xref: /openbmc/linux/include/uapi/linux/netfilter/nf_tables.h (revision fac59652993f075d57860769c99045b3ca18780d)
1  /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
2  #ifndef _LINUX_NF_TABLES_H
3  #define _LINUX_NF_TABLES_H
4  
5  #define NFT_NAME_MAXLEN		256
6  #define NFT_TABLE_MAXNAMELEN	NFT_NAME_MAXLEN
7  #define NFT_CHAIN_MAXNAMELEN	NFT_NAME_MAXLEN
8  #define NFT_SET_MAXNAMELEN	NFT_NAME_MAXLEN
9  #define NFT_OBJ_MAXNAMELEN	NFT_NAME_MAXLEN
10  #define NFT_USERDATA_MAXLEN	256
11  #define NFT_OSF_MAXGENRELEN	16
12  
13  /**
14   * enum nft_registers - nf_tables registers
15   *
16   * nf_tables used to have five registers: a verdict register and four data
17   * registers of size 16. The data registers have been changed to 16 registers
18   * of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
19   * map to areas of size 16, the 4 byte registers are addressed using
20   * NFT_REG32_00 - NFT_REG32_15.
21   */
22  enum nft_registers {
23  	NFT_REG_VERDICT,
24  	NFT_REG_1,
25  	NFT_REG_2,
26  	NFT_REG_3,
27  	NFT_REG_4,
28  	__NFT_REG_MAX,
29  
30  	NFT_REG32_00	= 8,
31  	NFT_REG32_01,
32  	NFT_REG32_02,
33  	NFT_REG32_03,
34  	NFT_REG32_04,
35  	NFT_REG32_05,
36  	NFT_REG32_06,
37  	NFT_REG32_07,
38  	NFT_REG32_08,
39  	NFT_REG32_09,
40  	NFT_REG32_10,
41  	NFT_REG32_11,
42  	NFT_REG32_12,
43  	NFT_REG32_13,
44  	NFT_REG32_14,
45  	NFT_REG32_15,
46  };
47  #define NFT_REG_MAX	(__NFT_REG_MAX - 1)
48  
49  #define NFT_REG_SIZE	16
50  #define NFT_REG32_SIZE	4
51  #define NFT_REG32_COUNT	(NFT_REG32_15 - NFT_REG32_00 + 1)
52  
53  /**
54   * enum nft_verdicts - nf_tables internal verdicts
55   *
56   * @NFT_CONTINUE: continue evaluation of the current rule
57   * @NFT_BREAK: terminate evaluation of the current rule
58   * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
59   * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
60   * @NFT_RETURN: return to the topmost chain on the jump stack
61   *
62   * The nf_tables verdicts share their numeric space with the netfilter verdicts.
63   */
64  enum nft_verdicts {
65  	NFT_CONTINUE	= -1,
66  	NFT_BREAK	= -2,
67  	NFT_JUMP	= -3,
68  	NFT_GOTO	= -4,
69  	NFT_RETURN	= -5,
70  };
71  
72  /**
73   * enum nf_tables_msg_types - nf_tables netlink message types
74   *
75   * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
76   * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
77   * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
78   * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
79   * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
80   * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
81   * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
82   * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
83   * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
84   * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
85   * @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
86   * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
87   * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
88   * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
89   * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
90   * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
91   * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
92   * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
93   * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
94   * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
95   * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
96   * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
97   * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
98   * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
99   * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
100   * @NFT_MSG_GETRULE_RESET: get rules and reset stateful expressions (enum nft_obj_attributes)
101   * @NFT_MSG_DESTROYTABLE: destroy a table (enum nft_table_attributes)
102   * @NFT_MSG_DESTROYCHAIN: destroy a chain (enum nft_chain_attributes)
103   * @NFT_MSG_DESTROYRULE: destroy a rule (enum nft_rule_attributes)
104   * @NFT_MSG_DESTROYSET: destroy a set (enum nft_set_attributes)
105   * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)
106   * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)
107   * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)
108   * @NFT_MSG_GETSETELEM_RESET: get set elements and reset attached stateful expressions (enum nft_set_elem_attributes)
109   */
110  enum nf_tables_msg_types {
111  	NFT_MSG_NEWTABLE,
112  	NFT_MSG_GETTABLE,
113  	NFT_MSG_DELTABLE,
114  	NFT_MSG_NEWCHAIN,
115  	NFT_MSG_GETCHAIN,
116  	NFT_MSG_DELCHAIN,
117  	NFT_MSG_NEWRULE,
118  	NFT_MSG_GETRULE,
119  	NFT_MSG_DELRULE,
120  	NFT_MSG_NEWSET,
121  	NFT_MSG_GETSET,
122  	NFT_MSG_DELSET,
123  	NFT_MSG_NEWSETELEM,
124  	NFT_MSG_GETSETELEM,
125  	NFT_MSG_DELSETELEM,
126  	NFT_MSG_NEWGEN,
127  	NFT_MSG_GETGEN,
128  	NFT_MSG_TRACE,
129  	NFT_MSG_NEWOBJ,
130  	NFT_MSG_GETOBJ,
131  	NFT_MSG_DELOBJ,
132  	NFT_MSG_GETOBJ_RESET,
133  	NFT_MSG_NEWFLOWTABLE,
134  	NFT_MSG_GETFLOWTABLE,
135  	NFT_MSG_DELFLOWTABLE,
136  	NFT_MSG_GETRULE_RESET,
137  	NFT_MSG_DESTROYTABLE,
138  	NFT_MSG_DESTROYCHAIN,
139  	NFT_MSG_DESTROYRULE,
140  	NFT_MSG_DESTROYSET,
141  	NFT_MSG_DESTROYSETELEM,
142  	NFT_MSG_DESTROYOBJ,
143  	NFT_MSG_DESTROYFLOWTABLE,
144  	NFT_MSG_GETSETELEM_RESET,
145  	NFT_MSG_MAX,
146  };
147  
148  /**
149   * enum nft_list_attributes - nf_tables generic list netlink attributes
150   *
151   * @NFTA_LIST_ELEM: list element (NLA_NESTED)
152   */
153  enum nft_list_attributes {
154  	NFTA_LIST_UNSPEC,
155  	NFTA_LIST_ELEM,
156  	__NFTA_LIST_MAX
157  };
158  #define NFTA_LIST_MAX		(__NFTA_LIST_MAX - 1)
159  
160  /**
161   * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
162   *
163   * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
164   * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
165   * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
166   * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
167   */
168  enum nft_hook_attributes {
169  	NFTA_HOOK_UNSPEC,
170  	NFTA_HOOK_HOOKNUM,
171  	NFTA_HOOK_PRIORITY,
172  	NFTA_HOOK_DEV,
173  	NFTA_HOOK_DEVS,
174  	__NFTA_HOOK_MAX
175  };
176  #define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)
177  
178  /**
179   * enum nft_table_flags - nf_tables table flags
180   *
181   * @NFT_TABLE_F_DORMANT: this table is not active
182   */
183  enum nft_table_flags {
184  	NFT_TABLE_F_DORMANT	= 0x1,
185  	NFT_TABLE_F_OWNER	= 0x2,
186  };
187  #define NFT_TABLE_F_MASK	(NFT_TABLE_F_DORMANT | \
188  				 NFT_TABLE_F_OWNER)
189  
190  /**
191   * enum nft_table_attributes - nf_tables table netlink attributes
192   *
193   * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
194   * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
195   * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
196   * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
197   * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
198   */
199  enum nft_table_attributes {
200  	NFTA_TABLE_UNSPEC,
201  	NFTA_TABLE_NAME,
202  	NFTA_TABLE_FLAGS,
203  	NFTA_TABLE_USE,
204  	NFTA_TABLE_HANDLE,
205  	NFTA_TABLE_PAD,
206  	NFTA_TABLE_USERDATA,
207  	NFTA_TABLE_OWNER,
208  	__NFTA_TABLE_MAX
209  };
210  #define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
211  
212  enum nft_chain_flags {
213  	NFT_CHAIN_BASE		= (1 << 0),
214  	NFT_CHAIN_HW_OFFLOAD	= (1 << 1),
215  	NFT_CHAIN_BINDING	= (1 << 2),
216  };
217  #define NFT_CHAIN_FLAGS		(NFT_CHAIN_BASE		| \
218  				 NFT_CHAIN_HW_OFFLOAD	| \
219  				 NFT_CHAIN_BINDING)
220  
221  /**
222   * enum nft_chain_attributes - nf_tables chain netlink attributes
223   *
224   * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
225   * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
226   * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
227   * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
228   * @NFTA_CHAIN_POLICY: numeric policy of the chain (NLA_U32)
229   * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
230   * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
231   * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
232   * @NFTA_CHAIN_FLAGS: chain flags
233   * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
234   * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
235   */
236  enum nft_chain_attributes {
237  	NFTA_CHAIN_UNSPEC,
238  	NFTA_CHAIN_TABLE,
239  	NFTA_CHAIN_HANDLE,
240  	NFTA_CHAIN_NAME,
241  	NFTA_CHAIN_HOOK,
242  	NFTA_CHAIN_POLICY,
243  	NFTA_CHAIN_USE,
244  	NFTA_CHAIN_TYPE,
245  	NFTA_CHAIN_COUNTERS,
