1 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
2 #ifndef _LINUX_NF_TABLES_H
3 #define _LINUX_NF_TABLES_H
4 
5 #define NFT_NAME_MAXLEN		256
6 #define NFT_TABLE_MAXNAMELEN	NFT_NAME_MAXLEN
7 #define NFT_CHAIN_MAXNAMELEN	NFT_NAME_MAXLEN
8 #define NFT_SET_MAXNAMELEN	NFT_NAME_MAXLEN
9 #define NFT_OBJ_MAXNAMELEN	NFT_NAME_MAXLEN
10 #define NFT_USERDATA_MAXLEN	256
11 #define NFT_OSF_MAXGENRELEN	16
12 
13 /**
14  * enum nft_registers - nf_tables registers
15  *
16  * nf_tables used to have five registers: a verdict register and four data
17  * registers of size 16. The data registers have been changed to 16 registers
18  * of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
19  * map to areas of size 16, the 4 byte registers are addressed using
20  * NFT_REG32_00 - NFT_REG32_15.
21  */
22 enum nft_registers {
23 	NFT_REG_VERDICT,
24 	NFT_REG_1,
25 	NFT_REG_2,
26 	NFT_REG_3,
27 	NFT_REG_4,
28 	__NFT_REG_MAX,
29 
30 	NFT_REG32_00	= 8,
31 	NFT_REG32_01,
32 	NFT_REG32_02,
33 	NFT_REG32_03,
34 	NFT_REG32_04,
35 	NFT_REG32_05,
36 	NFT_REG32_06,
37 	NFT_REG32_07,
38 	NFT_REG32_08,
39 	NFT_REG32_09,
40 	NFT_REG32_10,
41 	NFT_REG32_11,
42 	NFT_REG32_12,
43 	NFT_REG32_13,
44 	NFT_REG32_14,
45 	NFT_REG32_15,
46 };
47 #define NFT_REG_MAX	(__NFT_REG_MAX - 1)
48 
49 #define NFT_REG_SIZE	16
50 #define NFT_REG32_SIZE	4
51 #define NFT_REG32_COUNT	(NFT_REG32_15 - NFT_REG32_00 + 1)
52 
53 /**
54  * enum nft_verdicts - nf_tables internal verdicts
55  *
56  * @NFT_CONTINUE: continue evaluation of the current rule
57  * @NFT_BREAK: terminate evaluation of the current rule
58  * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
59  * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
60  * @NFT_RETURN: return to the topmost chain on the jump stack
61  *
62  * The nf_tables verdicts share their numeric space with the netfilter verdicts.
63  */
64 enum nft_verdicts {
65 	NFT_CONTINUE	= -1,
66 	NFT_BREAK	= -2,
67 	NFT_JUMP	= -3,
68 	NFT_GOTO	= -4,
69 	NFT_RETURN	= -5,
70 };
71 
72 /**
73  * enum nf_tables_msg_types - nf_tables netlink message types
74  *
75  * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
76  * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
77  * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
78  * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
79  * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
80  * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
81  * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
82  * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
83  * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
84  * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
85  * @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
86  * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
87  * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
88  * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
89  * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
90  * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
91  * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
92  * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
93  * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
94  * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
95  * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
96  * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
97  * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
98  * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
99  * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
100  * @NFT_MSG_GETRULE_RESET: get rules and reset stateful expressions (enum nft_obj_attributes)
101  * @NFT_MSG_DESTROYTABLE: destroy a table (enum nft_table_attributes)
102  * @NFT_MSG_DESTROYCHAIN: destroy a chain (enum nft_chain_attributes)
103  * @NFT_MSG_DESTROYRULE: destroy a rule (enum nft_rule_attributes)
104  * @NFT_MSG_DESTROYSET: destroy a set (enum nft_set_attributes)
105  * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)
106  * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)
107  * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)
108  * @NFT_MSG_GETSETELEM_RESET: get set elements and reset attached stateful expressions (enum nft_set_elem_attributes)
109  */
110 enum nf_tables_msg_types {
111 	NFT_MSG_NEWTABLE,
112 	NFT_MSG_GETTABLE,
113 	NFT_MSG_DELTABLE,
114 	NFT_MSG_NEWCHAIN,
115 	NFT_MSG_GETCHAIN,
116 	NFT_MSG_DELCHAIN,
117 	NFT_MSG_NEWRULE,
118 	NFT_MSG_GETRULE,
119 	NFT_MSG_DELRULE,
120 	NFT_MSG_NEWSET,
121 	NFT_MSG_GETSET,
122 	NFT_MSG_DELSET,
123 	NFT_MSG_NEWSETELEM,
124 	NFT_MSG_GETSETELEM,
125 	NFT_MSG_DELSETELEM,
126 	NFT_MSG_NEWGEN,
127 	NFT_MSG_GETGEN,
128 	NFT_MSG_TRACE,
129 	NFT_MSG_NEWOBJ,
130 	NFT_MSG_GETOBJ,
131 	NFT_MSG_DELOBJ,
132 	NFT_MSG_GETOBJ_RESET,
133 	NFT_MSG_NEWFLOWTABLE,
134 	NFT_MSG_GETFLOWTABLE,
135 	NFT_MSG_DELFLOWTABLE,
136 	NFT_MSG_GETRULE_RESET,
137 	NFT_MSG_DESTROYTABLE,
138 	NFT_MSG_DESTROYCHAIN,
139 	NFT_MSG_DESTROYRULE,
140 	NFT_MSG_DESTROYSET,
141 	NFT_MSG_DESTROYSETELEM,
142 	NFT_MSG_DESTROYOBJ,
143 	NFT_MSG_DESTROYFLOWTABLE,
144 	NFT_MSG_GETSETELEM_RESET,
145 	NFT_MSG_MAX,
146 };
147 
148 /**
149  * enum nft_list_attributes - nf_tables generic list netlink attributes
150  *
151  * @NFTA_LIST_ELEM: list element (NLA_NESTED)
152  */
153 enum nft_list_attributes {
154 	NFTA_LIST_UNSPEC,
155 	NFTA_LIST_ELEM,
156 	__NFTA_LIST_MAX
157 };
158 #define NFTA_LIST_MAX		(__NFTA_LIST_MAX - 1)
159 
160 /**
161  * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
162  *
163  * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
164  * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
165  * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
166  * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
167  */
168 enum nft_hook_attributes {
169 	NFTA_HOOK_UNSPEC,
170 	NFTA_HOOK_HOOKNUM,
171 	NFTA_HOOK_PRIORITY,
172 	NFTA_HOOK_DEV,
173 	NFTA_HOOK_DEVS,
174 	__NFTA_HOOK_MAX
175 };
176 #define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)
177 
178 /**
179  * enum nft_table_flags - nf_tables table flags
180  *
181  * @NFT_TABLE_F_DORMANT: this table is not active
182  */
183 enum nft_table_flags {
184 	NFT_TABLE_F_DORMANT	= 0x1,
185 	NFT_TABLE_F_OWNER	= 0x2,
186 };
187 #define NFT_TABLE_F_MASK	(NFT_TABLE_F_DORMANT | \
188 				 NFT_TABLE_F_OWNER)
189 
190 /**
191  * enum nft_table_attributes - nf_tables table netlink attributes
192  *
193  * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
194  * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
195  * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
196  * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
197  * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
198  */
199 enum nft_table_attributes {
200 	NFTA_TABLE_UNSPEC,
201 	NFTA_TABLE_NAME,
202 	NFTA_TABLE_FLAGS,
203 	NFTA_TABLE_USE,
204 	NFTA_TABLE_HANDLE,
205 	NFTA_TABLE_PAD,
206 	NFTA_TABLE_USERDATA,
207 	NFTA_TABLE_OWNER,
208 	__NFTA_TABLE_MAX
209 };
210 #define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
211 
212 enum nft_chain_flags {
213 	NFT_CHAIN_BASE		= (1 << 0),
214 	NFT_CHAIN_HW_OFFLOAD	= (1 << 1),
215 	NFT_CHAIN_BINDING	= (1 << 2),
216 };
217 #define NFT_CHAIN_FLAGS		(NFT_CHAIN_BASE		| \
218 				 NFT_CHAIN_HW_OFFLOAD	| \
219 				 NFT_CHAIN_BINDING)
220 
221 /**
222  * enum nft_chain_attributes - nf_tables chain netlink attributes
223  *
224  * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
225  * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
226  * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
227  * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
228  * @NFTA_CHAIN_POLICY: numeric policy of the chain (NLA_U32)
229  * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
230  * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
231  * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
232  * @NFTA_CHAIN_FLAGS: chain flags
233  * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
234  * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
235  */
236 enum nft_chain_attributes {
237 	NFTA_CHAIN_UNSPEC,
238 	NFTA_CHAIN_TABLE,
239 	NFTA_CHAIN_HANDLE,
240 	NFTA_CHAIN_NAME,
241 	NFTA_CHAIN_HOOK,
242 	NFTA_CHAIN_POLICY,
243 	NFTA_CHAIN_USE,
244 	NFTA_CHAIN_TYPE,
245 	NFTA_CHAIN_COUNTERS,
246 	NFTA_CHAIN_PAD,
247 	NFTA_CHAIN_FLAGS,
248 	NFTA_CHAIN_ID,
