logo

oasis-root

Compiled tree of Oasis Linux based on own branch at <https://hacktivis.me/git/oasis/> git clone https://anongit.hacktivis.me/git/oasis-root.git

nf_tables.h (58448B)


  1. /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
  2. #ifndef _LINUX_NF_TABLES_H
  3. #define _LINUX_NF_TABLES_H
  4. #define NFT_NAME_MAXLEN 256
  5. #define NFT_TABLE_MAXNAMELEN NFT_NAME_MAXLEN
  6. #define NFT_CHAIN_MAXNAMELEN NFT_NAME_MAXLEN
  7. #define NFT_SET_MAXNAMELEN NFT_NAME_MAXLEN
  8. #define NFT_OBJ_MAXNAMELEN NFT_NAME_MAXLEN
  9. #define NFT_USERDATA_MAXLEN 256
  10. #define NFT_OSF_MAXGENRELEN 16
  11. /**
  12. * enum nft_registers - nf_tables registers
  13. *
  14. * nf_tables used to have five registers: a verdict register and four data
  15. * registers of size 16. The data registers have been changed to 16 registers
  16. * of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
  17. * map to areas of size 16, the 4 byte registers are addressed using
  18. * NFT_REG32_00 - NFT_REG32_15.
  19. */
  20. enum nft_registers {
  21. NFT_REG_VERDICT,
  22. NFT_REG_1,
  23. NFT_REG_2,
  24. NFT_REG_3,
  25. NFT_REG_4,
  26. __NFT_REG_MAX,
  27. NFT_REG32_00 = 8,
  28. NFT_REG32_01,
  29. NFT_REG32_02,
  30. NFT_REG32_03,
  31. NFT_REG32_04,
  32. NFT_REG32_05,
  33. NFT_REG32_06,
  34. NFT_REG32_07,
  35. NFT_REG32_08,
  36. NFT_REG32_09,
  37. NFT_REG32_10,
  38. NFT_REG32_11,
  39. NFT_REG32_12,
  40. NFT_REG32_13,
  41. NFT_REG32_14,
  42. NFT_REG32_15,
  43. };
  44. #define NFT_REG_MAX (__NFT_REG_MAX - 1)
  45. #define NFT_REG_SIZE 16
  46. #define NFT_REG32_SIZE 4
  47. #define NFT_REG32_COUNT (NFT_REG32_15 - NFT_REG32_00 + 1)
  48. /**
  49. * enum nft_verdicts - nf_tables internal verdicts
  50. *
  51. * @NFT_CONTINUE: continue evaluation of the current rule
  52. * @NFT_BREAK: terminate evaluation of the current rule
  53. * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
  54. * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
  55. * @NFT_RETURN: return to the topmost chain on the jump stack
  56. *
  57. * The nf_tables verdicts share their numeric space with the netfilter verdicts.
  58. */
  59. enum nft_verdicts {
  60. NFT_CONTINUE = -1,
  61. NFT_BREAK = -2,
  62. NFT_JUMP = -3,
  63. NFT_GOTO = -4,
  64. NFT_RETURN = -5,
  65. };
  66. /**
  67. * enum nf_tables_msg_types - nf_tables netlink message types
  68. *
  69. * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
  70. * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
  71. * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
  72. * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
  73. * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
  74. * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
  75. * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
  76. * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
  77. * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
  78. * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
  79. * @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
  80. * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
  81. * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
  82. * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
  83. * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
  84. * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
  85. * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
  86. * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
  87. * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
  88. * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
  89. * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
  90. * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