246  	NFTA_CHAIN_PAD,
247  	NFTA_CHAIN_FLAGS,
248  	NFTA_CHAIN_ID,
249  	NFTA_CHAIN_USERDATA,
250  	__NFTA_CHAIN_MAX
251  };
252  #define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)
253  
254  /**
255   * enum nft_rule_attributes - nf_tables rule netlink attributes
256   *
257   * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
258   * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
259   * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
260   * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
261   * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
262   * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
263   * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
264   * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
265   * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
266   * @NFTA_RULE_CHAIN_ID: add the rule to chain by ID, alternative to @NFTA_RULE_CHAIN (NLA_U32)
267   */
268  enum nft_rule_attributes {
269  	NFTA_RULE_UNSPEC,
270  	NFTA_RULE_TABLE,
271  	NFTA_RULE_CHAIN,
272  	NFTA_RULE_HANDLE,
273  	NFTA_RULE_EXPRESSIONS,
274  	NFTA_RULE_COMPAT,
275  	NFTA_RULE_POSITION,
276  	NFTA_RULE_USERDATA,
277  	NFTA_RULE_PAD,
278  	NFTA_RULE_ID,
279  	NFTA_RULE_POSITION_ID,
280  	NFTA_RULE_CHAIN_ID,
281  	__NFTA_RULE_MAX
282  };
283  #define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)
284  
285  /**
286   * enum nft_rule_compat_flags - nf_tables rule compat flags
287   *
288   * @NFT_RULE_COMPAT_F_UNUSED: unused
289   * @NFT_RULE_COMPAT_F_INV: invert the check result
290   */
291  enum nft_rule_compat_flags {
292  	NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
293  	NFT_RULE_COMPAT_F_INV	= (1 << 1),
294  	NFT_RULE_COMPAT_F_MASK	= NFT_RULE_COMPAT_F_INV,
295  };
296  
297  /**
298   * enum nft_rule_compat_attributes - nf_tables rule compat attributes
299   *
300   * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
301   * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
302   */
303  enum nft_rule_compat_attributes {
304  	NFTA_RULE_COMPAT_UNSPEC,
305  	NFTA_RULE_COMPAT_PROTO,
306  	NFTA_RULE_COMPAT_FLAGS,
307  	__NFTA_RULE_COMPAT_MAX
308  };
309  #define NFTA_RULE_COMPAT_MAX	(__NFTA_RULE_COMPAT_MAX - 1)
310  
311  /**
312   * enum nft_set_flags - nf_tables set flags
313   *
314   * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
315   * @NFT_SET_CONSTANT: set contents may not change while bound
316   * @NFT_SET_INTERVAL: set contains intervals
317   * @NFT_SET_MAP: set is used as a dictionary
318   * @NFT_SET_TIMEOUT: set uses timeouts
319   * @NFT_SET_EVAL: set can be updated from the evaluation path
320   * @NFT_SET_OBJECT: set contains stateful objects
321   * @NFT_SET_CONCAT: set contains a concatenation
322   * @NFT_SET_EXPR: set contains expressions
323   */
324  enum nft_set_flags {
325  	NFT_SET_ANONYMOUS		= 0x1,
326  	NFT_SET_CONSTANT		= 0x2,
327  	NFT_SET_INTERVAL		= 0x4,
328  	NFT_SET_MAP			= 0x8,
329  	NFT_SET_TIMEOUT			= 0x10,
330  	NFT_SET_EVAL			= 0x20,
331  	NFT_SET_OBJECT			= 0x40,
332  	NFT_SET_CONCAT			= 0x80,
333  	NFT_SET_EXPR			= 0x100,
334  };
335  
336  /**
337   * enum nft_set_policies - set selection policy
338   *
339   * @NFT_SET_POL_PERFORMANCE: prefer high performance over low memory use
340   * @NFT_SET_POL_MEMORY: prefer low memory use over high performance
341   */
342  enum nft_set_policies {
343  	NFT_SET_POL_PERFORMANCE,
344  	NFT_SET_POL_MEMORY,
345  };
346  
347  /**
348   * enum nft_set_desc_attributes - set element description
349   *
350   * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
351   * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
352   */
353  enum nft_set_desc_attributes {
354  	NFTA_SET_DESC_UNSPEC,
355  	NFTA_SET_DESC_SIZE,
356  	NFTA_SET_DESC_CONCAT,
357  	__NFTA_SET_DESC_MAX
358  };
359  #define NFTA_SET_DESC_MAX	(__NFTA_SET_DESC_MAX - 1)
360  
361  /**
362   * enum nft_set_field_attributes - attributes of concatenated fields
363   *
364   * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
365   */
366  enum nft_set_field_attributes {
367  	NFTA_SET_FIELD_UNSPEC,
368  	NFTA_SET_FIELD_LEN,
369  	__NFTA_SET_FIELD_MAX
370  };
371  #define NFTA_SET_FIELD_MAX	(__NFTA_SET_FIELD_MAX - 1)
372  
373  /**
374   * enum nft_set_attributes - nf_tables set netlink attributes
375   *
376   * @NFTA_SET_TABLE: table name (NLA_STRING)
377   * @NFTA_SET_NAME: set name (NLA_STRING)
378   * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
379   * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
380   * @NFTA_SET_KEY_LEN: key data length (NLA_U32)
381   * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
382   * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
383   * @NFTA_SET_POLICY: selection policy (NLA_U32)
384   * @NFTA_SET_DESC: set description (NLA_NESTED)
385   * @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
386   * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
387   * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
388   * @NFTA_SET_USERDATA: user data (NLA_BINARY)
389   * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
390   * @NFTA_SET_HANDLE: set handle (NLA_U64)
391   * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
392   * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
393   */
394  enum nft_set_attributes {
395  	NFTA_SET_UNSPEC,
396  	NFTA_SET_TABLE,
397  	NFTA_SET_NAME,
398  	NFTA_SET_FLAGS,
399  	NFTA_SET_KEY_TYPE,
400  	NFTA_SET_KEY_LEN,
401  	NFTA_SET_DATA_TYPE,
402  	NFTA_SET_DATA_LEN,
403  	NFTA_SET_POLICY,
404  	NFTA_SET_DESC,
405  	NFTA_SET_ID,
406  	NFTA_SET_TIMEOUT,
407  	NFTA_SET_GC_INTERVAL,
408  	NFTA_SET_USERDATA,
409  	NFTA_SET_PAD,
410  	NFTA_SET_OBJ_TYPE,
411  	NFTA_SET_HANDLE,
412  	NFTA_SET_EXPR,
413  	NFTA_SET_EXPRESSIONS,
414  	__NFTA_SET_MAX
415  };
416  #define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
417  
418  /**
419   * enum nft_set_elem_flags - nf_tables set element flags
420   *
421   * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
422   * @NFT_SET_ELEM_CATCHALL: special catch-all element
423   */
424  enum nft_set_elem_flags {
425  	NFT_SET_ELEM_INTERVAL_END	= 0x1,
426  	NFT_SET_ELEM_CATCHALL		= 0x2,
427  };
428  
429  /**
430   * enum nft_set_elem_attributes - nf_tables set element netlink attributes
431   *
432   * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
433   * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
434   * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
435   * @NFTA_SET_ELEM_TIMEOUT: timeout value (NLA_U64)
436   * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
437   * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
438   * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
439   * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
440   * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
441   * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
442   */
443  enum nft_set_elem_attributes {
444  	NFTA_SET_ELEM_UNSPEC,
445  	NFTA_SET_ELEM_KEY,
446  	NFTA_SET_ELEM_DATA,
447  	NFTA_SET_ELEM_FLAGS,
448  	NFTA_SET_ELEM_TIMEOUT,
449  	NFTA_SET_ELEM_EXPIRATION,
450  	NFTA_SET_ELEM_USERDATA,
451  	NFTA_SET_ELEM_EXPR,
452  	NFTA_SET_ELEM_PAD,
453  	NFTA_SET_ELEM_OBJREF,
454  	NFTA_SET_ELEM_KEY_END,
455  	NFTA_SET_ELEM_EXPRESSIONS,
456  	__NFTA_SET_ELEM_MAX
457  };
458  #define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)
459  
460  /**
461   * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
462   *
463   * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
464   * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
465   * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
466   * @NFTA_SET_ELEM_LIST_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
467   */
468  enum nft_set_elem_list_attributes {
469  	NFTA_SET_ELEM_LIST_UNSPEC,
470  	NFTA_SET_ELEM_LIST_TABLE,
471  	NFTA_SET_ELEM_LIST_SET,
472  	NFTA_SET_ELEM_LIST_ELEMENTS,
473  	NFTA_SET_ELEM_LIST_SET_ID,
474  	__NFTA_SET_ELEM_LIST_MAX
475  };
476  #define NFTA_SET_ELEM_LIST_MAX	(__NFTA_SET_ELEM_LIST_MAX - 1)
477  
478  /**
479   * enum nft_data_types - nf_tables data types
480   *
481   * @NFT_DATA_VALUE: generic data
482   * @NFT_DATA_VERDICT: netfilter verdict
483   *
484   * The type of data is usually determined by the kernel directly and is not
485   * explicitly specified by userspace. The only difference are sets, where
486   * userspace specifies the key and mapping data types.
487   *
488   * The values 0xffffff00-0xffffffff are reserved for internally used types.
489   * The remaining range can be freely used by userspace to encode types, all
490   * values are equivalent to NFT_DATA_VALUE.