249 	NFTA_CHAIN_USERDATA,
250 	__NFTA_CHAIN_MAX
251 };
252 #define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)
253 
254 /**
255  * enum nft_rule_attributes - nf_tables rule netlink attributes
256  *
257  * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
258  * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
259  * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
260  * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
261  * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
262  * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
263  * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
264  * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
265  * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
266  * @NFTA_RULE_CHAIN_ID: add the rule to chain by ID, alternative to @NFTA_RULE_CHAIN (NLA_U32)
267  */
268 enum nft_rule_attributes {
269 	NFTA_RULE_UNSPEC,
270 	NFTA_RULE_TABLE,
271 	NFTA_RULE_CHAIN,
272 	NFTA_RULE_HANDLE,
273 	NFTA_RULE_EXPRESSIONS,
274 	NFTA_RULE_COMPAT,
275 	NFTA_RULE_POSITION,
276 	NFTA_RULE_USERDATA,
277 	NFTA_RULE_PAD,
278 	NFTA_RULE_ID,
279 	NFTA_RULE_POSITION_ID,
280 	NFTA_RULE_CHAIN_ID,
281 	__NFTA_RULE_MAX
282 };
283 #define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)
284 
285 /**
286  * enum nft_rule_compat_flags - nf_tables rule compat flags
287  *
288  * @NFT_RULE_COMPAT_F_UNUSED: unused
289  * @NFT_RULE_COMPAT_F_INV: invert the check result
290  */
291 enum nft_rule_compat_flags {
292 	NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
293 	NFT_RULE_COMPAT_F_INV	= (1 << 1),
294 	NFT_RULE_COMPAT_F_MASK	= NFT_RULE_COMPAT_F_INV,
295 };
296 
297 /**
298  * enum nft_rule_compat_attributes - nf_tables rule compat attributes
299  *
300  * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
301  * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
302  */
303 enum nft_rule_compat_attributes {
304 	NFTA_RULE_COMPAT_UNSPEC,
305 	NFTA_RULE_COMPAT_PROTO,
306 	NFTA_RULE_COMPAT_FLAGS,
307 	__NFTA_RULE_COMPAT_MAX
308 };
309 #define NFTA_RULE_COMPAT_MAX	(__NFTA_RULE_COMPAT_MAX - 1)
310 
311 /**
312  * enum nft_set_flags - nf_tables set flags
313  *
314  * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
315  * @NFT_SET_CONSTANT: set contents may not change while bound
316  * @NFT_SET_INTERVAL: set contains intervals
317  * @NFT_SET_MAP: set is used as a dictionary
318  * @NFT_SET_TIMEOUT: set uses timeouts
319  * @NFT_SET_EVAL: set can be updated from the evaluation path
320  * @NFT_SET_OBJECT: set contains stateful objects
321  * @NFT_SET_CONCAT: set contains a concatenation
322  * @NFT_SET_EXPR: set contains expressions
323  */
324 enum nft_set_flags {
325 	NFT_SET_ANONYMOUS		= 0x1,
326 	NFT_SET_CONSTANT		= 0x2,
327 	NFT_SET_INTERVAL		= 0x4,
328 	NFT_SET_MAP			= 0x8,
329 	NFT_SET_TIMEOUT			= 0x10,
330 	NFT_SET_EVAL			= 0x20,
331 	NFT_SET_OBJECT			= 0x40,
332 	NFT_SET_CONCAT			= 0x80,
333 	NFT_SET_EXPR			= 0x100,
334 };
335 
336 /**
337  * enum nft_set_policies - set selection policy
338  *
339  * @NFT_SET_POL_PERFORMANCE: prefer high performance over low memory use
340  * @NFT_SET_POL_MEMORY: prefer low memory use over high performance
341  */
342 enum nft_set_policies {
343 	NFT_SET_POL_PERFORMANCE,
344 	NFT_SET_POL_MEMORY,
345 };
346 
347 /**
348  * enum nft_set_desc_attributes - set element description
349  *
350  * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
351  * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
352  */
353 enum nft_set_desc_attributes {
354 	NFTA_SET_DESC_UNSPEC,
355 	NFTA_SET_DESC_SIZE,
356 	NFTA_SET_DESC_CONCAT,
357 	__NFTA_SET_DESC_MAX
358 };
359 #define NFTA_SET_DESC_MAX	(__NFTA_SET_DESC_MAX - 1)
360 
361 /**
362  * enum nft_set_field_attributes - attributes of concatenated fields
363  *
364  * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
365  */
366 enum nft_set_field_attributes {
367 	NFTA_SET_FIELD_UNSPEC,
368 	NFTA_SET_FIELD_LEN,
369 	__NFTA_SET_FIELD_MAX
370 };
371 #define NFTA_SET_FIELD_MAX	(__NFTA_SET_FIELD_MAX - 1)
372 
373 /**
374  * enum nft_set_attributes - nf_tables set netlink attributes
375  *
376  * @NFTA_SET_TABLE: table name (NLA_STRING)
377  * @NFTA_SET_NAME: set name (NLA_STRING)
378  * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
379  * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
380  * @NFTA_SET_KEY_LEN: key data length (NLA_U32)
381  * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
382  * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
383  * @NFTA_SET_POLICY: selection policy (NLA_U32)
384  * @NFTA_SET_DESC: set description (NLA_NESTED)
385  * @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
386  * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
387  * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
388  * @NFTA_SET_USERDATA: user data (NLA_BINARY)
389  * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
390  * @NFTA_SET_HANDLE: set handle (NLA_U64)
391  * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
392  * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
393  */
394 enum nft_set_attributes {
395 	NFTA_SET_UNSPEC,
396 	NFTA_SET_TABLE,
397 	NFTA_SET_NAME,
398 	NFTA_SET_FLAGS,
399 	NFTA_SET_KEY_TYPE,
400 	NFTA_SET_KEY_LEN,
401 	NFTA_SET_DATA_TYPE,
402 	NFTA_SET_DATA_LEN,
403 	NFTA_SET_POLICY,
404 	NFTA_SET_DESC,
405 	NFTA_SET_ID,
406 	NFTA_SET_TIMEOUT,
407 	NFTA_SET_GC_INTERVAL,
408 	NFTA_SET_USERDATA,
409 	NFTA_SET_PAD,
410 	NFTA_SET_OBJ_TYPE,
411 	NFTA_SET_HANDLE,
412 	NFTA_SET_EXPR,
413 	NFTA_SET_EXPRESSIONS,
414 	__NFTA_SET_MAX
415 };
416 #define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
417 
418 /**
419  * enum nft_set_elem_flags - nf_tables set element flags
420  *
421  * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
422  * @NFT_SET_ELEM_CATCHALL: special catch-all element
423  */
424 enum nft_set_elem_flags {
425 	NFT_SET_ELEM_INTERVAL_END	= 0x1,
426 	NFT_SET_ELEM_CATCHALL		= 0x2,
427 };
428 
429 /**
430  * enum nft_set_elem_attributes - nf_tables set element netlink attributes
431  *
432  * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
433  * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
434  * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
435  * @NFTA_SET_ELEM_TIMEOUT: timeout value (NLA_U64)
436  * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
437  * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
438  * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
439  * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
440  * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
441  * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
442  */
443 enum nft_set_elem_attributes {
444 	NFTA_SET_ELEM_UNSPEC,
445 	NFTA_SET_ELEM_KEY,
446 	NFTA_SET_ELEM_DATA,
447 	NFTA_SET_ELEM_FLAGS,
448 	NFTA_SET_ELEM_TIMEOUT,
449 	NFTA_SET_ELEM_EXPIRATION,
450 	NFTA_SET_ELEM_USERDATA,
451 	NFTA_SET_ELEM_EXPR,
452 	NFTA_SET_ELEM_PAD,
453 	NFTA_SET_ELEM_OBJREF,
454 	NFTA_SET_ELEM_KEY_END,
455 	NFTA_SET_ELEM_EXPRESSIONS,
456 	__NFTA_SET_ELEM_MAX
457 };
458 #define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)
459 
460 /**
461  * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
462  *
463  * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
464  * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
465  * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
466  * @NFTA_SET_ELEM_LIST_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
467  */
468 enum nft_set_elem_list_attributes {
469 	NFTA_SET_ELEM_LIST_UNSPEC,
470 	NFTA_SET_ELEM_LIST_TABLE,
471 	NFTA_SET_ELEM_LIST_SET,
472 	NFTA_SET_ELEM_LIST_ELEMENTS,
473 	NFTA_SET_ELEM_LIST_SET_ID,
474 	__NFTA_SET_ELEM_LIST_MAX
475 };
476 #define NFTA_SET_ELEM_LIST_MAX	(__NFTA_SET_ELEM_LIST_MAX - 1)
477 
478 /**
479  * enum nft_data_types - nf_tables data types
480  *
481  * @NFT_DATA_VALUE: generic data
482  * @NFT_DATA_VERDICT: netfilter verdict
483  *
484  * The type of data is usually determined by the kernel directly and is not
485  * explicitly specified by userspace. The only difference are sets, where
486  * userspace specifies the key and mapping data types.
487  *
488  * The values 0xffffff00-0xffffffff are reserved for internally used types.
489  * The remaining range can be freely used by userspace to encode types, all
490  * values are equivalent to NFT_DATA_VALUE.
