack state</header>
+<p>Select one or more states to match.</p>
+<ul>
+<li>invalid</li>
+<li>new</li>
+<li>established</li>
+<li>related</li>
+<li>untracked</li>
+</ul>
+<footer>nft(8)</footer>

nftables/help/daddr.html

@@ -0,0 +1,3 @@
+<header>Destination address</header>
+<p>IPv4/IPv6 address or CIDR (e.g., 2001:db8::/32).</p>
+<footer>nft(8)</footer>

nftables/help/dport.html

@@ -0,0 +1,3 @@
+<header>Destination port</header>
+<p>TCP/UDP destination port number or range on the local service being reached (e.g., 22, 80 or 1000-2000).</p>
+<footer>nft(8)</footer>

nftables/help/edit_direct.html

@@ -0,0 +1,4 @@
+<header>Edit directly</header>
+<p>Disable structured fields and edit the raw rule line.</p>
+<p>Validation occurs on save.</p>
+<footer>nft(8)</footer>

nftables/help/edit_direct_1.html

@@ -0,0 +1,4 @@
+<header>Edit directly</header>
+<p>Disable structured fields and edit the raw rule line.</p>
+<p>Validation occurs on save.</p>
+<footer>nft(8)</footer>

nftables/help/goto.html

@@ -0,0 +1,4 @@
+<header>Goto target chain</header>
+<p>Name of the chain to transfer control to.</p>
+<p>Does not return to the calling chain.</p>
+<footer>nft(8)</footer>

nftables/help/icmp_type.html

@@ -0,0 +1,5 @@
+<header>ICMP/ICMPv6 type</header>
+<p>Select a type name (or leave blank for any). The valid names depend on the protocol.</p>
+<p>ICMP types: echo-reply, destination-unreachable, source-quench, redirect, echo-request, router-advertisement, router-solicitation, time-exceeded, parameter-problem, timestamp-request, timestamp-reply, info-request, info-reply, address-mask-request, address-mask-reply.</p>
+<p>ICMPv6 types: destination-unreachable, packet-too-big, time-exceeded, parameter-problem, echo-request, echo-reply, mld-listener-query, mld-listener-report, mld-listener-done, mld-listener-reduction, nd-router-solicit, nd-router-advert, nd-neighbor-solicit, nd-neighbor-advert, nd-redirect, router-renumbering, ind-neighbor-solicit, ind-neighbor-advert, mld2-listener-report.</p>
+<footer>nft(8)</footer>

nftables/help/iif.html

@@ -0,0 +1,3 @@
+<header>Incoming interface</header>
+<p>Match the incoming interface name (e.g., eth0).</p>
+<footer>nft(8)</footer>

nftables/help/intro.html

@@ -0,0 +1,4 @@
+<header>Introduction</header>
+<p>nftables stores firewall rules in tables. Each table belongs to a family (such as <tt>inet</tt>, <tt>ip</tt>, or <tt>ip6</tt>) and contains one or more chains. Chains contain rules, and each rule is a sequence of tests (matches) followed by an action like <tt>accept</tt>, <tt>drop</tt>, <tt>jump</tt>, or <tt>log</tt>. Named sets can group addresses or services for reuse in multiple rules.</p>
+<p>To get started, use the Setup page to create a default ruleset, or create a table and chain manually. Then add rules (and sets) from the table view. When you are ready to activate your changes, click Apply Configuration to load the ruleset into the kernel.</p>
+<footer>nft(8)</footer>

nftables/help/jump.html

@@ -0,0 +1,4 @@
+<header>Jump target chain</header>
+<p>Name of the chain to call.</p>
+<p>Control returns to the next rule after the jump.</p>
+<footer>nft(8)</footer>

nftables/help/limit_burst.html

@@ -0,0 +1,3 @@
+<header>Limit burst</header>
+<p>Optional burst size in packets.</p>
+<footer>nft(8)</footer>

nftables/help/limit_rate.html

@@ -0,0 +1,3 @@
+<header>Limit rate</header>
+<p>Rate limit (e.g., 10/second, 5/minute, 100/hour).</p>
+<footer>nft(8)</footer>