491   */
492  enum nft_data_types {
493  	NFT_DATA_VALUE,
494  	NFT_DATA_VERDICT	= 0xffffff00U,
495  };
496  
497  #define NFT_DATA_RESERVED_MASK	0xffffff00U
498  
499  /**
500   * enum nft_data_attributes - nf_tables data netlink attributes
501   *
502   * @NFTA_DATA_VALUE: generic data (NLA_BINARY)
503   * @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
504   */
505  enum nft_data_attributes {
506  	NFTA_DATA_UNSPEC,
507  	NFTA_DATA_VALUE,
508  	NFTA_DATA_VERDICT,
509  	__NFTA_DATA_MAX
510  };
511  #define NFTA_DATA_MAX		(__NFTA_DATA_MAX - 1)
512  
513  /* Maximum length of a value */
514  #define NFT_DATA_VALUE_MAXLEN	64
515  
516  /**
517   * enum nft_verdict_attributes - nf_tables verdict netlink attributes
518   *
519   * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
520   * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
521   * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
522   */
523  enum nft_verdict_attributes {
524  	NFTA_VERDICT_UNSPEC,
525  	NFTA_VERDICT_CODE,
526  	NFTA_VERDICT_CHAIN,
527  	NFTA_VERDICT_CHAIN_ID,
528  	__NFTA_VERDICT_MAX
529  };
530  #define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)
531  
532  /**
533   * enum nft_expr_attributes - nf_tables expression netlink attributes
534   *
535   * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
536   * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
537   */
538  enum nft_expr_attributes {
539  	NFTA_EXPR_UNSPEC,
540  	NFTA_EXPR_NAME,
541  	NFTA_EXPR_DATA,
542  	__NFTA_EXPR_MAX
543  };
544  #define NFTA_EXPR_MAX		(__NFTA_EXPR_MAX - 1)
545  
546  /**
547   * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
548   *
549   * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
550   * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
551   */
552  enum nft_immediate_attributes {
553  	NFTA_IMMEDIATE_UNSPEC,
554  	NFTA_IMMEDIATE_DREG,
555  	NFTA_IMMEDIATE_DATA,
556  	__NFTA_IMMEDIATE_MAX
557  };
558  #define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)
559  
560  /**
561   * enum nft_bitwise_ops - nf_tables bitwise operations
562   *
563   * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
564   *                    XOR boolean operations
565   * @NFT_BITWISE_LSHIFT: left-shift operation
566   * @NFT_BITWISE_RSHIFT: right-shift operation
567   */
568  enum nft_bitwise_ops {
569  	NFT_BITWISE_BOOL,
570  	NFT_BITWISE_LSHIFT,
571  	NFT_BITWISE_RSHIFT,
572  };
573  
574  /**
575   * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
576   *
577   * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
578   * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
579   * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
580   * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
581   * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
582   * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
583   * @NFTA_BITWISE_DATA: argument for non-boolean operations
584   *                     (NLA_NESTED: nft_data_attributes)
585   *
586   * The bitwise expression supports boolean and shift operations.  It implements
587   * the boolean operations by performing the following operation:
588   *
589   * dreg = (sreg & mask) ^ xor
590   *
591   * with these mask and xor values:
592   *
593   * 		mask	xor
594   * NOT:		1	1
595   * OR:		~x	x
596   * XOR:		1	x
597   * AND:		x	0
598   */
599  enum nft_bitwise_attributes {
600  	NFTA_BITWISE_UNSPEC,
601  	NFTA_BITWISE_SREG,
602  	NFTA_BITWISE_DREG,
603  	NFTA_BITWISE_LEN,
604  	NFTA_BITWISE_MASK,
605  	NFTA_BITWISE_XOR,
606  	NFTA_BITWISE_OP,
607  	NFTA_BITWISE_DATA,
608  	__NFTA_BITWISE_MAX
609  };
610  #define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
611  
612  /**
613   * enum nft_byteorder_ops - nf_tables byteorder operators
614   *
615   * @NFT_BYTEORDER_NTOH: network to host operator
616   * @NFT_BYTEORDER_HTON: host to network operator
617   */
618  enum nft_byteorder_ops {
619  	NFT_BYTEORDER_NTOH,
620  	NFT_BYTEORDER_HTON,
621  };
622  
623  /**
624   * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
625   *
626   * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
627   * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
628   * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
629   * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
630   * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
631   */
632  enum nft_byteorder_attributes {
633  	NFTA_BYTEORDER_UNSPEC,
634  	NFTA_BYTEORDER_SREG,
635  	NFTA_BYTEORDER_DREG,
636  	NFTA_BYTEORDER_OP,
637  	NFTA_BYTEORDER_LEN,
638  	NFTA_BYTEORDER_SIZE,
639  	__NFTA_BYTEORDER_MAX
640  };
641  #define NFTA_BYTEORDER_MAX	(__NFTA_BYTEORDER_MAX - 1)
642  
643  /**
644   * enum nft_cmp_ops - nf_tables relational operator
645   *
646   * @NFT_CMP_EQ: equal
647   * @NFT_CMP_NEQ: not equal
648   * @NFT_CMP_LT: less than
649   * @NFT_CMP_LTE: less than or equal to
650   * @NFT_CMP_GT: greater than
651   * @NFT_CMP_GTE: greater than or equal to
652   */
653  enum nft_cmp_ops {
654  	NFT_CMP_EQ,
655  	NFT_CMP_NEQ,
656  	NFT_CMP_LT,
657  	NFT_CMP_LTE,
658  	NFT_CMP_GT,
659  	NFT_CMP_GTE,
660  };
661  
662  /**
663   * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
664   *
665   * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
666   * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
667   * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
668   */
669  enum nft_cmp_attributes {
670  	NFTA_CMP_UNSPEC,
671  	NFTA_CMP_SREG,
672  	NFTA_CMP_OP,
673  	NFTA_CMP_DATA,
674  	__NFTA_CMP_MAX
675  };
676  #define NFTA_CMP_MAX		(__NFTA_CMP_MAX - 1)
677  
678  /**
679   * enum nft_range_ops - nf_tables range operator
680   *
681   * @NFT_RANGE_EQ: equal
682   * @NFT_RANGE_NEQ: not equal
683   */
684  enum nft_range_ops {
685  	NFT_RANGE_EQ,
686  	NFT_RANGE_NEQ,
687  };
688  
689  /**
690   * enum nft_range_attributes - nf_tables range expression netlink attributes
691   *
692   * @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
693   * @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_range_ops)
694   * @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
695   * @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
696   */
697  enum nft_range_attributes {
698  	NFTA_RANGE_UNSPEC,
699  	NFTA_RANGE_SREG,
700  	NFTA_RANGE_OP,
701  	NFTA_RANGE_FROM_DATA,
702  	NFTA_RANGE_TO_DATA,
703  	__NFTA_RANGE_MAX
704  };
705  #define NFTA_RANGE_MAX		(__NFTA_RANGE_MAX - 1)
706  
707  enum nft_lookup_flags {
708  	NFT_LOOKUP_F_INV = (1 << 0),
709  };
710  
711  /**
712   * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
713   *
714   * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
715   * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
716   * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
717   * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
718   * @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags)
719   */
720  enum nft_lookup_attributes {
721  	NFTA_LOOKUP_UNSPEC,
722  	NFTA_LOOKUP_SET,
723  	NFTA_LOOKUP_SREG,
724  	NFTA_LOOKUP_DREG,
725  	NFTA_LOOKUP_SET_ID,
726  	NFTA_LOOKUP_FLAGS,
727  	__NFTA_LOOKUP_MAX
728  };
729  #define NFTA_LOOKUP_MAX		(__NFTA_LOOKUP_MAX - 1)
730  
731  enum nft_dynset_ops {
732  	NFT_DYNSET_OP_ADD,
733  	NFT_DYNSET_OP_UPDATE,
734  	NFT_DYNSET_OP_DELETE,
735  };
736  
737  enum nft_dynset_flags {
738  	NFT_DYNSET_F_INV	= (1 << 0),
739  	NFT_DYNSET_F_EXPR	= (1 << 1),
740  };
741  
742  /**
743   * enum nft_dynset_attributes - dynset expression attributes
744   *
745   * @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)
746   * @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)
747   * @NFTA_DYNSET_OP: operation (NLA_U32)
748   * @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)
749   * @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)
750   * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
751   * @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
752   * @NFTA_DYNSET_FLAGS: flags (NLA_U32)
753   * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
754   */
755  enum nft_dynset_attributes {
756  	NFTA_DYNSET_UNSPEC,
757  	NFTA_DYNSET_SET_NAME,
758  	NFTA_DYNSET_SET_ID,
759  	NFTA_DYNSET_OP,
760  	NFTA_DYNSET_SREG_KEY,
761  	NFTA_DYNSET_SREG_DATA,
762  	NFTA_DYNSET_TIMEOUT,
763  	NFTA_DYNSET_EXPR,
764  	NFTA_DYNSET_PAD,
765  	NFTA_DYNSET_FLAGS,
766  	NFTA_DYNSET_EXPRESSIONS,
767  	__NFTA_DYNSET_MAX,
768  };
769  #define NFTA_DYNSET_MAX		(__NFTA_DYNSET_MAX - 1)
770  
771  /**
772   * enum nft_payload_bases - nf_tables payload expression offset bases
773   *
774   * @NFT_PAYLOAD_LL_HEADER: link layer header
775   * @NFT_PAYLOAD_NETWORK_HEADER: network header
776   * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
777   * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
778   */
779  enum nft_payload_bases {
780  	NFT_PAYLOAD_LL_HEADER,
781  	NFT_PAYLOAD_NETWORK_HEADER,
782  	NFT_PAYLOAD_TRANSPORT_HEADER,