491  */
492 enum nft_data_types {
493 	NFT_DATA_VALUE,
494 	NFT_DATA_VERDICT	= 0xffffff00U,
495 };
496 
497 #define NFT_DATA_RESERVED_MASK	0xffffff00U
498 
499 /**
500  * enum nft_data_attributes - nf_tables data netlink attributes
501  *
502  * @NFTA_DATA_VALUE: generic data (NLA_BINARY)
503  * @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
504  */
505 enum nft_data_attributes {
506 	NFTA_DATA_UNSPEC,
507 	NFTA_DATA_VALUE,
508 	NFTA_DATA_VERDICT,
509 	__NFTA_DATA_MAX
510 };
511 #define NFTA_DATA_MAX		(__NFTA_DATA_MAX - 1)
512 
513 /* Maximum length of a value */
514 #define NFT_DATA_VALUE_MAXLEN	64
515 
516 /**
517  * enum nft_verdict_attributes - nf_tables verdict netlink attributes
518  *
519  * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
520  * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
521  * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
522  */
523 enum nft_verdict_attributes {
524 	NFTA_VERDICT_UNSPEC,
525 	NFTA_VERDICT_CODE,
526 	NFTA_VERDICT_CHAIN,
527 	NFTA_VERDICT_CHAIN_ID,
528 	__NFTA_VERDICT_MAX
529 };
530 #define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)
531 
532 /**
533  * enum nft_expr_attributes - nf_tables expression netlink attributes
534  *
535  * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
536  * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
537  */
538 enum nft_expr_attributes {
539 	NFTA_EXPR_UNSPEC,
540 	NFTA_EXPR_NAME,
541 	NFTA_EXPR_DATA,
542 	__NFTA_EXPR_MAX
543 };
544 #define NFTA_EXPR_MAX		(__NFTA_EXPR_MAX - 1)
545 
546 /**
547  * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
548  *
549  * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
550  * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
551  */
552 enum nft_immediate_attributes {
553 	NFTA_IMMEDIATE_UNSPEC,
554 	NFTA_IMMEDIATE_DREG,
555 	NFTA_IMMEDIATE_DATA,
556 	__NFTA_IMMEDIATE_MAX
557 };
558 #define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)
559 
560 /**
561  * enum nft_bitwise_ops - nf_tables bitwise operations
562  *
563  * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
564  *                    XOR boolean operations
565  * @NFT_BITWISE_LSHIFT: left-shift operation
566  * @NFT_BITWISE_RSHIFT: right-shift operation
567  */
568 enum nft_bitwise_ops {
569 	NFT_BITWISE_BOOL,
570 	NFT_BITWISE_LSHIFT,
571 	NFT_BITWISE_RSHIFT,
572 };
573 
574 /**
575  * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
576  *
577  * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
578  * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
579  * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
580  * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
581  * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
582  * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
583  * @NFTA_BITWISE_DATA: argument for non-boolean operations
584  *                     (NLA_NESTED: nft_data_attributes)
585  *
586  * The bitwise expression supports boolean and shift operations.  It implements
587  * the boolean operations by performing the following operation:
588  *
589  * dreg = (sreg & mask) ^ xor
590  *
591  * with these mask and xor values:
592  *
593  * 		mask	xor
594  * NOT:		1	1
595  * OR:		~x	x
596  * XOR:		1	x
597  * AND:		x	0
598  */
599 enum nft_bitwise_attributes {
600 	NFTA_BITWISE_UNSPEC,
601 	NFTA_BITWISE_SREG,
602 	NFTA_BITWISE_DREG,
603 	NFTA_BITWISE_LEN,
604 	NFTA_BITWISE_MASK,
605 	NFTA_BITWISE_XOR,
606 	NFTA_BITWISE_OP,
607 	NFTA_BITWISE_DATA,
608 	__NFTA_BITWISE_MAX
609 };
610 #define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
611 
612 /**
613  * enum nft_byteorder_ops - nf_tables byteorder operators
614  *
615  * @NFT_BYTEORDER_NTOH: network to host operator
616  * @NFT_BYTEORDER_HTON: host to network operator
617  */
618 enum nft_byteorder_ops {
619 	NFT_BYTEORDER_NTOH,
620 	NFT_BYTEORDER_HTON,
621 };
622 
623 /**
624  * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
625  *
626  * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
627  * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
628  * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
629  * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
630  * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
631  */
632 enum nft_byteorder_attributes {
633 	NFTA_BYTEORDER_UNSPEC,
634 	NFTA_BYTEORDER_SREG,
635 	NFTA_BYTEORDER_DREG,
636 	NFTA_BYTEORDER_OP,
637 	NFTA_BYTEORDER_LEN,
638 	NFTA_BYTEORDER_SIZE,
639 	__NFTA_BYTEORDER_MAX
640 };
641 #define NFTA_BYTEORDER_MAX	(__NFTA_BYTEORDER_MAX - 1)
642 
643 /**
644  * enum nft_cmp_ops - nf_tables relational operator
645  *
646  * @NFT_CMP_EQ: equal
647  * @NFT_CMP_NEQ: not equal
648  * @NFT_CMP_LT: less than
649  * @NFT_CMP_LTE: less than or equal to
650  * @NFT_CMP_GT: greater than
651  * @NFT_CMP_GTE: greater than or equal to
652  */
653 enum nft_cmp_ops {
654 	NFT_CMP_EQ,
655 	NFT_CMP_NEQ,
656 	NFT_CMP_LT,
657 	NFT_CMP_LTE,
658 	NFT_CMP_GT,
659 	NFT_CMP_GTE,
660 };
661 
662 /**
663  * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
664  *
665  * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
666  * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
667  * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
668  */
669 enum nft_cmp_attributes {
670 	NFTA_CMP_UNSPEC,
671 	NFTA_CMP_SREG,
672 	NFTA_CMP_OP,
673 	NFTA_CMP_DATA,
674 	__NFTA_CMP_MAX
675 };
676 #define NFTA_CMP_MAX		(__NFTA_CMP_MAX - 1)
677 
678 /**
679  * enum nft_range_ops - nf_tables range operator
680  *
681  * @NFT_RANGE_EQ: equal
682  * @NFT_RANGE_NEQ: not equal
683  */
684 enum nft_range_ops {
685 	NFT_RANGE_EQ,
686 	NFT_RANGE_NEQ,
687 };
688 
689 /**
690  * enum nft_range_attributes - nf_tables range expression netlink attributes
691  *
692  * @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
693  * @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_range_ops)
694  * @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
695  * @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
696  */
697 enum nft_range_attributes {
698 	NFTA_RANGE_UNSPEC,
699 	NFTA_RANGE_SREG,
700 	NFTA_RANGE_OP,
701 	NFTA_RANGE_FROM_DATA,
702 	NFTA_RANGE_TO_DATA,
703 	__NFTA_RANGE_MAX
704 };
705 #define NFTA_RANGE_MAX		(__NFTA_RANGE_MAX - 1)
706 
707 enum nft_lookup_flags {
708 	NFT_LOOKUP_F_INV = (1 << 0),
709 };
710 
711 /**
712  * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
713  *
714  * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
715  * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
716  * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
717  * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
718  * @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags)
719  */
720 enum nft_lookup_attributes {
721 	NFTA_LOOKUP_UNSPEC,
722 	NFTA_LOOKUP_SET,
723 	NFTA_LOOKUP_SREG,
724 	NFTA_LOOKUP_DREG,
725 	NFTA_LOOKUP_SET_ID,
726 	NFTA_LOOKUP_FLAGS,
727 	__NFTA_LOOKUP_MAX
728 };
729 #define NFTA_LOOKUP_MAX		(__NFTA_LOOKUP_MAX - 1)
730 
731 enum nft_dynset_ops {
732 	NFT_DYNSET_OP_ADD,
733 	NFT_DYNSET_OP_UPDATE,
734 	NFT_DYNSET_OP_DELETE,
735 };
736 
737 enum nft_dynset_flags {
738 	NFT_DYNSET_F_INV	= (1 << 0),
739 	NFT_DYNSET_F_EXPR	= (1 << 1),
740 };
741 
742 /**
743  * enum nft_dynset_attributes - dynset expression attributes
744  *
745  * @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)
746  * @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)
747  * @NFTA_DYNSET_OP: operation (NLA_U32)
748  * @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)
749  * @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)
750  * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
751  * @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
752  * @NFTA_DYNSET_FLAGS: flags (NLA_U32)
753  * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
754  */
755 enum nft_dynset_attributes {
756 	NFTA_DYNSET_UNSPEC,
757 	NFTA_DYNSET_SET_NAME,
758 	NFTA_DYNSET_SET_ID,
759 	NFTA_DYNSET_OP,
760 	NFTA_DYNSET_SREG_KEY,
761 	NFTA_DYNSET_SREG_DATA,
762 	NFTA_DYNSET_TIMEOUT,
763 	NFTA_DYNSET_EXPR,
764 	NFTA_DYNSET_PAD,
765 	NFTA_DYNSET_FLAGS,
766 	NFTA_DYNSET_EXPRESSIONS,
767 	__NFTA_DYNSET_MAX,
768 };
769 #define NFTA_DYNSET_MAX		(__NFTA_DYNSET_MAX - 1)
770 
771 /**
772  * enum nft_payload_bases - nf_tables payload expression offset bases
773  *
774  * @NFT_PAYLOAD_LL_HEADER: link layer header
775  * @NFT_PAYLOAD_NETWORK_HEADER: network header
776  * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
777  * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
778  */
779 enum nft_payload_bases {
780 	NFT_PAYLOAD_LL_HEADER,
781 	NFT_PAYLOAD_NETWORK_HEADER,
782 	NFT_PAYLOAD_TRANSPORT_HEADER,