  91. * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
  92. * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
  93. * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
  94. * @NFT_MSG_GETRULE_RESET: get rules and reset stateful expressions (enum nft_obj_attributes)
  95. * @NFT_MSG_DESTROYTABLE: destroy a table (enum nft_table_attributes)
  96. * @NFT_MSG_DESTROYCHAIN: destroy a chain (enum nft_chain_attributes)
  97. * @NFT_MSG_DESTROYRULE: destroy a rule (enum nft_rule_attributes)
  98. * @NFT_MSG_DESTROYSET: destroy a set (enum nft_set_attributes)
  99. * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)
  100. * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)
  101. * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)
  102. * @NFT_MSG_GETSETELEM_RESET: get set elements and reset attached stateful expressions (enum nft_set_elem_attributes)
  103. */
  104. enum nf_tables_msg_types {
  105. NFT_MSG_NEWTABLE,
  106. NFT_MSG_GETTABLE,
  107. NFT_MSG_DELTABLE,
  108. NFT_MSG_NEWCHAIN,
  109. NFT_MSG_GETCHAIN,
  110. NFT_MSG_DELCHAIN,
  111. NFT_MSG_NEWRULE,
  112. NFT_MSG_GETRULE,
  113. NFT_MSG_DELRULE,
  114. NFT_MSG_NEWSET,
  115. NFT_MSG_GETSET,
  116. NFT_MSG_DELSET,
  117. NFT_MSG_NEWSETELEM,
  118. NFT_MSG_GETSETELEM,
  119. NFT_MSG_DELSETELEM,
  120. NFT_MSG_NEWGEN,
  121. NFT_MSG_GETGEN,
  122. NFT_MSG_TRACE,
  123. NFT_MSG_NEWOBJ,
  124. NFT_MSG_GETOBJ,
  125. NFT_MSG_DELOBJ,
  126. NFT_MSG_GETOBJ_RESET,
  127. NFT_MSG_NEWFLOWTABLE,
  128. NFT_MSG_GETFLOWTABLE,
  129. NFT_MSG_DELFLOWTABLE,
  130. NFT_MSG_GETRULE_RESET,
  131. NFT_MSG_DESTROYTABLE,
  132. NFT_MSG_DESTROYCHAIN,
  133. NFT_MSG_DESTROYRULE,
  134. NFT_MSG_DESTROYSET,
  135. NFT_MSG_DESTROYSETELEM,
  136. NFT_MSG_DESTROYOBJ,
  137. NFT_MSG_DESTROYFLOWTABLE,
  138. NFT_MSG_GETSETELEM_RESET,
  139. NFT_MSG_MAX,
  140. };
  141. /**
  142. * enum nft_list_attributes - nf_tables generic list netlink attributes
  143. *
  144. * @NFTA_LIST_ELEM: list element (NLA_NESTED)
  145. */
  146. enum nft_list_attributes {
  147. NFTA_LIST_UNSPEC,
  148. NFTA_LIST_ELEM,
  149. __NFTA_LIST_MAX
  150. };
  151. #define NFTA_LIST_MAX (__NFTA_LIST_MAX - 1)
  152. /**
  153. * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
  154. *
  155. * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
  156. * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
  157. * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
  158. * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
  159. */
  160. enum nft_hook_attributes {
  161. NFTA_HOOK_UNSPEC,
  162. NFTA_HOOK_HOOKNUM,
  163. NFTA_HOOK_PRIORITY,
  164. NFTA_HOOK_DEV,
  165. NFTA_HOOK_DEVS,
  166. __NFTA_HOOK_MAX
  167. };
  168. #define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
  169. /**
  170. * enum nft_table_flags - nf_tables table flags
  171. *
  172. * @NFT_TABLE_F_DORMANT: this table is not active
  173. * @NFT_TABLE_F_OWNER: this table is owned by a process
  174. * @NFT_TABLE_F_PERSIST: this table shall outlive its owner
  175. */
  176. enum nft_table_flags {
  177. NFT_TABLE_F_DORMANT = 0x1,
  178. NFT_TABLE_F_OWNER = 0x2,
  179. NFT_TABLE_F_PERSIST = 0x4,
  180. };
  181. #define NFT_TABLE_F_MASK (NFT_TABLE_F_DORMANT | \
  182. NFT_TABLE_F_OWNER | \
  183. NFT_TABLE_F_PERSIST)
  184. /**
  185. * enum nft_table_attributes - nf_tables table netlink attributes
  186. *
  187. * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
  188. * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
  189. * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
  190. * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
  191. * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
  192. */
  193. enum nft_table_attributes {
  194. NFTA_TABLE_UNSPEC,