783  	NFT_PAYLOAD_INNER_HEADER,
784  	NFT_PAYLOAD_TUN_HEADER,
785  };
786  
787  /**
788   * enum nft_payload_csum_types - nf_tables payload expression checksum types
789   *
790   * @NFT_PAYLOAD_CSUM_NONE: no checksumming
791   * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
792   * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
793   */
794  enum nft_payload_csum_types {
795  	NFT_PAYLOAD_CSUM_NONE,
796  	NFT_PAYLOAD_CSUM_INET,
797  	NFT_PAYLOAD_CSUM_SCTP,
798  };
799  
800  enum nft_payload_csum_flags {
801  	NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
802  };
803  
804  enum nft_inner_type {
805  	NFT_INNER_UNSPEC	= 0,
806  	NFT_INNER_VXLAN,
807  	NFT_INNER_GENEVE,
808  };
809  
810  enum nft_inner_flags {
811  	NFT_INNER_HDRSIZE	= (1 << 0),
812  	NFT_INNER_LL		= (1 << 1),
813  	NFT_INNER_NH		= (1 << 2),
814  	NFT_INNER_TH		= (1 << 3),
815  };
816  #define NFT_INNER_MASK		(NFT_INNER_HDRSIZE | NFT_INNER_LL | \
817  				 NFT_INNER_NH | NFT_INNER_TH)
818  
819  enum nft_inner_attributes {
820  	NFTA_INNER_UNSPEC,
821  	NFTA_INNER_NUM,
822  	NFTA_INNER_TYPE,
823  	NFTA_INNER_FLAGS,
824  	NFTA_INNER_HDRSIZE,
825  	NFTA_INNER_EXPR,
826  	__NFTA_INNER_MAX
827  };
828  #define NFTA_INNER_MAX	(__NFTA_INNER_MAX - 1)
829  
830  /**
831   * enum nft_payload_attributes - nf_tables payload expression netlink attributes
832   *
833   * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
834   * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
835   * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
836   * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
837   * @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
838   * @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
839   * @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
840   * @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
841   */
842  enum nft_payload_attributes {
843  	NFTA_PAYLOAD_UNSPEC,
844  	NFTA_PAYLOAD_DREG,
845  	NFTA_PAYLOAD_BASE,
846  	NFTA_PAYLOAD_OFFSET,
847  	NFTA_PAYLOAD_LEN,
848  	NFTA_PAYLOAD_SREG,
849  	NFTA_PAYLOAD_CSUM_TYPE,
850  	NFTA_PAYLOAD_CSUM_OFFSET,
851  	NFTA_PAYLOAD_CSUM_FLAGS,
852  	__NFTA_PAYLOAD_MAX
853  };
854  #define NFTA_PAYLOAD_MAX	(__NFTA_PAYLOAD_MAX - 1)
855  
856  enum nft_exthdr_flags {
857  	NFT_EXTHDR_F_PRESENT = (1 << 0),
858  };
859  
860  /**
861   * enum nft_exthdr_op - nf_tables match options
862   *
863   * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
864   * @NFT_EXTHDR_OP_TCP: match against tcp options
865   * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
866   * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
867   * @NFT_EXTHDR_OP_DCCP: match against dccp otions
868   */
869  enum nft_exthdr_op {
870  	NFT_EXTHDR_OP_IPV6,
871  	NFT_EXTHDR_OP_TCPOPT,
872  	NFT_EXTHDR_OP_IPV4,
873  	NFT_EXTHDR_OP_SCTP,
874  	NFT_EXTHDR_OP_DCCP,
875  	__NFT_EXTHDR_OP_MAX
876  };
877  #define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
878  
879  /**
880   * enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes
881   *
882   * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
883   * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
884   * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
885   * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
886   * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
887   * @NFTA_EXTHDR_OP: option match type (NLA_U32)
888   * @NFTA_EXTHDR_SREG: source register (NLA_U32: nft_registers)
889   */
890  enum nft_exthdr_attributes {
891  	NFTA_EXTHDR_UNSPEC,
892  	NFTA_EXTHDR_DREG,
893  	NFTA_EXTHDR_TYPE,
894  	NFTA_EXTHDR_OFFSET,
895  	NFTA_EXTHDR_LEN,
896  	NFTA_EXTHDR_FLAGS,
897  	NFTA_EXTHDR_OP,
898  	NFTA_EXTHDR_SREG,
899  	__NFTA_EXTHDR_MAX
900  };
901  #define NFTA_EXTHDR_MAX		(__NFTA_EXTHDR_MAX - 1)
902  
903  /**
904   * enum nft_meta_keys - nf_tables meta expression keys
905   *
906   * @NFT_META_LEN: packet length (skb->len)
907   * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
908   * @NFT_META_PRIORITY: packet priority (skb->priority)
909   * @NFT_META_MARK: packet mark (skb->mark)
910   * @NFT_META_IIF: packet input interface index (dev->ifindex)
911   * @NFT_META_OIF: packet output interface index (dev->ifindex)
912   * @NFT_META_IIFNAME: packet input interface name (dev->name)
913   * @NFT_META_OIFNAME: packet output interface name (dev->name)
914   * @NFT_META_IIFTYPE: packet input interface type (dev->type)
915   * @NFT_META_OIFTYPE: packet output interface type (dev->type)
916   * @NFT_META_SKUID: originating socket UID (fsuid)
917   * @NFT_META_SKGID: originating socket GID (fsgid)
918   * @NFT_META_NFTRACE: packet nftrace bit
919   * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
920   * @NFT_META_SECMARK: packet secmark (skb->secmark)
921   * @NFT_META_NFPROTO: netfilter protocol
922   * @NFT_META_L4PROTO: layer 4 protocol number
923   * @NFT_META_BRI_IIFNAME: packet input bridge interface name
924   * @NFT_META_BRI_OIFNAME: packet output bridge interface name
925   * @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
926   * @NFT_META_CPU: cpu id through smp_processor_id()
927   * @NFT_META_IIFGROUP: packet input interface group
928   * @NFT_META_OIFGROUP: packet output interface group
929   * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
930   * @NFT_META_PRANDOM: a 32bit pseudo-random number
931   * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
932   * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
933   * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
934   * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
935   * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
936   * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
937   * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
938   * @NFT_META_TIME_HOUR: hour of day (in seconds)
939   * @NFT_META_SDIF: slave device interface index
940   * @NFT_META_SDIFNAME: slave device interface name
941   * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
942   */
943  enum nft_meta_keys {
944  	NFT_META_LEN,
945  	NFT_META_PROTOCOL,
946  	NFT_META_PRIORITY,
947  	NFT_META_MARK,
948  	NFT_META_IIF,
949  	NFT_META_OIF,
950  	NFT_META_IIFNAME,
951  	NFT_META_OIFNAME,
952  	NFT_META_IFTYPE,
953  #define NFT_META_IIFTYPE	NFT_META_IFTYPE
954  	NFT_META_OIFTYPE,
955  	NFT_META_SKUID,
956  	NFT_META_SKGID,
957  	NFT_META_NFTRACE,
958  	NFT_META_RTCLASSID,
959  	NFT_META_SECMARK,
960  	NFT_META_NFPROTO,
961  	NFT_META_L4PROTO,
962  	NFT_META_BRI_IIFNAME,
963  	NFT_META_BRI_OIFNAME,
964  	NFT_META_PKTTYPE,
965  	NFT_META_CPU,
966  	NFT_META_IIFGROUP,
967  	NFT_META_OIFGROUP,
968  	NFT_META_CGROUP,
969  	NFT_META_PRANDOM,
970  	NFT_META_SECPATH,
971  	NFT_META_IIFKIND,
972  	NFT_META_OIFKIND,
973  	NFT_META_BRI_IIFPVID,
974  	NFT_META_BRI_IIFVPROTO,
975  	NFT_META_TIME_NS,
976  	NFT_META_TIME_DAY,
977  	NFT_META_TIME_HOUR,
978  	NFT_META_SDIF,
979  	NFT_META_SDIFNAME,
980  	NFT_META_BRI_BROUTE,
981  	__NFT_META_IIFTYPE,
982  };
983  
984  /**
985   * enum nft_rt_keys - nf_tables routing expression keys
986   *
987   * @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
988   * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
989   * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
990   * @NFT_RT_TCPMSS: fetch current path tcp mss
991   * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
992   */
993  enum nft_rt_keys {
994  	NFT_RT_CLASSID,
995  	NFT_RT_NEXTHOP4,
996  	NFT_RT_NEXTHOP6,
997  	NFT_RT_TCPMSS,
998  	NFT_RT_XFRM,
999  	__NFT_RT_MAX
1000  };
1001  #define NFT_RT_MAX		(__NFT_RT_MAX - 1)
1002  
1003  /**
1004   * enum nft_hash_types - nf_tables hash expression types
1005   *
1006   * @NFT_HASH_JENKINS: Jenkins Hash
1007   * @NFT_HASH_SYM: Symmetric Hash
1008   */
1009  enum nft_hash_types {
1010  	NFT_HASH_JENKINS,
1011  	NFT_HASH_SYM,
1012  };
1013  
1014  /**
1015   * enum nft_hash_attributes - nf_tables hash expression netlink attributes
1016   *
1017   * @NFTA_HASH_SREG: source register (NLA_U32)
1018   * @NFTA_HASH_DREG: destination register (NLA_U32)
1019   * @NFTA_HASH_LEN: source data length (NLA_U32)
1020   * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
1021   * @NFTA_HASH_SEED: seed value (NLA_U32)
1022   * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
1023   * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
1024   * @NFTA_HASH_SET_NAME: name of the map to lookup (NLA_STRING)
1025   * @NFTA_HASH_SET_ID: id of the map (NLA_U32)
1026   */
1027  enum nft_hash_attributes {
1028  	NFTA_HASH_UNSPEC,
1029  	NFTA_HASH_SREG,
1030  	NFTA_HASH_DREG,
1031  	NFTA_HASH_LEN,
1032  	NFTA_HASH_MODULUS,
1033  	NFTA_HASH_SEED,
1034  	NFTA_HASH_OFFSET,
1035  	NFTA_HASH_TYPE,
1036  	NFTA_HASH_SET_NAME,	/* deprecated */
1037  	NFTA_HASH_SET_ID,	/* deprecated */
1038  	__NFTA_HASH_MAX,
1039  };
1040  #define NFTA_HASH_MAX	(__NFTA_HASH_MAX - 1)
1041  
1042  /**