nftables/help/log.html

@@ -0,0 +1,4 @@
+<header>Logging</header>
+<p>Add a log statement before the verdict.</p>
+<p>Use prefix and level to customize.</p>
+<footer>nft(8)</footer>

nftables/help/log_1.html

@@ -0,0 +1,4 @@
+<header>Logging</header>
+<p>Add a log statement before the verdict.</p>
+<p>Use prefix and level to customize.</p>
+<footer>nft(8)</footer>

nftables/help/log_level.html

@@ -0,0 +1,3 @@
+<header>Log level</header>
+<p>Common values: emerg, alert, crit, err, warning, notice, info, debug.</p>
+<footer>nft(8)</footer>

nftables/help/log_prefix.html

@@ -0,0 +1,3 @@
+<header>Log prefix</header>
+<p>String prepended to the log message.</p>
+<footer>nft(8)</footer>

nftables/help/oif.html

@@ -0,0 +1,3 @@
+<header>Outgoing interface</header>
+<p>Match the outgoing interface name (e.g., eth1).</p>
+<footer>nft(8)</footer>

nftables/help/proto.html

@@ -0,0 +1,7 @@
+<header>Protocol</header>
+<p>Select a protocol to match.</p>
+<ul>
+<li>Any, TCP, UDP, ICMP, ICMPv6</li>
+</ul>
+<p>Ports apply to TCP/UDP; ICMP uses the type field.</p>
+<footer>nft(8)</footer>

nftables/help/raw_rule.html

@@ -0,0 +1,4 @@
+<header>Raw rule</header>
+<p>Generated rule line.</p>
+<p>In Edit directly mode, this is the rule that will be saved.</p>
+<footer>nft(8)</footer>

nftables/help/saddr.html

@@ -0,0 +1,3 @@
+<header>Source address</header>
+<p>IPv4/IPv6 address or CIDR (e.g., 192.168.1.0/24).</p>
+<footer>nft(8)</footer>

nftables/help/set_elements.html

@@ -0,0 +1,3 @@
+<header>Set elements</header>
+<p>Elements to store in the set. Separate entries with commas or newlines. Use nftables syntax, such as IPs/CIDR for address sets or ports for service sets.</p>
+<footer>nft(8)</footer>

nftables/help/set_flags.html

@@ -0,0 +1,3 @@
+<header>Set flags</header>
+<p>Optional flags for the set, like <tt>interval</tt> or <tt>timeout</tt>. Use the same syntax as nftables, separated by spaces if multiple.</p>
+<footer>nft(8)</footer>

nftables/help/set_name.html

@@ -0,0 +1,3 @@
+<header>Set name</header>
+<p>Unique name for the set within the table. Use letters, numbers, underscores, or dashes. Rules reference a set as <tt>@name</tt>.</p>
+<footer>nft(8)</footer>

nftables/help/set_type.html

@@ -0,0 +1,3 @@
+<header>Set type</header>
+<p>Type of elements stored in the set, such as <tt>ipv4_addr</tt>, <tt>ipv6_addr</tt>, or <tt>inet_service</tt>. This must match the elements you enter.</p>
+<footer>nft(8)</footer>

nftables/help/sport.html

@@ -0,0 +1,3 @@
+<header>Source port</header>
+<p>TCP/UDP source port number or range on the remote side of the connection (e.g., 22 or 1000-2000).</p>
+<footer>nft(8)</footer>

nftables/help/tcp_flags.html

@@ -0,0 +1,14 @@
+<header>TCP flags</header>
+<p>Select one or more TCP flags to match.</p>
+<ul>
+<li>fin</li>
+<li>syn</li>
+<li>rst</li>
+<li>psh</li>
+<li>ack</li>
+<li>urg</li>
+<li>ecn</li>
+<li>cwr</li>
+</ul>
+<p>Use the mask field for a bitmask match.</p>
+<footer>nft(8)</footer>

nftables/help/tcp_flags_mask.html

@@ -0,0 +1,4 @@
+<header>TCP flags mask</header>
+<p>Optional mask used with tcp flags &amp; mask == value.</p>
+<p>Example mask: syn|rst.</p>
+<footer>nft(8)</footer>