783 	NFT_PAYLOAD_INNER_HEADER,
784 	NFT_PAYLOAD_TUN_HEADER,
785 };
786 
787 /**
788  * enum nft_payload_csum_types - nf_tables payload expression checksum types
789  *
790  * @NFT_PAYLOAD_CSUM_NONE: no checksumming
791  * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
792  * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
793  */
794 enum nft_payload_csum_types {
795 	NFT_PAYLOAD_CSUM_NONE,
796 	NFT_PAYLOAD_CSUM_INET,
797 	NFT_PAYLOAD_CSUM_SCTP,
798 };
799 
800 enum nft_payload_csum_flags {
801 	NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
802 };
803 
804 enum nft_inner_type {
805 	NFT_INNER_UNSPEC	= 0,
806 	NFT_INNER_VXLAN,
807 	NFT_INNER_GENEVE,
808 };
809 
810 enum nft_inner_flags {
811 	NFT_INNER_HDRSIZE	= (1 << 0),
812 	NFT_INNER_LL		= (1 << 1),
813 	NFT_INNER_NH		= (1 << 2),
814 	NFT_INNER_TH		= (1 << 3),
815 };
816 #define NFT_INNER_MASK		(NFT_INNER_HDRSIZE | NFT_INNER_LL | \
817 				 NFT_INNER_NH | NFT_INNER_TH)
818 
819 enum nft_inner_attributes {
820 	NFTA_INNER_UNSPEC,
821 	NFTA_INNER_NUM,
822 	NFTA_INNER_TYPE,
823 	NFTA_INNER_FLAGS,
824 	NFTA_INNER_HDRSIZE,
825 	NFTA_INNER_EXPR,
826 	__NFTA_INNER_MAX
827 };
828 #define NFTA_INNER_MAX	(__NFTA_INNER_MAX - 1)
829 
830 /**
831  * enum nft_payload_attributes - nf_tables payload expression netlink attributes
832  *
833  * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
834  * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
835  * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
836  * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
837  * @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
838  * @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
839  * @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
840  * @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
841  */
842 enum nft_payload_attributes {
843 	NFTA_PAYLOAD_UNSPEC,
844 	NFTA_PAYLOAD_DREG,
845 	NFTA_PAYLOAD_BASE,
846 	NFTA_PAYLOAD_OFFSET,
847 	NFTA_PAYLOAD_LEN,
848 	NFTA_PAYLOAD_SREG,
849 	NFTA_PAYLOAD_CSUM_TYPE,
850 	NFTA_PAYLOAD_CSUM_OFFSET,
851 	NFTA_PAYLOAD_CSUM_FLAGS,
852 	__NFTA_PAYLOAD_MAX
853 };
854 #define NFTA_PAYLOAD_MAX	(__NFTA_PAYLOAD_MAX - 1)
855 
856 enum nft_exthdr_flags {
857 	NFT_EXTHDR_F_PRESENT = (1 << 0),
858 };
859 
860 /**
861  * enum nft_exthdr_op - nf_tables match options
862  *
863  * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
864  * @NFT_EXTHDR_OP_TCP: match against tcp options
865  * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
866  * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
867  * @NFT_EXTHDR_OP_DCCP: match against dccp otions
868  */
869 enum nft_exthdr_op {
870 	NFT_EXTHDR_OP_IPV6,
871 	NFT_EXTHDR_OP_TCPOPT,
872 	NFT_EXTHDR_OP_IPV4,
873 	NFT_EXTHDR_OP_SCTP,
874 	NFT_EXTHDR_OP_DCCP,
875 	__NFT_EXTHDR_OP_MAX
876 };
877 #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
878 
879 /**
880  * enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes
881  *
882  * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
883  * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
884  * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
885  * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
886  * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
887  * @NFTA_EXTHDR_OP: option match type (NLA_U32)
888  * @NFTA_EXTHDR_SREG: source register (NLA_U32: nft_registers)
889  */
890 enum nft_exthdr_attributes {
891 	NFTA_EXTHDR_UNSPEC,
892 	NFTA_EXTHDR_DREG,
893 	NFTA_EXTHDR_TYPE,
894 	NFTA_EXTHDR_OFFSET,
895 	NFTA_EXTHDR_LEN,
896 	NFTA_EXTHDR_FLAGS,
897 	NFTA_EXTHDR_OP,
898 	NFTA_EXTHDR_SREG,
899 	__NFTA_EXTHDR_MAX
900 };
901 #define NFTA_EXTHDR_MAX		(__NFTA_EXTHDR_MAX - 1)
902 
903 /**
904  * enum nft_meta_keys - nf_tables meta expression keys
905  *
906  * @NFT_META_LEN: packet length (skb->len)
907  * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
908  * @NFT_META_PRIORITY: packet priority (skb->priority)
909  * @NFT_META_MARK: packet mark (skb->mark)
910  * @NFT_META_IIF: packet input interface index (dev->ifindex)
911  * @NFT_META_OIF: packet output interface index (dev->ifindex)
912  * @NFT_META_IIFNAME: packet input interface name (dev->name)
913  * @NFT_META_OIFNAME: packet output interface name (dev->name)
914  * @NFT_META_IIFTYPE: packet input interface type (dev->type)
915  * @NFT_META_OIFTYPE: packet output interface type (dev->type)
916  * @NFT_META_SKUID: originating socket UID (fsuid)
917  * @NFT_META_SKGID: originating socket GID (fsgid)
918  * @NFT_META_NFTRACE: packet nftrace bit
919  * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
920  * @NFT_META_SECMARK: packet secmark (skb->secmark)
921  * @NFT_META_NFPROTO: netfilter protocol
922  * @NFT_META_L4PROTO: layer 4 protocol number
923  * @NFT_META_BRI_IIFNAME: packet input bridge interface name
924  * @NFT_META_BRI_OIFNAME: packet output bridge interface name
925  * @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
926  * @NFT_META_CPU: cpu id through smp_processor_id()
927  * @NFT_META_IIFGROUP: packet input interface group
928  * @NFT_META_OIFGROUP: packet output interface group
929  * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
930  * @NFT_META_PRANDOM: a 32bit pseudo-random number
931  * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
932  * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
933  * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
934  * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
935  * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
936  * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
937  * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
938  * @NFT_META_TIME_HOUR: hour of day (in seconds)
939  * @NFT_META_SDIF: slave device interface index
940  * @NFT_META_SDIFNAME: slave device interface name
941  * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
942  */
943 enum nft_meta_keys {
944 	NFT_META_LEN,
945 	NFT_META_PROTOCOL,
946 	NFT_META_PRIORITY,
947 	NFT_META_MARK,
948 	NFT_META_IIF,
949 	NFT_META_OIF,
950 	NFT_META_IIFNAME,
951 	NFT_META_OIFNAME,
952 	NFT_META_IFTYPE,
953 #define NFT_META_IIFTYPE	NFT_META_IFTYPE
954 	NFT_META_OIFTYPE,
955 	NFT_META_SKUID,
956 	NFT_META_SKGID,
957 	NFT_META_NFTRACE,
958 	NFT_META_RTCLASSID,
959 	NFT_META_SECMARK,
960 	NFT_META_NFPROTO,
961 	NFT_META_L4PROTO,
962 	NFT_META_BRI_IIFNAME,
963 	NFT_META_BRI_OIFNAME,
964 	NFT_META_PKTTYPE,
965 	NFT_META_CPU,
966 	NFT_META_IIFGROUP,
967 	NFT_META_OIFGROUP,
968 	NFT_META_CGROUP,
969 	NFT_META_PRANDOM,
970 	NFT_META_SECPATH,
971 	NFT_META_IIFKIND,
972 	NFT_META_OIFKIND,
973 	NFT_META_BRI_IIFPVID,
974 	NFT_META_BRI_IIFVPROTO,
975 	NFT_META_TIME_NS,
976 	NFT_META_TIME_DAY,
977 	NFT_META_TIME_HOUR,
978 	NFT_META_SDIF,
979 	NFT_META_SDIFNAME,
980 	NFT_META_BRI_BROUTE,
981 	__NFT_META_IIFTYPE,
982 };
983 
984 /**
985  * enum nft_rt_keys - nf_tables routing expression keys
986  *
987  * @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
988  * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
989  * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
990  * @NFT_RT_TCPMSS: fetch current path tcp mss
991  * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
992  */
993 enum nft_rt_keys {
994 	NFT_RT_CLASSID,
995 	NFT_RT_NEXTHOP4,
996 	NFT_RT_NEXTHOP6,
997 	NFT_RT_TCPMSS,
998 	NFT_RT_XFRM,
999 	__NFT_RT_MAX
1000 };
1001 #define NFT_RT_MAX		(__NFT_RT_MAX - 1)
1002 
1003 /**
1004  * enum nft_hash_types - nf_tables hash expression types
1005  *
1006  * @NFT_HASH_JENKINS: Jenkins Hash
1007  * @NFT_HASH_SYM: Symmetric Hash
1008  */
1009 enum nft_hash_types {
1010 	NFT_HASH_JENKINS,
1011 	NFT_HASH_SYM,
1012 };
1013 
1014 /**
1015  * enum nft_hash_attributes - nf_tables hash expression netlink attributes
1016  *
1017  * @NFTA_HASH_SREG: source register (NLA_U32)
1018  * @NFTA_HASH_DREG: destination register (NLA_U32)
1019  * @NFTA_HASH_LEN: source data length (NLA_U32)
1020  * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
1021  * @NFTA_HASH_SEED: seed value (NLA_U32)
1022  * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
1023  * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
1024  * @NFTA_HASH_SET_NAME: name of the map to lookup (NLA_STRING)
1025  * @NFTA_HASH_SET_ID: id of the map (NLA_U32)
1026  */
1027 enum nft_hash_attributes {
1028 	NFTA_HASH_UNSPEC,
1029 	NFTA_HASH_SREG,
1030 	NFTA_HASH_DREG,
1031 	NFTA_HASH_LEN,
1032 	NFTA_HASH_MODULUS,
1033 	NFTA_HASH_SEED,
1034 	NFTA_HASH_OFFSET,
1035 	NFTA_HASH_TYPE,
1036 	NFTA_HASH_SET_NAME,	/* deprecated */
1037 	NFTA_HASH_SET_ID,	/* deprecated */
1038 	__NFTA_HASH_MAX,
1039 };
1040 #define NFTA_HASH_MAX	(__NFTA_HASH_MAX - 1)
1041 
1042 /**