1043   * enum nft_meta_attributes - nf_tables meta expression netlink attributes
1044   *
1045   * @NFTA_META_DREG: destination register (NLA_U32)
1046   * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
1047   * @NFTA_META_SREG: source register (NLA_U32)
1048   */
1049  enum nft_meta_attributes {
1050  	NFTA_META_UNSPEC,
1051  	NFTA_META_DREG,
1052  	NFTA_META_KEY,
1053  	NFTA_META_SREG,
1054  	__NFTA_META_MAX
1055  };
1056  #define NFTA_META_MAX		(__NFTA_META_MAX - 1)
1057  
1058  /**
1059   * enum nft_rt_attributes - nf_tables routing expression netlink attributes
1060   *
1061   * @NFTA_RT_DREG: destination register (NLA_U32)
1062   * @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
1063   */
1064  enum nft_rt_attributes {
1065  	NFTA_RT_UNSPEC,
1066  	NFTA_RT_DREG,
1067  	NFTA_RT_KEY,
1068  	__NFTA_RT_MAX
1069  };
1070  #define NFTA_RT_MAX		(__NFTA_RT_MAX - 1)
1071  
1072  /**
1073   * enum nft_socket_attributes - nf_tables socket expression netlink attributes
1074   *
1075   * @NFTA_SOCKET_KEY: socket key to match
1076   * @NFTA_SOCKET_DREG: destination register
1077   * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
1078   */
1079  enum nft_socket_attributes {
1080  	NFTA_SOCKET_UNSPEC,
1081  	NFTA_SOCKET_KEY,
1082  	NFTA_SOCKET_DREG,
1083  	NFTA_SOCKET_LEVEL,
1084  	__NFTA_SOCKET_MAX
1085  };
1086  #define NFTA_SOCKET_MAX		(__NFTA_SOCKET_MAX - 1)
1087  
1088  /*
1089   * enum nft_socket_keys - nf_tables socket expression keys
1090   *
1091   * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
1092   * @NFT_SOCKET_MARK: Value of the socket mark
1093   * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
1094   * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
1095   */
1096  enum nft_socket_keys {
1097  	NFT_SOCKET_TRANSPARENT,
1098  	NFT_SOCKET_MARK,
1099  	NFT_SOCKET_WILDCARD,
1100  	NFT_SOCKET_CGROUPV2,
1101  	__NFT_SOCKET_MAX
1102  };
1103  #define NFT_SOCKET_MAX	(__NFT_SOCKET_MAX - 1)
1104  
1105  /**
1106   * enum nft_ct_keys - nf_tables ct expression keys
1107   *
1108   * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
1109   * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
1110   * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
1111   * @NFT_CT_MARK: conntrack mark value
1112   * @NFT_CT_SECMARK: conntrack secmark value
1113   * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
1114   * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
1115   * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
1116   * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address, deprecated)
1117   * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address, deprecated)
1118   * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
1119   * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
1120   * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
1121   * @NFT_CT_LABELS: conntrack labels
1122   * @NFT_CT_PKTS: conntrack packets
1123   * @NFT_CT_BYTES: conntrack bytes
1124   * @NFT_CT_AVGPKT: conntrack average bytes per packet
1125   * @NFT_CT_ZONE: conntrack zone
1126   * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
1127   * @NFT_CT_SRC_IP: conntrack layer 3 protocol source (IPv4 address)
1128   * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address)
1129   * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)
1130   * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)
1131   * @NFT_CT_ID: conntrack id
1132   */
1133  enum nft_ct_keys {
1134  	NFT_CT_STATE,
1135  	NFT_CT_DIRECTION,
1136  	NFT_CT_STATUS,
1137  	NFT_CT_MARK,
1138  	NFT_CT_SECMARK,
1139  	NFT_CT_EXPIRATION,
1140  	NFT_CT_HELPER,
1141  	NFT_CT_L3PROTOCOL,
1142  	NFT_CT_SRC,
1143  	NFT_CT_DST,
1144  	NFT_CT_PROTOCOL,
1145  	NFT_CT_PROTO_SRC,
1146  	NFT_CT_PROTO_DST,
1147  	NFT_CT_LABELS,
1148  	NFT_CT_PKTS,
1149  	NFT_CT_BYTES,
1150  	NFT_CT_AVGPKT,
1151  	NFT_CT_ZONE,
1152  	NFT_CT_EVENTMASK,
1153  	NFT_CT_SRC_IP,
1154  	NFT_CT_DST_IP,
1155  	NFT_CT_SRC_IP6,
1156  	NFT_CT_DST_IP6,
1157  	NFT_CT_ID,
1158  	__NFT_CT_MAX
1159  };
1160  #define NFT_CT_MAX		(__NFT_CT_MAX - 1)
1161  
1162  /**
1163   * enum nft_ct_attributes - nf_tables ct expression netlink attributes
1164   *
1165   * @NFTA_CT_DREG: destination register (NLA_U32)
1166   * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
1167   * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
1168   * @NFTA_CT_SREG: source register (NLA_U32)
1169   */
1170  enum nft_ct_attributes {
1171  	NFTA_CT_UNSPEC,
1172  	NFTA_CT_DREG,
1173  	NFTA_CT_KEY,
1174  	NFTA_CT_DIRECTION,
1175  	NFTA_CT_SREG,
1176  	__NFTA_CT_MAX
1177  };
1178  #define NFTA_CT_MAX		(__NFTA_CT_MAX - 1)
1179  
1180  /**
1181   * enum nft_flow_attributes - ct offload expression attributes
1182   * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
1183   */
1184  enum nft_offload_attributes {
1185  	NFTA_FLOW_UNSPEC,
1186  	NFTA_FLOW_TABLE_NAME,
1187  	__NFTA_FLOW_MAX,
1188  };
1189  #define NFTA_FLOW_MAX		(__NFTA_FLOW_MAX - 1)
1190  
1191  enum nft_limit_type {
1192  	NFT_LIMIT_PKTS,
1193  	NFT_LIMIT_PKT_BYTES
1194  };
1195  
1196  enum nft_limit_flags {
1197  	NFT_LIMIT_F_INV	= (1 << 0),
1198  };
1199  
1200  /**
1201   * enum nft_limit_attributes - nf_tables limit expression netlink attributes
1202   *
1203   * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
1204   * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
1205   * @NFTA_LIMIT_BURST: burst (NLA_U32)
1206   * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
1207   * @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
1208   */
1209  enum nft_limit_attributes {
1210  	NFTA_LIMIT_UNSPEC,
1211  	NFTA_LIMIT_RATE,
1212  	NFTA_LIMIT_UNIT,
1213  	NFTA_LIMIT_BURST,
1214  	NFTA_LIMIT_TYPE,
1215  	NFTA_LIMIT_FLAGS,
1216  	NFTA_LIMIT_PAD,
1217  	__NFTA_LIMIT_MAX
1218  };
1219  #define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)
1220  
1221  enum nft_connlimit_flags {
1222  	NFT_CONNLIMIT_F_INV	= (1 << 0),
1223  };
1224  
1225  /**
1226   * enum nft_connlimit_attributes - nf_tables connlimit expression netlink attributes
1227   *
1228   * @NFTA_CONNLIMIT_COUNT: number of connections (NLA_U32)
1229   * @NFTA_CONNLIMIT_FLAGS: flags (NLA_U32: enum nft_connlimit_flags)
1230   */
1231  enum nft_connlimit_attributes {
1232  	NFTA_CONNLIMIT_UNSPEC,
1233  	NFTA_CONNLIMIT_COUNT,
1234  	NFTA_CONNLIMIT_FLAGS,
1235  	__NFTA_CONNLIMIT_MAX
1236  };
1237  #define NFTA_CONNLIMIT_MAX	(__NFTA_CONNLIMIT_MAX - 1)
1238  
1239  /**
1240   * enum nft_counter_attributes - nf_tables counter expression netlink attributes
1241   *
1242   * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
1243   * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
1244   */
1245  enum nft_counter_attributes {
1246  	NFTA_COUNTER_UNSPEC,
1247  	NFTA_COUNTER_BYTES,
1248  	NFTA_COUNTER_PACKETS,
1249  	NFTA_COUNTER_PAD,
1250  	__NFTA_COUNTER_MAX
1251  };
1252  #define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)
1253  
1254  /**
1255   * enum nft_last_attributes - nf_tables last expression netlink attributes
1256   *
1257   * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
1258   * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
1259   */
1260  enum nft_last_attributes {
1261  	NFTA_LAST_UNSPEC,
1262  	NFTA_LAST_SET,
1263  	NFTA_LAST_MSECS,
1264  	NFTA_LAST_PAD,
1265  	__NFTA_LAST_MAX
1266  };
1267  #define NFTA_LAST_MAX	(__NFTA_LAST_MAX - 1)
1268  
1269  /**
1270   * enum nft_log_attributes - nf_tables log expression netlink attributes
1271   *
1272   * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U16)
1273   * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
1274   * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
1275   * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U16)
1276   * @NFTA_LOG_LEVEL: log level (NLA_U32)
1277   * @NFTA_LOG_FLAGS: logging flags (NLA_U32)
1278   */
1279  enum nft_log_attributes {
1280  	NFTA_LOG_UNSPEC,
1281  	NFTA_LOG_GROUP,
1282  	NFTA_LOG_PREFIX,
1283  	NFTA_LOG_SNAPLEN,
1284  	NFTA_LOG_QTHRESHOLD,
1285  	NFTA_LOG_LEVEL,
1286  	NFTA_LOG_FLAGS,
1287  	__NFTA_LOG_MAX
1288  };
1289  #define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)
1290  
1291  /**
1292   * enum nft_log_level - nf_tables log levels
1293   *
1294   * @NFT_LOGLEVEL_EMERG: system is unusable
1295   * @NFT_LOGLEVEL_ALERT: action must be taken immediately
1296   * @NFT_LOGLEVEL_CRIT: critical conditions
1297   * @NFT_LOGLEVEL_ERR: error conditions
1298   * @NFT_LOGLEVEL_WARNING: warning conditions
1299   * @NFT_LOGLEVEL_NOTICE: normal but significant condition
1300   * @NFT_LOGLEVEL_INFO: informational
1301   * @NFT_LOGLEVEL_DEBUG: debug-level messages
1302   * @NFT_LOGLEVEL_AUDIT: enabling audit logging
1303   */
1304  enum nft_log_level {
1305  	NFT_LOGLEVEL_EMERG,
1306  	NFT_LOGLEVEL_ALERT,
1307  	NFT_LOGLEVEL_CRIT,
1308  	NFT_LOGLEVEL_ERR,
1309  	NFT_LOGLEVEL_WARNING,
1310  	NFT_LOGLEVEL_NOTICE,
1311  	NFT_LOGLEVEL_INFO,