1043  * enum nft_meta_attributes - nf_tables meta expression netlink attributes
1044  *
1045  * @NFTA_META_DREG: destination register (NLA_U32)
1046  * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
1047  * @NFTA_META_SREG: source register (NLA_U32)
1048  */
1049 enum nft_meta_attributes {
1050 	NFTA_META_UNSPEC,
1051 	NFTA_META_DREG,
1052 	NFTA_META_KEY,
1053 	NFTA_META_SREG,
1054 	__NFTA_META_MAX
1055 };
1056 #define NFTA_META_MAX		(__NFTA_META_MAX - 1)
1057 
1058 /**
1059  * enum nft_rt_attributes - nf_tables routing expression netlink attributes
1060  *
1061  * @NFTA_RT_DREG: destination register (NLA_U32)
1062  * @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
1063  */
1064 enum nft_rt_attributes {
1065 	NFTA_RT_UNSPEC,
1066 	NFTA_RT_DREG,
1067 	NFTA_RT_KEY,
1068 	__NFTA_RT_MAX
1069 };
1070 #define NFTA_RT_MAX		(__NFTA_RT_MAX - 1)
1071 
1072 /**
1073  * enum nft_socket_attributes - nf_tables socket expression netlink attributes
1074  *
1075  * @NFTA_SOCKET_KEY: socket key to match
1076  * @NFTA_SOCKET_DREG: destination register
1077  * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
1078  */
1079 enum nft_socket_attributes {
1080 	NFTA_SOCKET_UNSPEC,
1081 	NFTA_SOCKET_KEY,
1082 	NFTA_SOCKET_DREG,
1083 	NFTA_SOCKET_LEVEL,
1084 	__NFTA_SOCKET_MAX
1085 };
1086 #define NFTA_SOCKET_MAX		(__NFTA_SOCKET_MAX - 1)
1087 
1088 /*
1089  * enum nft_socket_keys - nf_tables socket expression keys
1090  *
1091  * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
1092  * @NFT_SOCKET_MARK: Value of the socket mark
1093  * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
1094  * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
1095  */
1096 enum nft_socket_keys {
1097 	NFT_SOCKET_TRANSPARENT,
1098 	NFT_SOCKET_MARK,
1099 	NFT_SOCKET_WILDCARD,
1100 	NFT_SOCKET_CGROUPV2,
1101 	__NFT_SOCKET_MAX
1102 };
1103 #define NFT_SOCKET_MAX	(__NFT_SOCKET_MAX - 1)
1104 
1105 /**
1106  * enum nft_ct_keys - nf_tables ct expression keys
1107  *
1108  * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
1109  * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
1110  * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
1111  * @NFT_CT_MARK: conntrack mark value
1112  * @NFT_CT_SECMARK: conntrack secmark value
1113  * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
1114  * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
1115  * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
1116  * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address, deprecated)
1117  * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address, deprecated)
1118  * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
1119  * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
1120  * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
1121  * @NFT_CT_LABELS: conntrack labels
1122  * @NFT_CT_PKTS: conntrack packets
1123  * @NFT_CT_BYTES: conntrack bytes
1124  * @NFT_CT_AVGPKT: conntrack average bytes per packet
1125  * @NFT_CT_ZONE: conntrack zone
1126  * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
1127  * @NFT_CT_SRC_IP: conntrack layer 3 protocol source (IPv4 address)
1128  * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address)
1129  * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)
1130  * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)
1131  * @NFT_CT_ID: conntrack id
1132  */
1133 enum nft_ct_keys {
1134 	NFT_CT_STATE,
1135 	NFT_CT_DIRECTION,
1136 	NFT_CT_STATUS,
1137 	NFT_CT_MARK,
1138 	NFT_CT_SECMARK,
1139 	NFT_CT_EXPIRATION,
1140 	NFT_CT_HELPER,
1141 	NFT_CT_L3PROTOCOL,
1142 	NFT_CT_SRC,
1143 	NFT_CT_DST,
1144 	NFT_CT_PROTOCOL,
1145 	NFT_CT_PROTO_SRC,
1146 	NFT_CT_PROTO_DST,
1147 	NFT_CT_LABELS,
1148 	NFT_CT_PKTS,
1149 	NFT_CT_BYTES,
1150 	NFT_CT_AVGPKT,
1151 	NFT_CT_ZONE,
1152 	NFT_CT_EVENTMASK,
1153 	NFT_CT_SRC_IP,
1154 	NFT_CT_DST_IP,
1155 	NFT_CT_SRC_IP6,
1156 	NFT_CT_DST_IP6,
1157 	NFT_CT_ID,
1158 	__NFT_CT_MAX
1159 };
1160 #define NFT_CT_MAX		(__NFT_CT_MAX - 1)
1161 
1162 /**
1163  * enum nft_ct_attributes - nf_tables ct expression netlink attributes
1164  *
1165  * @NFTA_CT_DREG: destination register (NLA_U32)
1166  * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
1167  * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
1168  * @NFTA_CT_SREG: source register (NLA_U32)
1169  */
1170 enum nft_ct_attributes {
1171 	NFTA_CT_UNSPEC,
1172 	NFTA_CT_DREG,
1173 	NFTA_CT_KEY,
1174 	NFTA_CT_DIRECTION,
1175 	NFTA_CT_SREG,
1176 	__NFTA_CT_MAX
1177 };
1178 #define NFTA_CT_MAX		(__NFTA_CT_MAX - 1)
1179 
1180 /**
1181  * enum nft_flow_attributes - ct offload expression attributes
1182  * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
1183  */
1184 enum nft_offload_attributes {
1185 	NFTA_FLOW_UNSPEC,
1186 	NFTA_FLOW_TABLE_NAME,
1187 	__NFTA_FLOW_MAX,
1188 };
1189 #define NFTA_FLOW_MAX		(__NFTA_FLOW_MAX - 1)
1190 
1191 enum nft_limit_type {
1192 	NFT_LIMIT_PKTS,
1193 	NFT_LIMIT_PKT_BYTES
1194 };
1195 
1196 enum nft_limit_flags {
1197 	NFT_LIMIT_F_INV	= (1 << 0),
1198 };
1199 
1200 /**
1201  * enum nft_limit_attributes - nf_tables limit expression netlink attributes
1202  *
1203  * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
1204  * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
1205  * @NFTA_LIMIT_BURST: burst (NLA_U32)
1206  * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
1207  * @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
1208  */
1209 enum nft_limit_attributes {
1210 	NFTA_LIMIT_UNSPEC,
1211 	NFTA_LIMIT_RATE,
1212 	NFTA_LIMIT_UNIT,
1213 	NFTA_LIMIT_BURST,
1214 	NFTA_LIMIT_TYPE,
1215 	NFTA_LIMIT_FLAGS,
1216 	NFTA_LIMIT_PAD,
1217 	__NFTA_LIMIT_MAX
1218 };
1219 #define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)
1220 
1221 enum nft_connlimit_flags {
1222 	NFT_CONNLIMIT_F_INV	= (1 << 0),
1223 };
1224 
1225 /**
1226  * enum nft_connlimit_attributes - nf_tables connlimit expression netlink attributes
1227  *
1228  * @NFTA_CONNLIMIT_COUNT: number of connections (NLA_U32)
1229  * @NFTA_CONNLIMIT_FLAGS: flags (NLA_U32: enum nft_connlimit_flags)
1230  */
1231 enum nft_connlimit_attributes {
1232 	NFTA_CONNLIMIT_UNSPEC,
1233 	NFTA_CONNLIMIT_COUNT,
1234 	NFTA_CONNLIMIT_FLAGS,
1235 	__NFTA_CONNLIMIT_MAX
1236 };
1237 #define NFTA_CONNLIMIT_MAX	(__NFTA_CONNLIMIT_MAX - 1)
1238 
1239 /**
1240  * enum nft_counter_attributes - nf_tables counter expression netlink attributes
1241  *
1242  * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
1243  * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
1244  */
1245 enum nft_counter_attributes {
1246 	NFTA_COUNTER_UNSPEC,
1247 	NFTA_COUNTER_BYTES,
1248 	NFTA_COUNTER_PACKETS,
1249 	NFTA_COUNTER_PAD,
1250 	__NFTA_COUNTER_MAX
1251 };
1252 #define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)
1253 
1254 /**
1255  * enum nft_last_attributes - nf_tables last expression netlink attributes
1256  *
1257  * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
1258  * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
1259  */
1260 enum nft_last_attributes {
1261 	NFTA_LAST_UNSPEC,
1262 	NFTA_LAST_SET,
1263 	NFTA_LAST_MSECS,
1264 	NFTA_LAST_PAD,
1265 	__NFTA_LAST_MAX
1266 };
1267 #define NFTA_LAST_MAX	(__NFTA_LAST_MAX - 1)
1268 
1269 /**
1270  * enum nft_log_attributes - nf_tables log expression netlink attributes
1271  *
1272  * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U16)
1273  * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
1274  * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
1275  * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U16)
1276  * @NFTA_LOG_LEVEL: log level (NLA_U32)
1277  * @NFTA_LOG_FLAGS: logging flags (NLA_U32)
1278  */
1279 enum nft_log_attributes {
1280 	NFTA_LOG_UNSPEC,
1281 	NFTA_LOG_GROUP,
1282 	NFTA_LOG_PREFIX,
1283 	NFTA_LOG_SNAPLEN,
1284 	NFTA_LOG_QTHRESHOLD,
1285 	NFTA_LOG_LEVEL,
1286 	NFTA_LOG_FLAGS,
1287 	__NFTA_LOG_MAX
1288 };
1289 #define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)
1290 
1291 /**
1292  * enum nft_log_level - nf_tables log levels
1293  *
1294  * @NFT_LOGLEVEL_EMERG: system is unusable
1295  * @NFT_LOGLEVEL_ALERT: action must be taken immediately
1296  * @NFT_LOGLEVEL_CRIT: critical conditions
1297  * @NFT_LOGLEVEL_ERR: error conditions
1298  * @NFT_LOGLEVEL_WARNING: warning conditions
1299  * @NFT_LOGLEVEL_NOTICE: normal but significant condition
1300  * @NFT_LOGLEVEL_INFO: informational
1301  * @NFT_LOGLEVEL_DEBUG: debug-level messages
1302  * @NFT_LOGLEVEL_AUDIT: enabling audit logging
1303  */
1304 enum nft_log_level {
1305 	NFT_LOGLEVEL_EMERG,
1306 	NFT_LOGLEVEL_ALERT,
1307 	NFT_LOGLEVEL_CRIT,
1308 	NFT_LOGLEVEL_ERR,
1309 	NFT_LOGLEVEL_WARNING,
1310 	NFT_LOGLEVEL_NOTICE,
1311 	NFT_LOGLEVEL_INFO,
1312 	NFT_LOGLEVEL_DEBUG,
1313 	NFT_LOGLEVEL_AUDIT,
1314 	__NFT_LOGLEVEL_MAX
1315 };
1316 #define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
1317 
1318 /**
1319  * enum nft_queue_attributes - nf_tables queue expression netlink attributes
1320  *
1321  * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
1322  * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
1323  * @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
1324  * @NFTA_QUEUE_SREG_QNUM: source register of queue number (NLA_U32: nft_registers)
1325  */
1326 enum nft_queue_attributes {
1327 	NFTA_QUEUE_UNSPEC,
1328 	NFTA_QUEUE_NUM,
1329 	NFTA_QUEUE_TOTAL,
1330 	NFTA_QUEUE_FLAGS,
1331 	NFTA_QUEUE_SREG_QNUM,
1332 	__NFTA_QUEUE_MAX
1333 };
1334 #define NFTA_QUEUE_MAX		(__NFTA_QUEUE_MAX - 1)
1335 
1336 #define NFT_QUEUE_FLAG_BYPASS		0x01 /* for compatibility with v2 */
1337 #define NFT_QUEUE_FLAG_CPU_FANOUT	0x02 /* use current CPU (no hashing) */
1338 #define NFT_QUEUE_FLAG_MASK		0x03
1339 
1340 enum nft_quota_flags {
1341 	NFT_QUOTA_F_INV		= (1 << 0),
1342 	NFT_QUOTA_F_DEPLETED	= (1 << 1),
1343 };
1344 
1345 /**
1346  * enum nft_quota_attributes - nf_tables quota expression netlink attributes
1347  *
1348  * @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
1349  * @NFTA_QUOTA_FLAGS: flags (NLA_U32)
1350  * @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
1351  */
1352 enum nft_quota_attributes {
1353 	NFTA_QUOTA_UNSPEC,
1354 	NFTA_QUOTA_BYTES,
1355 	NFTA_QUOTA_FLAGS,
1356 	NFTA_QUOTA_PAD,
1357 	NFTA_QUOTA_CONSUMED,
1358 	__NFTA_QUOTA_MAX
1359 };
1360 #define NFTA_QUOTA_MAX		(__NFTA_QUOTA_MAX - 1)
1361 
1362 /**
1363  * enum nft_secmark_attributes - nf_tables secmark object netlink attributes
1364  *
1365  * @NFTA_SECMARK_CTX: security context (NLA_STRING)
1366  */
1367 enum nft_secmark_attributes {
1368 	NFTA_SECMARK_UNSPEC,
1369 	NFTA_SECMARK_CTX,
1370 	__NFTA_SECMARK_MAX,
1371 };
1372 #define NFTA_SECMARK_MAX	(__NFTA_SECMARK_MAX - 1)
1373 
1374 /* Max security context length */
1375 #define NFT_SECMARK_CTX_MAXLEN		256
1376 
1377 /**
1378  * enum nft_reject_types - nf_tables reject expression reject types
1379  *
1380  * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
1381  * @NFT_REJECT_TCP_RST: reject using TCP RST
1382  * @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet
1383  */
1384 enum nft_reject_types {
1385 	NFT_REJECT_ICMP_UNREACH,
1386 	NFT_REJECT_TCP_RST,
1387 	NFT_REJECT_ICMPX_UNREACH,
1388 };
1389 
1390 /**
1391  * enum nft_reject_code - Generic reject codes for IPv4/IPv6
1392  *
1393  * @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable
1394  * @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
1395  * @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
1396  * @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited
1397  *
1398  * These codes are mapped to real ICMP and ICMPv6 codes.
1399  */
1400 enum nft_reject_inet_code {
1401 	NFT_REJECT_ICMPX_NO_ROUTE	= 0,
1402 	NFT_REJECT_ICMPX_PORT_UNREACH,
1403 	NFT_REJECT_ICMPX_HOST_UNREACH,
1404 	NFT_REJECT_ICMPX_ADMIN_PROHIBITED,
1405 	__NFT_REJECT_ICMPX_MAX
1406 };
1407 #define NFT_REJECT_ICMPX_MAX	(__NFT_REJECT_ICMPX_MAX - 1)
1408 
1409 /**
1410  * enum nft_reject_attributes - nf_tables reject expression netlink attributes
1411  *
1412  * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
1413  * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
1414  */
1415 enum nft_reject_attributes {
1416 	NFTA_REJECT_UNSPEC,
1417 	NFTA_REJECT_TYPE,
1418 	NFTA_REJECT_ICMP_CODE,
1419 	__NFTA_REJECT_MAX
1420 };
1421 #define NFTA_REJECT_MAX		(__NFTA_REJECT_MAX - 1)
1422 
1423 /**
1424  * enum nft_nat_types - nf_tables nat expression NAT types
1425  *
1426  * @NFT_NAT_SNAT: source NAT
1427  * @NFT_NAT_DNAT: destination NAT
1428  */
1429 enum nft_nat_types {
1430 	NFT_NAT_SNAT,
1431 	NFT_NAT_DNAT,
1432 };
1433 
1434 /**
1435  * enum nft_nat_attributes - nf_tables nat expression netlink attributes
1436  *
1437  * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
1438  * @NFTA_NAT_FAMILY: NAT family (NLA_U32)
1439  * @NFTA_NAT_REG_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
1440  * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
1441  * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
1442  * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
1443  * @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
1444  */
1445 enum nft_nat_attributes {
1446 	NFTA_NAT_UNSPEC,
1447 	NFTA_NAT_TYPE,
1448 	NFTA_NAT_FAMILY,
1449 	NFTA_NAT_REG_ADDR_MIN,
1450 	NFTA_NAT_REG_ADDR_MAX,
1451 	NFTA_NAT_REG_PROTO_MIN,
1452 	NFTA_NAT_REG_PROTO_MAX,
1453 	NFTA_NAT_FLAGS,
1454 	__NFTA_NAT_MAX
1455 };
1456 #define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)
1457 
1458 /**
1459  * enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
1460  *
1461  * NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
1462  * NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
1463  * NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
1464  */
1465 enum nft_tproxy_attributes {
1466 	NFTA_TPROXY_UNSPEC,
1467 	NFTA_TPROXY_FAMILY,
1468 	NFTA_TPROXY_REG_ADDR,
1469 	NFTA_TPROXY_REG_PORT,
1470 	__NFTA_TPROXY_MAX
1471 };
1472 #define NFTA_TPROXY_MAX		(__NFTA_TPROXY_MAX - 1)
1473 
1474 /**
1475  * enum nft_masq_attributes - nf_tables masquerade expression attributes
1476  *
1477  * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
1478  * @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
1479  * @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
1480  */
1481 enum nft_masq_attributes {
1482 	NFTA_MASQ_UNSPEC,
1483 	NFTA_MASQ_FLAGS,
1484 	NFTA_MASQ_REG_PROTO_MIN,
1485 	NFTA_MASQ_REG_PROTO_MAX,
1486 	__NFTA_MASQ_MAX
1487 };
1488 #define NFTA_MASQ_MAX		(__NFTA_MASQ_MAX - 1)
1489 
1490 /**
1491  * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
1492  *
1493  * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
1494  * @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
1495  * @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
1496  */
1497 enum nft_redir_attributes {
1498 	NFTA_REDIR_UNSPEC,
1499 	NFTA_REDIR_REG_PROTO_MIN,
1500 	NFTA_REDIR_REG_PROTO_MAX,
1501 	NFTA_REDIR_FLAGS,
1502 	__NFTA_REDIR_MAX
1503 };
1504 #define NFTA_REDIR_MAX		(__NFTA_REDIR_MAX - 1)
1505 
1506 /**
1507  * enum nft_dup_attributes - nf_tables dup expression netlink attributes
1508  *
1509  * @NFTA_DUP_SREG_ADDR: source register of address (NLA_U32: nft_registers)
1510  * @NFTA_DUP_SREG_DEV: source register of output interface (NLA_U32: nft_register)
1511  */
1512 enum nft_dup_attributes {
1513 	NFTA_DUP_UNSPEC,
1514 	NFTA_DUP_SREG_ADDR,
1515 	NFTA_DUP_SREG_DEV,
1516 	__NFTA_DUP_MAX
1517 };
1518 #define NFTA_DUP_MAX		(__NFTA_DUP_MAX - 1)
1519 
1520 /**
1521  * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
1522  *
1523  * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
1524  * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register)
1525  * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto)
1526  */
1527 enum nft_fwd_attributes {
1528 	NFTA_FWD_UNSPEC,
1529 	NFTA_FWD_SREG_DEV,
1530 	NFTA_FWD_SREG_ADDR,
1531 	NFTA_FWD_NFPROTO,
1532 	__NFTA_FWD_MAX
1533 };
1534 #define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)
1535 
1536 /**
1537  * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
1538  *
1539  * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
1540  * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
1541  * @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
1542  * @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
1543  * @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
1544  */
1545 enum nft_objref_attributes {
1546 	NFTA_OBJREF_UNSPEC,
1547 	NFTA_OBJREF_IMM_TYPE,
1548 	NFTA_OBJREF_IMM_NAME,
1549 	NFTA_OBJREF_SET_SREG,
1550 	NFTA_OBJREF_SET_NAME,
1551 	NFTA_OBJREF_SET_ID,
1552 	__NFTA_OBJREF_MAX
1553 };
1554 #define NFTA_OBJREF_MAX	(__NFTA_OBJREF_MAX - 1)
1555 
1556 /**
1557  * enum nft_gen_attributes - nf_tables ruleset generation attributes
1558  *
1559  * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
1560  */
1561 enum nft_gen_attributes {
1562 	NFTA_GEN_UNSPEC,
1563 	NFTA_GEN_ID,
1564 	NFTA_GEN_PROC_PID,
1565 	NFTA_GEN_PROC_NAME,
1566 	__NFTA_GEN_MAX
1567 };
1568 #define NFTA_GEN_MAX		(__NFTA_GEN_MAX - 1)
1569 
1570 /*
1571  * enum nft_fib_attributes - nf_tables fib expression netlink attributes
1572  *
1573  * @NFTA_FIB_DREG: destination register (NLA_U32)
1574  * @NFTA_FIB_RESULT: desired result (NLA_U32)
1575  * @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)
1576  *
1577  * The FIB expression performs a route lookup according
1578  * to the packet data.