1312  	NFT_LOGLEVEL_DEBUG,
1313  	NFT_LOGLEVEL_AUDIT,
1314  	__NFT_LOGLEVEL_MAX
1315  };
1316  #define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
1317  
1318  /**
1319   * enum nft_queue_attributes - nf_tables queue expression netlink attributes
1320   *
1321   * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
1322   * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
1323   * @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
1324   * @NFTA_QUEUE_SREG_QNUM: source register of queue number (NLA_U32: nft_registers)
1325   */
1326  enum nft_queue_attributes {
1327  	NFTA_QUEUE_UNSPEC,
1328  	NFTA_QUEUE_NUM,
1329  	NFTA_QUEUE_TOTAL,
1330  	NFTA_QUEUE_FLAGS,
1331  	NFTA_QUEUE_SREG_QNUM,
1332  	__NFTA_QUEUE_MAX
1333  };
1334  #define NFTA_QUEUE_MAX		(__NFTA_QUEUE_MAX - 1)
1335  
1336  #define NFT_QUEUE_FLAG_BYPASS		0x01 /* for compatibility with v2 */
1337  #define NFT_QUEUE_FLAG_CPU_FANOUT	0x02 /* use current CPU (no hashing) */
1338  #define NFT_QUEUE_FLAG_MASK		0x03
1339  
1340  enum nft_quota_flags {
1341  	NFT_QUOTA_F_INV		= (1 << 0),
1342  	NFT_QUOTA_F_DEPLETED	= (1 << 1),
1343  };
1344  
1345  /**
1346   * enum nft_quota_attributes - nf_tables quota expression netlink attributes
1347   *
1348   * @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
1349   * @NFTA_QUOTA_FLAGS: flags (NLA_U32)
1350   * @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
1351   */
1352  enum nft_quota_attributes {
1353  	NFTA_QUOTA_UNSPEC,
1354  	NFTA_QUOTA_BYTES,
1355  	NFTA_QUOTA_FLAGS,
1356  	NFTA_QUOTA_PAD,
1357  	NFTA_QUOTA_CONSUMED,
1358  	__NFTA_QUOTA_MAX
1359  };
1360  #define NFTA_QUOTA_MAX		(__NFTA_QUOTA_MAX - 1)
1361  
1362  /**
1363   * enum nft_secmark_attributes - nf_tables secmark object netlink attributes
1364   *
1365   * @NFTA_SECMARK_CTX: security context (NLA_STRING)
1366   */
1367  enum nft_secmark_attributes {
1368  	NFTA_SECMARK_UNSPEC,
1369  	NFTA_SECMARK_CTX,
1370  	__NFTA_SECMARK_MAX,
1371  };
1372  #define NFTA_SECMARK_MAX	(__NFTA_SECMARK_MAX - 1)
1373  
1374  /* Max security context length */
1375  #define NFT_SECMARK_CTX_MAXLEN		4096
1376  
1377  /**
1378   * enum nft_reject_types - nf_tables reject expression reject types
1379   *
1380   * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
1381   * @NFT_REJECT_TCP_RST: reject using TCP RST
1382   * @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet
1383   */
1384  enum nft_reject_types {
1385  	NFT_REJECT_ICMP_UNREACH,
1386  	NFT_REJECT_TCP_RST,
1387  	NFT_REJECT_ICMPX_UNREACH,
1388  };
1389  
1390  /**
1391   * enum nft_reject_code - Generic reject codes for IPv4/IPv6
1392   *
1393   * @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable
1394   * @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
1395   * @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
1396   * @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited
1397   *
1398   * These codes are mapped to real ICMP and ICMPv6 codes.
1399   */
1400  enum nft_reject_inet_code {
1401  	NFT_REJECT_ICMPX_NO_ROUTE	= 0,
1402  	NFT_REJECT_ICMPX_PORT_UNREACH,
1403  	NFT_REJECT_ICMPX_HOST_UNREACH,
1404  	NFT_REJECT_ICMPX_ADMIN_PROHIBITED,
1405  	__NFT_REJECT_ICMPX_MAX
1406  };
1407  #define NFT_REJECT_ICMPX_MAX	(__NFT_REJECT_ICMPX_MAX - 1)
1408  
1409  /**
1410   * enum nft_reject_attributes - nf_tables reject expression netlink attributes
1411   *
1412   * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
1413   * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
1414   */
1415  enum nft_reject_attributes {
1416  	NFTA_REJECT_UNSPEC,
1417  	NFTA_REJECT_TYPE,
1418  	NFTA_REJECT_ICMP_CODE,
1419  	__NFTA_REJECT_MAX
1420  };
1421  #define NFTA_REJECT_MAX		(__NFTA_REJECT_MAX - 1)
1422  
1423  /**
1424   * enum nft_nat_types - nf_tables nat expression NAT types
1425   *
1426   * @NFT_NAT_SNAT: source NAT
1427   * @NFT_NAT_DNAT: destination NAT
1428   */
1429  enum nft_nat_types {
1430  	NFT_NAT_SNAT,
1431  	NFT_NAT_DNAT,
1432  };
1433  
1434  /**
1435   * enum nft_nat_attributes - nf_tables nat expression netlink attributes
1436   *
1437   * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
1438   * @NFTA_NAT_FAMILY: NAT family (NLA_U32)
1439   * @NFTA_NAT_REG_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
1440   * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
1441   * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
1442   * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
1443   * @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
1444   */
1445  enum nft_nat_attributes {
1446  	NFTA_NAT_UNSPEC,
1447  	NFTA_NAT_TYPE,
1448  	NFTA_NAT_FAMILY,
1449  	NFTA_NAT_REG_ADDR_MIN,
1450  	NFTA_NAT_REG_ADDR_MAX,
1451  	NFTA_NAT_REG_PROTO_MIN,
1452  	NFTA_NAT_REG_PROTO_MAX,
1453  	NFTA_NAT_FLAGS,
1454  	__NFTA_NAT_MAX
1455  };
1456  #define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)
1457  
1458  /**
1459   * enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
1460   *
1461   * NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
1462   * NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
1463   * NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
1464   */
1465  enum nft_tproxy_attributes {
1466  	NFTA_TPROXY_UNSPEC,
1467  	NFTA_TPROXY_FAMILY,
1468  	NFTA_TPROXY_REG_ADDR,
1469  	NFTA_TPROXY_REG_PORT,
1470  	__NFTA_TPROXY_MAX
1471  };
1472  #define NFTA_TPROXY_MAX		(__NFTA_TPROXY_MAX - 1)
1473  
1474  /**
1475   * enum nft_masq_attributes - nf_tables masquerade expression attributes
1476   *
1477   * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
1478   * @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
1479   * @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
1480   */
1481  enum nft_masq_attributes {
1482  	NFTA_MASQ_UNSPEC,
1483  	NFTA_MASQ_FLAGS,
1484  	NFTA_MASQ_REG_PROTO_MIN,
1485  	NFTA_MASQ_REG_PROTO_MAX,
1486  	__NFTA_MASQ_MAX
1487  };
1488  #define NFTA_MASQ_MAX		(__NFTA_MASQ_MAX - 1)
1489  
1490  /**
1491   * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
1492   *
1493   * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
1494   * @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
1495   * @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
1496   */
1497  enum nft_redir_attributes {
1498  	NFTA_REDIR_UNSPEC,
1499  	NFTA_REDIR_REG_PROTO_MIN,
1500  	NFTA_REDIR_REG_PROTO_MAX,
1501  	NFTA_REDIR_FLAGS,
1502  	__NFTA_REDIR_MAX
1503  };
1504  #define NFTA_REDIR_MAX		(__NFTA_REDIR_MAX - 1)
1505  
1506  /**
1507   * enum nft_dup_attributes - nf_tables dup expression netlink attributes
1508   *
1509   * @NFTA_DUP_SREG_ADDR: source register of address (NLA_U32: nft_registers)
1510   * @NFTA_DUP_SREG_DEV: source register of output interface (NLA_U32: nft_register)
1511   */
1512  enum nft_dup_attributes {
1513  	NFTA_DUP_UNSPEC,
1514  	NFTA_DUP_SREG_ADDR,
1515  	NFTA_DUP_SREG_DEV,
1516  	__NFTA_DUP_MAX
1517  };
1518  #define NFTA_DUP_MAX		(__NFTA_DUP_MAX - 1)
1519  
1520  /**
1521   * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
1522   *
1523   * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
1524   * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register)
1525   * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto)
1526   */
1527  enum nft_fwd_attributes {
1528  	NFTA_FWD_UNSPEC,
1529  	NFTA_FWD_SREG_DEV,
1530  	NFTA_FWD_SREG_ADDR,
1531  	NFTA_FWD_NFPROTO,
1532  	__NFTA_FWD_MAX
1533  };
1534  #define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)
1535  
1536  /**
1537   * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
1538   *
1539   * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
1540   * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
1541   * @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
1542   * @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
1543   * @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
1544   */
1545  enum nft_objref_attributes {
1546  	NFTA_OBJREF_UNSPEC,
1547  	NFTA_OBJREF_IMM_TYPE,
1548  	NFTA_OBJREF_IMM_NAME,
1549  	NFTA_OBJREF_SET_SREG,
1550  	NFTA_OBJREF_SET_NAME,
1551  	NFTA_OBJREF_SET_ID,
1552  	__NFTA_OBJREF_MAX
1553  };
1554  #define NFTA_OBJREF_MAX	(__NFTA_OBJREF_MAX - 1)
1555  
1556  /**
1557   * enum nft_gen_attributes - nf_tables ruleset generation attributes
1558   *
1559   * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
1560   */
1561  enum nft_gen_attributes {
1562  	NFTA_GEN_UNSPEC,
1563  	NFTA_GEN_ID,
1564  	NFTA_GEN_PROC_PID,
1565  	NFTA_GEN_PROC_NAME,
1566  	__NFTA_GEN_MAX
1567  };
1568  #define NFTA_GEN_MAX		(__NFTA_GEN_MAX - 1)
1569  
1570  /*
1571   * enum nft_fib_attributes - nf_tables fib expression netlink attributes
1572   *
1573   * @NFTA_FIB_DREG: destination register (NLA_U32)
1574   * @NFTA_FIB_RESULT: desired result (NLA_U32)
1575   * @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)
1576   *
1577   * The FIB expression performs a route lookup according
1578   * to the packet data.