1579  */
1580 enum nft_fib_attributes {
1581 	NFTA_FIB_UNSPEC,
1582 	NFTA_FIB_DREG,
1583 	NFTA_FIB_RESULT,
1584 	NFTA_FIB_FLAGS,
1585 	__NFTA_FIB_MAX
1586 };
1587 #define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)
1588 
1589 enum nft_fib_result {
1590 	NFT_FIB_RESULT_UNSPEC,
1591 	NFT_FIB_RESULT_OIF,
1592 	NFT_FIB_RESULT_OIFNAME,
1593 	NFT_FIB_RESULT_ADDRTYPE,
1594 	__NFT_FIB_RESULT_MAX
1595 };
1596 #define NFT_FIB_RESULT_MAX	(__NFT_FIB_RESULT_MAX - 1)
1597 
1598 enum nft_fib_flags {
1599 	NFTA_FIB_F_SADDR	= 1 << 0,	/* look up src */
1600 	NFTA_FIB_F_DADDR	= 1 << 1,	/* look up dst */
1601 	NFTA_FIB_F_MARK		= 1 << 2,	/* use skb->mark */
1602 	NFTA_FIB_F_IIF		= 1 << 3,	/* restrict to iif */
1603 	NFTA_FIB_F_OIF		= 1 << 4,	/* restrict to oif */
1604 	NFTA_FIB_F_PRESENT	= 1 << 5,	/* check existence only */
1605 };
1606 
1607 enum nft_ct_helper_attributes {
1608 	NFTA_CT_HELPER_UNSPEC,
1609 	NFTA_CT_HELPER_NAME,
1610 	NFTA_CT_HELPER_L3PROTO,
1611 	NFTA_CT_HELPER_L4PROTO,
1612 	__NFTA_CT_HELPER_MAX,
1613 };
1614 #define NFTA_CT_HELPER_MAX	(__NFTA_CT_HELPER_MAX - 1)
1615 
1616 enum nft_ct_timeout_timeout_attributes {
1617 	NFTA_CT_TIMEOUT_UNSPEC,
1618 	NFTA_CT_TIMEOUT_L3PROTO,
1619 	NFTA_CT_TIMEOUT_L4PROTO,
1620 	NFTA_CT_TIMEOUT_DATA,
1621 	__NFTA_CT_TIMEOUT_MAX,
1622 };
1623 #define NFTA_CT_TIMEOUT_MAX	(__NFTA_CT_TIMEOUT_MAX - 1)
1624 
1625 enum nft_ct_expectation_attributes {
1626 	NFTA_CT_EXPECT_UNSPEC,
1627 	NFTA_CT_EXPECT_L3PROTO,
1628 	NFTA_CT_EXPECT_L4PROTO,
1629 	NFTA_CT_EXPECT_DPORT,
1630 	NFTA_CT_EXPECT_TIMEOUT,
1631 	NFTA_CT_EXPECT_SIZE,
1632 	__NFTA_CT_EXPECT_MAX,
1633 };
1634 #define NFTA_CT_EXPECT_MAX	(__NFTA_CT_EXPECT_MAX - 1)
1635 
1636 #define NFT_OBJECT_UNSPEC	0
1637 #define NFT_OBJECT_COUNTER	1
1638 #define NFT_OBJECT_QUOTA	2
1639 #define NFT_OBJECT_CT_HELPER	3
1640 #define NFT_OBJECT_LIMIT	4
1641 #define NFT_OBJECT_CONNLIMIT	5
1642 #define NFT_OBJECT_TUNNEL	6
1643 #define NFT_OBJECT_CT_TIMEOUT	7
1644 #define NFT_OBJECT_SECMARK	8
1645 #define NFT_OBJECT_CT_EXPECT	9
1646 #define NFT_OBJECT_SYNPROXY	10
1647 #define __NFT_OBJECT_MAX	11
1648 #define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
1649 
1650 /**
1651  * enum nft_object_attributes - nf_tables stateful object netlink attributes
1652  *
1653  * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
1654  * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
1655  * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
1656  * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
1657  * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
1658  * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
1659  * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
1660  */
1661 enum nft_object_attributes {
1662 	NFTA_OBJ_UNSPEC,
1663 	NFTA_OBJ_TABLE,
1664 	NFTA_OBJ_NAME,
1665 	NFTA_OBJ_TYPE,
1666 	NFTA_OBJ_DATA,
1667 	NFTA_OBJ_USE,
1668 	NFTA_OBJ_HANDLE,
1669 	NFTA_OBJ_PAD,
1670 	NFTA_OBJ_USERDATA,
1671 	__NFTA_OBJ_MAX
1672 };
1673 #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
1674 
1675 /**
1676  * enum nft_flowtable_flags - nf_tables flowtable flags
1677  *
1678  * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
1679  * @NFT_FLOWTABLE_COUNTER: enable flow counters
1680  */
1681 enum nft_flowtable_flags {
1682 	NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
1683 	NFT_FLOWTABLE_COUNTER		= 0x2,
1684 	NFT_FLOWTABLE_MASK		= (NFT_FLOWTABLE_HW_OFFLOAD |
1685 					   NFT_FLOWTABLE_COUNTER)
1686 };
1687 
1688 /**
1689  * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
1690  *
1691  * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
1692  * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
1693  * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration(NLA_U32)
1694  * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
1695  * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
1696  * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
1697  */
1698 enum nft_flowtable_attributes {
1699 	NFTA_FLOWTABLE_UNSPEC,
1700 	NFTA_FLOWTABLE_TABLE,
1701 	NFTA_FLOWTABLE_NAME,
1702 	NFTA_FLOWTABLE_HOOK,
1703 	NFTA_FLOWTABLE_USE,
1704 	NFTA_FLOWTABLE_HANDLE,
1705 	NFTA_FLOWTABLE_PAD,
1706 	NFTA_FLOWTABLE_FLAGS,
1707 	__NFTA_FLOWTABLE_MAX
1708 };
1709 #define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
1710 
1711 /**
1712  * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
1713  *
1714  * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
1715  * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
1716  * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
1717  */
1718 enum nft_flowtable_hook_attributes {
1719 	NFTA_FLOWTABLE_HOOK_UNSPEC,
1720 	NFTA_FLOWTABLE_HOOK_NUM,
1721 	NFTA_FLOWTABLE_HOOK_PRIORITY,
1722 	NFTA_FLOWTABLE_HOOK_DEVS,
1723 	__NFTA_FLOWTABLE_HOOK_MAX
1724 };
1725 #define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
1726 
1727 /**
1728  * enum nft_osf_attributes - nftables osf expression netlink attributes
1729  *
1730  * @NFTA_OSF_DREG: destination register (NLA_U32: nft_registers)
1731  * @NFTA_OSF_TTL: Value of the TTL osf option (NLA_U8)
1732  * @NFTA_OSF_FLAGS: flags (NLA_U32)
1733  */
1734 enum nft_osf_attributes {
1735 	NFTA_OSF_UNSPEC,
1736 	NFTA_OSF_DREG,
1737 	NFTA_OSF_TTL,
1738 	NFTA_OSF_FLAGS,
1739 	__NFTA_OSF_MAX,
1740 };
1741 #define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1)
1742 
1743 enum nft_osf_flags {
1744 	NFT_OSF_F_VERSION = (1 << 0),
1745 };
1746 
1747 /**
1748  * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
1749  *
1750  * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
1751  * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
1752  * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
1753  */
1754 enum nft_synproxy_attributes {
1755 	NFTA_SYNPROXY_UNSPEC,
1756 	NFTA_SYNPROXY_MSS,
1757 	NFTA_SYNPROXY_WSCALE,
1758 	NFTA_SYNPROXY_FLAGS,
1759 	__NFTA_SYNPROXY_MAX,
1760 };
1761 #define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
1762 
1763 /**
1764  * enum nft_device_attributes - nf_tables device netlink attributes
1765  *
1766  * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
1767  */
1768 enum nft_devices_attributes {
1769 	NFTA_DEVICE_UNSPEC,
1770 	NFTA_DEVICE_NAME,
1771 	__NFTA_DEVICE_MAX
1772 };
1773 #define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)
1774 
1775 /*
1776  * enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
1777  *
1778  * @NFTA_XFRM_DREG: destination register (NLA_U32)
1779  * @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
1780  * @NFTA_XFRM_DIR: direction (NLA_U8)
1781  * @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
1782  */
1783 enum nft_xfrm_attributes {
1784 	NFTA_XFRM_UNSPEC,
1785 	NFTA_XFRM_DREG,
1786 	NFTA_XFRM_KEY,
1787 	NFTA_XFRM_DIR,
1788 	NFTA_XFRM_SPNUM,
1789 	__NFTA_XFRM_MAX
1790 };
1791 #define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
1792 
1793 enum nft_xfrm_keys {
1794 	NFT_XFRM_KEY_UNSPEC,
1795 	NFT_XFRM_KEY_DADDR_IP4,
1796 	NFT_XFRM_KEY_DADDR_IP6,
1797 	NFT_XFRM_KEY_SADDR_IP4,
1798 	NFT_XFRM_KEY_SADDR_IP6,
1799 	NFT_XFRM_KEY_REQID,
1800 	NFT_XFRM_KEY_SPI,
1801 	__NFT_XFRM_KEY_MAX,
1802 };
1803 #define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
1804 
1805 /**
1806  * enum nft_trace_attributes - nf_tables trace netlink attributes
1807  *
1808  * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
1809  * @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)
1810  * @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)
1811  * @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)
1812  * @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)
1813  * @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)
1814  * @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)
1815  * @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)
1816  * @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)
1817  * @NFTA_TRACE_IIF: indev ifindex (NLA_U32)
1818  * @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)
1819  * @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)
1820  * @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)
1821  * @NFTA_TRACE_MARK: nfmark (NLA_U32)
1822  * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
1823  * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
1824  */
1825 enum nft_trace_attributes {
1826 	NFTA_TRACE_UNSPEC,
1827 	NFTA_TRACE_TABLE,
1828 	NFTA_TRACE_CHAIN,
1829 	NFTA_TRACE_RULE_HANDLE,
1830 	NFTA_TRACE_TYPE,
1831 	NFTA_TRACE_VERDICT,
1832 	NFTA_TRACE_ID,
1833 	NFTA_TRACE_LL_HEADER,
1834 	NFTA_TRACE_NETWORK_HEADER,
1835 	NFTA_TRACE_TRANSPORT_HEADER,
1836 	NFTA_TRACE_IIF,
1837 	NFTA_TRACE_IIFTYPE,
1838 	NFTA_TRACE_OIF,
1839 	NFTA_TRACE_OIFTYPE,
1840 	NFTA_TRACE_MARK,
1841 	NFTA_TRACE_NFPROTO,
1842 	NFTA_TRACE_POLICY,
1843 	NFTA_TRACE_PAD,
1844 	__NFTA_TRACE_MAX
1845 };
1846 #define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
1847 
1848 enum nft_trace_types {
1849 	NFT_TRACETYPE_UNSPEC,
1850 	NFT_TRACETYPE_POLICY,
1851 	NFT_TRACETYPE_RETURN,
1852 	NFT_TRACETYPE_RULE,
1853 	__NFT_TRACETYPE_MAX
1854 };
1855 #define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
1856 
1857 /**
1858  * enum nft_ng_attributes - nf_tables number generator expression netlink attributes
1859  *
1860  * @NFTA_NG_DREG: destination register (NLA_U32)
1861  * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
1862  * @NFTA_NG_TYPE: operation type (NLA_U32)
1863  * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
1864  * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
1865  * @NFTA_NG_SET_ID: id of the map (NLA_U32)
1866  */
1867 enum nft_ng_attributes {
1868 	NFTA_NG_UNSPEC,
1869 	NFTA_NG_DREG,
1870 	NFTA_NG_MODULUS,
1871 	NFTA_NG_TYPE,
1872 	NFTA_NG_OFFSET,
1873 	NFTA_NG_SET_NAME,	/* deprecated */
1874 	NFTA_NG_SET_ID,		/* deprecated */
1875 	__NFTA_NG_MAX
1876 };
1877 #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
1878 
1879 enum nft_ng_types {
1880 	NFT_NG_INCREMENTAL,
1881 	NFT_NG_RANDOM,
1882 	__NFT_NG_MAX
1883 };
1884 #define NFT_NG_MAX	(__NFT_NG_MAX - 1)
1885 
1886 enum nft_tunnel_key_ip_attributes {
1887 	NFTA_TUNNEL_KEY_IP_UNSPEC,
1888 	NFTA_TUNNEL_KEY_IP_SRC,
1889 	NFTA_TUNNEL_KEY_IP_DST,
1890 	__NFTA_TUNNEL_KEY_IP_MAX
1891 };
1892 #define NFTA_TUNNEL_KEY_IP_MAX	(__NFTA_TUNNEL_KEY_IP_MAX - 1)
1893 
1894 enum nft_tunnel_ip6_attributes {
1895 	NFTA_TUNNEL_KEY_IP6_UNSPEC,
1896 	NFTA_TUNNEL_KEY_IP6_SRC,
1897 	NFTA_TUNNEL_KEY_IP6_DST,
1898 	NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
1899 	__NFTA_TUNNEL_KEY_IP6_MAX
1900 };
1901 #define NFTA_TUNNEL_KEY_IP6_MAX	(__NFTA_TUNNEL_KEY_IP6_MAX - 1)
1902 
1903 enum nft_tunnel_opts_attributes {
1904 	NFTA_TUNNEL_KEY_OPTS_UNSPEC,
1905 	NFTA_TUNNEL_KEY_OPTS_VXLAN,
1906 	NFTA_TUNNEL_KEY_OPTS_ERSPAN,
1907 	NFTA_TUNNEL_KEY_OPTS_GENEVE,
1908 	__NFTA_TUNNEL_KEY_OPTS_MAX
1909 };
1910 #define NFTA_TUNNEL_KEY_OPTS_MAX	(__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
1911 
1912 enum nft_tunnel_opts_vxlan_attributes {
1913 	NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
1914 	NFTA_TUNNEL_KEY_VXLAN_GBP,
1915 	__NFTA_TUNNEL_KEY_VXLAN_MAX
1916 };
1917 #define NFTA_TUNNEL_KEY_VXLAN_MAX	(__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
1918 
1919 enum nft_tunnel_opts_erspan_attributes {
1920 	NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
1921 	NFTA_TUNNEL_KEY_ERSPAN_VERSION,
1922 	NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
1923 	NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
1924 	NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
1925 	__NFTA_TUNNEL_KEY_ERSPAN_MAX
1926 };
1927 #define NFTA_TUNNEL_KEY_ERSPAN_MAX	(__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
1928 
1929 enum nft_tunnel_opts_geneve_attributes {
1930 	NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
1931 	NFTA_TUNNEL_KEY_GENEVE_CLASS,
1932 	NFTA_TUNNEL_KEY_GENEVE_TYPE,
1933 	NFTA_TUNNEL_KEY_GENEVE_DATA,
1934 	__NFTA_TUNNEL_KEY_GENEVE_MAX
1935 };
1936 #define NFTA_TUNNEL_KEY_GENEVE_MAX	(__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
1937 
1938 enum nft_tunnel_flags {
1939 	NFT_TUNNEL_F_ZERO_CSUM_TX	= (1 << 0),
1940 	NFT_TUNNEL_F_DONT_FRAGMENT	= (1 << 1),
1941 	NFT_TUNNEL_F_SEQ_NUMBER		= (1 << 2),
1942 };
1943 #define NFT_TUNNEL_F_MASK	(NFT_TUNNEL_F_ZERO_CSUM_TX | \
1944 				 NFT_TUNNEL_F_DONT_FRAGMENT | \
1945 				 NFT_TUNNEL_F_SEQ_NUMBER)
1946 
1947 enum nft_tunnel_key_attributes {
1948 	NFTA_TUNNEL_KEY_UNSPEC,
1949 	NFTA_TUNNEL_KEY_ID,
1950 	NFTA_TUNNEL_KEY_IP,
1951 	NFTA_TUNNEL_KEY_IP6,
1952 	NFTA_TUNNEL_KEY_FLAGS,
1953 	NFTA_TUNNEL_KEY_TOS,
1954 	NFTA_TUNNEL_KEY_TTL,
1955 	NFTA_TUNNEL_KEY_SPORT,
1956 	NFTA_TUNNEL_KEY_DPORT,
1957 	NFTA_TUNNEL_KEY_OPTS,
1958 	__NFTA_TUNNEL_KEY_MAX
1959 };
1960 #define NFTA_TUNNEL_KEY_MAX	(__NFTA_TUNNEL_KEY_MAX - 1)
1961 
1962 enum nft_tunnel_keys {
1963 	NFT_TUNNEL_PATH,
1964 	NFT_TUNNEL_ID,
1965 	__NFT_TUNNEL_MAX
1966 };
1967 #define NFT_TUNNEL_MAX	(__NFT_TUNNEL_MAX - 1)
1968 
1969 enum nft_tunnel_mode {
1970 	NFT_TUNNEL_MODE_NONE,
1971 	NFT_TUNNEL_MODE_RX,
1972 	NFT_TUNNEL_MODE_TX,
1973 	__NFT_TUNNEL_MODE_MAX
1974 };
1975 #define NFT_TUNNEL_MODE_MAX	(__NFT_TUNNEL_MODE_MAX - 1)
1976 
1977 enum nft_tunnel_attributes {
1978 	NFTA_TUNNEL_UNSPEC,
1979 	NFTA_TUNNEL_KEY,
1980 	NFTA_TUNNEL_DREG,
1981 	NFTA_TUNNEL_MODE,
1982 	__NFTA_TUNNEL_MAX
1983 };
1984 #define NFTA_TUNNEL_MAX	(__NFTA_TUNNEL_MAX - 1)
1985 
1986 #endif /* _LINUX_NF_TABLES_H */
1987