1579   */
1580  enum nft_fib_attributes {
1581  	NFTA_FIB_UNSPEC,
1582  	NFTA_FIB_DREG,
1583  	NFTA_FIB_RESULT,
1584  	NFTA_FIB_FLAGS,
1585  	__NFTA_FIB_MAX
1586  };
1587  #define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)
1588  
1589  enum nft_fib_result {
1590  	NFT_FIB_RESULT_UNSPEC,
1591  	NFT_FIB_RESULT_OIF,
1592  	NFT_FIB_RESULT_OIFNAME,
1593  	NFT_FIB_RESULT_ADDRTYPE,
1594  	__NFT_FIB_RESULT_MAX
1595  };
1596  #define NFT_FIB_RESULT_MAX	(__NFT_FIB_RESULT_MAX - 1)
1597  
1598  enum nft_fib_flags {
1599  	NFTA_FIB_F_SADDR	= 1 << 0,	/* look up src */
1600  	NFTA_FIB_F_DADDR	= 1 << 1,	/* look up dst */
1601  	NFTA_FIB_F_MARK		= 1 << 2,	/* use skb->mark */
1602  	NFTA_FIB_F_IIF		= 1 << 3,	/* restrict to iif */
1603  	NFTA_FIB_F_OIF		= 1 << 4,	/* restrict to oif */
1604  	NFTA_FIB_F_PRESENT	= 1 << 5,	/* check existence only */
1605  };
1606  
1607  enum nft_ct_helper_attributes {
1608  	NFTA_CT_HELPER_UNSPEC,
1609  	NFTA_CT_HELPER_NAME,
1610  	NFTA_CT_HELPER_L3PROTO,
1611  	NFTA_CT_HELPER_L4PROTO,
1612  	__NFTA_CT_HELPER_MAX,
1613  };
1614  #define NFTA_CT_HELPER_MAX	(__NFTA_CT_HELPER_MAX - 1)
1615  
1616  enum nft_ct_timeout_timeout_attributes {
1617  	NFTA_CT_TIMEOUT_UNSPEC,
1618  	NFTA_CT_TIMEOUT_L3PROTO,
1619  	NFTA_CT_TIMEOUT_L4PROTO,
1620  	NFTA_CT_TIMEOUT_DATA,
1621  	__NFTA_CT_TIMEOUT_MAX,
1622  };
1623  #define NFTA_CT_TIMEOUT_MAX	(__NFTA_CT_TIMEOUT_MAX - 1)
1624  
1625  enum nft_ct_expectation_attributes {
1626  	NFTA_CT_EXPECT_UNSPEC,
1627  	NFTA_CT_EXPECT_L3PROTO,
1628  	NFTA_CT_EXPECT_L4PROTO,
1629  	NFTA_CT_EXPECT_DPORT,
1630  	NFTA_CT_EXPECT_TIMEOUT,
1631  	NFTA_CT_EXPECT_SIZE,
1632  	__NFTA_CT_EXPECT_MAX,
1633  };
1634  #define NFTA_CT_EXPECT_MAX	(__NFTA_CT_EXPECT_MAX - 1)
1635  
1636  #define NFT_OBJECT_UNSPEC	0
1637  #define NFT_OBJECT_COUNTER	1
1638  #define NFT_OBJECT_QUOTA	2
1639  #define NFT_OBJECT_CT_HELPER	3
1640  #define NFT_OBJECT_LIMIT	4
1641  #define NFT_OBJECT_CONNLIMIT	5
1642  #define NFT_OBJECT_TUNNEL	6
1643  #define NFT_OBJECT_CT_TIMEOUT	7
1644  #define NFT_OBJECT_SECMARK	8
1645  #define NFT_OBJECT_CT_EXPECT	9
1646  #define NFT_OBJECT_SYNPROXY	10
1647  #define __NFT_OBJECT_MAX	11
1648  #define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
1649  
1650  /**
1651   * enum nft_object_attributes - nf_tables stateful object netlink attributes
1652   *
1653   * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
1654   * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
1655   * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
1656   * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
1657   * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
1658   * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
1659   * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
1660   */
1661  enum nft_object_attributes {
1662  	NFTA_OBJ_UNSPEC,
1663  	NFTA_OBJ_TABLE,
1664  	NFTA_OBJ_NAME,
1665  	NFTA_OBJ_TYPE,
1666  	NFTA_OBJ_DATA,
1667  	NFTA_OBJ_USE,
1668  	NFTA_OBJ_HANDLE,
1669  	NFTA_OBJ_PAD,
1670  	NFTA_OBJ_USERDATA,
1671  	__NFTA_OBJ_MAX
1672  };
1673  #define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
1674  
1675  /**
1676   * enum nft_flowtable_flags - nf_tables flowtable flags
1677   *
1678   * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
1679   * @NFT_FLOWTABLE_COUNTER: enable flow counters
1680   */
1681  enum nft_flowtable_flags {
1682  	NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
1683  	NFT_FLOWTABLE_COUNTER		= 0x2,
1684  	NFT_FLOWTABLE_MASK		= (NFT_FLOWTABLE_HW_OFFLOAD |
1685  					   NFT_FLOWTABLE_COUNTER)
1686  };
1687  
1688  /**
1689   * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
1690   *
1691   * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
1692   * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
1693   * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED)
1694   * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
1695   * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
1696   * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
1697   */
1698  enum nft_flowtable_attributes {
1699  	NFTA_FLOWTABLE_UNSPEC,
1700  	NFTA_FLOWTABLE_TABLE,
1701  	NFTA_FLOWTABLE_NAME,
1702  	NFTA_FLOWTABLE_HOOK,
1703  	NFTA_FLOWTABLE_USE,
1704  	NFTA_FLOWTABLE_HANDLE,
1705  	NFTA_FLOWTABLE_PAD,
1706  	NFTA_FLOWTABLE_FLAGS,
1707  	__NFTA_FLOWTABLE_MAX
1708  };
1709  #define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
1710  
1711  /**
1712   * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
1713   *
1714   * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
1715   * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
1716   * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
1717   */
1718  enum nft_flowtable_hook_attributes {
1719  	NFTA_FLOWTABLE_HOOK_UNSPEC,
1720  	NFTA_FLOWTABLE_HOOK_NUM,
1721  	NFTA_FLOWTABLE_HOOK_PRIORITY,
1722  	NFTA_FLOWTABLE_HOOK_DEVS,
1723  	__NFTA_FLOWTABLE_HOOK_MAX
1724  };
1725  #define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
1726  
1727  /**
1728   * enum nft_osf_attributes - nftables osf expression netlink attributes
1729   *
1730   * @NFTA_OSF_DREG: destination register (NLA_U32: nft_registers)
1731   * @NFTA_OSF_TTL: Value of the TTL osf option (NLA_U8)
1732   * @NFTA_OSF_FLAGS: flags (NLA_U32)
1733   */
1734  enum nft_osf_attributes {
1735  	NFTA_OSF_UNSPEC,
1736  	NFTA_OSF_DREG,
1737  	NFTA_OSF_TTL,
1738  	NFTA_OSF_FLAGS,
1739  	__NFTA_OSF_MAX,
1740  };
1741  #define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1)
1742  
1743  enum nft_osf_flags {
1744  	NFT_OSF_F_VERSION = (1 << 0),
1745  };
1746  
1747  /**
1748   * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
1749   *
1750   * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
1751   * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
1752   * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
1753   */
1754  enum nft_synproxy_attributes {
1755  	NFTA_SYNPROXY_UNSPEC,
1756  	NFTA_SYNPROXY_MSS,
1757  	NFTA_SYNPROXY_WSCALE,
1758  	NFTA_SYNPROXY_FLAGS,
1759  	__NFTA_SYNPROXY_MAX,
1760  };
1761  #define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
1762  
1763  /**
1764   * enum nft_device_attributes - nf_tables device netlink attributes
1765   *
1766   * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
1767   */
1768  enum nft_devices_attributes {
1769  	NFTA_DEVICE_UNSPEC,
1770  	NFTA_DEVICE_NAME,
1771  	__NFTA_DEVICE_MAX
1772  };
1773  #define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)
1774  
1775  /*
1776   * enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
1777   *
1778   * @NFTA_XFRM_DREG: destination register (NLA_U32)
1779   * @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
1780   * @NFTA_XFRM_DIR: direction (NLA_U8)
1781   * @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
1782   */
1783  enum nft_xfrm_attributes {
1784  	NFTA_XFRM_UNSPEC,
1785  	NFTA_XFRM_DREG,
1786  	NFTA_XFRM_KEY,
1787  	NFTA_XFRM_DIR,
1788  	NFTA_XFRM_SPNUM,
1789  	__NFTA_XFRM_MAX
1790  };
1791  #define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
1792  
1793  enum nft_xfrm_keys {
1794  	NFT_XFRM_KEY_UNSPEC,
1795  	NFT_XFRM_KEY_DADDR_IP4,
1796  	NFT_XFRM_KEY_DADDR_IP6,
1797  	NFT_XFRM_KEY_SADDR_IP4,
1798  	NFT_XFRM_KEY_SADDR_IP6,
1799  	NFT_XFRM_KEY_REQID,
1800  	NFT_XFRM_KEY_SPI,
1801  	__NFT_XFRM_KEY_MAX,
1802  };
1803  #define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
1804  
1805  /**
1806   * enum nft_trace_attributes - nf_tables trace netlink attributes
1807   *
1808   * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
1809   * @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)
1810   * @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)
1811   * @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)
1812   * @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)
1813   * @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)
1814   * @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)
1815   * @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)
1816   * @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)
1817   * @NFTA_TRACE_IIF: indev ifindex (NLA_U32)
1818   * @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)
1819   * @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)
1820   * @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)
1821   * @NFTA_TRACE_MARK: nfmark (NLA_U32)
1822   * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
1823   * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
1824   */
1825  enum nft_trace_attributes {
1826  	NFTA_TRACE_UNSPEC,
1827  	NFTA_TRACE_TABLE,
1828  	NFTA_TRACE_CHAIN,
1829  	NFTA_TRACE_RULE_HANDLE,
1830  	NFTA_TRACE_TYPE,
1831  	NFTA_TRACE_VERDICT,
1832  	NFTA_TRACE_ID,
1833  	NFTA_TRACE_LL_HEADER,
1834  	NFTA_TRACE_NETWORK_HEADER,
1835  	NFTA_TRACE_TRANSPORT_HEADER,
1836  	NFTA_TRACE_IIF,
1837  	NFTA_TRACE_IIFTYPE,
1838  	NFTA_TRACE_OIF,
1839  	NFTA_TRACE_OIFTYPE,
1840  	NFTA_TRACE_MARK,
1841  	NFTA_TRACE_NFPROTO,
1842  	NFTA_TRACE_POLICY,
1843  	NFTA_TRACE_PAD,
1844  	__NFTA_TRACE_MAX
1845  };
1846  #define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
1847  
1848  enum nft_trace_types {
1849  	NFT_TRACETYPE_UNSPEC,
1850  	NFT_TRACETYPE_POLICY,
1851  	NFT_TRACETYPE_RETURN,
1852  	NFT_TRACETYPE_RULE,
1853  	__NFT_TRACETYPE_MAX
1854  };
1855  #define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
1856  
1857  /**
1858   * enum nft_ng_attributes - nf_tables number generator expression netlink attributes
1859   *
1860   * @NFTA_NG_DREG: destination register (NLA_U32)
1861   * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
1862   * @NFTA_NG_TYPE: operation type (NLA_U32)
1863   * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
1864   * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
1865   * @NFTA_NG_SET_ID: id of the map (NLA_U32)
1866   */
1867  enum nft_ng_attributes {
1868  	NFTA_NG_UNSPEC,
1869  	NFTA_NG_DREG,
1870  	NFTA_NG_MODULUS,
1871  	NFTA_NG_TYPE,
1872  	NFTA_NG_OFFSET,
1873  	NFTA_NG_SET_NAME,	/* deprecated */
1874  	NFTA_NG_SET_ID,		/* deprecated */
1875  	__NFTA_NG_MAX
1876  };
1877  #define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
1878  
1879  enum nft_ng_types {
1880  	NFT_NG_INCREMENTAL,
1881  	NFT_NG_RANDOM,
1882  	__NFT_NG_MAX
1883  };
1884  #define NFT_NG_MAX	(__NFT_NG_MAX - 1)
1885  
1886  enum nft_tunnel_key_ip_attributes {
1887  	NFTA_TUNNEL_KEY_IP_UNSPEC,
1888  	NFTA_TUNNEL_KEY_IP_SRC,
1889  	NFTA_TUNNEL_KEY_IP_DST,
1890  	__NFTA_TUNNEL_KEY_IP_MAX
1891  };
1892  #define NFTA_TUNNEL_KEY_IP_MAX	(__NFTA_TUNNEL_KEY_IP_MAX - 1)
1893  
1894  enum nft_tunnel_ip6_attributes {
1895  	NFTA_TUNNEL_KEY_IP6_UNSPEC,
1896  	NFTA_TUNNEL_KEY_IP6_SRC,
1897  	NFTA_TUNNEL_KEY_IP6_DST,
1898  	NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
1899  	__NFTA_TUNNEL_KEY_IP6_MAX
1900  };
1901  #define NFTA_TUNNEL_KEY_IP6_MAX	(__NFTA_TUNNEL_KEY_IP6_MAX - 1)
1902  
1903  enum nft_tunnel_opts_attributes {
1904  	NFTA_TUNNEL_KEY_OPTS_UNSPEC,
1905  	NFTA_TUNNEL_KEY_OPTS_VXLAN,
1906  	NFTA_TUNNEL_KEY_OPTS_ERSPAN,
1907  	NFTA_TUNNEL_KEY_OPTS_GENEVE,
1908  	__NFTA_TUNNEL_KEY_OPTS_MAX
1909  };
1910  #define NFTA_TUNNEL_KEY_OPTS_MAX	(__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
1911  
1912  enum nft_tunnel_opts_vxlan_attributes {
1913  	NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
1914  	NFTA_TUNNEL_KEY_VXLAN_GBP,
1915  	__NFTA_TUNNEL_KEY_VXLAN_MAX
1916  };
1917  #define NFTA_TUNNEL_KEY_VXLAN_MAX	(__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
1918  
1919  enum nft_tunnel_opts_erspan_attributes {
1920  	NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
1921  	NFTA_TUNNEL_KEY_ERSPAN_VERSION,
1922  	NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
1923  	NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
1924  	NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
1925  	__NFTA_TUNNEL_KEY_ERSPAN_MAX
1926  };
1927  #define NFTA_TUNNEL_KEY_ERSPAN_MAX	(__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
1928  
1929  enum nft_tunnel_opts_geneve_attributes {
1930  	NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
1931  	NFTA_TUNNEL_KEY_GENEVE_CLASS,
1932  	NFTA_TUNNEL_KEY_GENEVE_TYPE,
1933  	NFTA_TUNNEL_KEY_GENEVE_DATA,
1934  	__NFTA_TUNNEL_KEY_GENEVE_MAX
1935  };
1936  #define NFTA_TUNNEL_KEY_GENEVE_MAX	(__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
1937  
1938  enum nft_tunnel_flags {
1939  	NFT_TUNNEL_F_ZERO_CSUM_TX	= (1 << 0),
1940  	NFT_TUNNEL_F_DONT_FRAGMENT	= (1 << 1),
1941  	NFT_TUNNEL_F_SEQ_NUMBER		= (1 << 2),
1942  };
1943  #define NFT_TUNNEL_F_MASK	(NFT_TUNNEL_F_ZERO_CSUM_TX | \
1944  				 NFT_TUNNEL_F_DONT_FRAGMENT | \
1945  				 NFT_TUNNEL_F_SEQ_NUMBER)
1946  
1947  enum nft_tunnel_key_attributes {
1948  	NFTA_TUNNEL_KEY_UNSPEC,
1949  	NFTA_TUNNEL_KEY_ID,
1950  	NFTA_TUNNEL_KEY_IP,
1951  	NFTA_TUNNEL_KEY_IP6,
1952  	NFTA_TUNNEL_KEY_FLAGS,
1953  	NFTA_TUNNEL_KEY_TOS,
1954  	NFTA_TUNNEL_KEY_TTL,
1955  	NFTA_TUNNEL_KEY_SPORT,
1956  	NFTA_TUNNEL_KEY_DPORT,
1957  	NFTA_TUNNEL_KEY_OPTS,
1958  	__NFTA_TUNNEL_KEY_MAX
1959  };
1960  #define NFTA_TUNNEL_KEY_MAX	(__NFTA_TUNNEL_KEY_MAX - 1)
1961  
1962  enum nft_tunnel_keys {
1963  	NFT_TUNNEL_PATH,
1964  	NFT_TUNNEL_ID,
1965  	__NFT_TUNNEL_MAX
1966  };
1967  #define NFT_TUNNEL_MAX	(__NFT_TUNNEL_MAX - 1)
1968  
1969  enum nft_tunnel_mode {
1970  	NFT_TUNNEL_MODE_NONE,
1971  	NFT_TUNNEL_MODE_RX,
1972  	NFT_TUNNEL_MODE_TX,
1973  	__NFT_TUNNEL_MODE_MAX
1974  };
1975  #define NFT_TUNNEL_MODE_MAX	(__NFT_TUNNEL_MODE_MAX - 1)
1976  
1977  enum nft_tunnel_attributes {
1978  	NFTA_TUNNEL_UNSPEC,
1979  	NFTA_TUNNEL_KEY,
1980  	NFTA_TUNNEL_DREG,
1981  	NFTA_TUNNEL_MODE,
1982  	__NFTA_TUNNEL_MAX
1983  };
1984  #define NFTA_TUNNEL_MAX	(__NFTA_TUNNEL_MAX - 1)
1985  
1986  #endif /* _LINUX_NF_TABLES_H */
1987