  195. NFTA_TABLE_NAME,
  196. NFTA_TABLE_FLAGS,
  197. NFTA_TABLE_USE,
  198. NFTA_TABLE_HANDLE,
  199. NFTA_TABLE_PAD,
  200. NFTA_TABLE_USERDATA,
  201. NFTA_TABLE_OWNER,
  202. __NFTA_TABLE_MAX
  203. };
  204. #define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
  205. enum nft_chain_flags {
  206. NFT_CHAIN_BASE = (1 << 0),
  207. NFT_CHAIN_HW_OFFLOAD = (1 << 1),
  208. NFT_CHAIN_BINDING = (1 << 2),
  209. };
  210. #define NFT_CHAIN_FLAGS (NFT_CHAIN_BASE | \
  211. NFT_CHAIN_HW_OFFLOAD | \
  212. NFT_CHAIN_BINDING)
  213. /**
  214. * enum nft_chain_attributes - nf_tables chain netlink attributes
  215. *
  216. * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
  217. * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
  218. * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
  219. * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
  220. * @NFTA_CHAIN_POLICY: numeric policy of the chain (NLA_U32)
  221. * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
  222. * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
  223. * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
  224. * @NFTA_CHAIN_FLAGS: chain flags
  225. * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
  226. * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
  227. */
  228. enum nft_chain_attributes {
  229. NFTA_CHAIN_UNSPEC,
  230. NFTA_CHAIN_TABLE,
  231. NFTA_CHAIN_HANDLE,
  232. NFTA_CHAIN_NAME,
  233. NFTA_CHAIN_HOOK,
  234. NFTA_CHAIN_POLICY,
  235. NFTA_CHAIN_USE,
  236. NFTA_CHAIN_TYPE,
  237. NFTA_CHAIN_COUNTERS,
  238. NFTA_CHAIN_PAD,
  239. NFTA_CHAIN_FLAGS,
  240. NFTA_CHAIN_ID,
  241. NFTA_CHAIN_USERDATA,
  242. __NFTA_CHAIN_MAX
  243. };
  244. #define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
  245. /**
  246. * enum nft_rule_attributes - nf_tables rule netlink attributes
  247. *
  248. * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
  249. * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
  250. * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
  251. * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
  252. * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
  253. * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
  254. * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
  255. * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
  256. * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
  257. * @NFTA_RULE_CHAIN_ID: add the rule to chain by ID, alternative to @NFTA_RULE_CHAIN (NLA_U32)
  258. */
  259. enum nft_rule_attributes {
  260. NFTA_RULE_UNSPEC,
  261. NFTA_RULE_TABLE,
  262. NFTA_RULE_CHAIN,
  263. NFTA_RULE_HANDLE,
  264. NFTA_RULE_EXPRESSIONS,
  265. NFTA_RULE_COMPAT,
  266. NFTA_RULE_POSITION,
  267. NFTA_RULE_USERDATA,
  268. NFTA_RULE_PAD,
  269. NFTA_RULE_ID,
  270. NFTA_RULE_POSITION_ID,
  271. NFTA_RULE_CHAIN_ID,
  272. __NFTA_RULE_MAX
  273. };
  274. #define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
  275. /**
  276. * enum nft_rule_compat_flags - nf_tables rule compat flags
  277. *
  278. * @NFT_RULE_COMPAT_F_UNUSED: unused
  279. * @NFT_RULE_COMPAT_F_INV: invert the check result
  280. */
  281. enum nft_rule_compat_flags {
  282. NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
  283. NFT_RULE_COMPAT_F_INV = (1 << 1),
  284. NFT_RULE_COMPAT_F_MASK = NFT_RULE_COMPAT_F_INV,
  285. };
  286. /**
  287. * enum nft_rule_compat_attributes - nf_tables rule compat attributes
  288. *
  289. * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
  290. * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
  291. */
  292. enum nft_rule_compat_attributes {
  293. NFTA_RULE_COMPAT_UNSPEC,
  294. NFTA_RULE_COMPAT_PROTO,
  295. NFTA_RULE_COMPAT_FLAGS,
  296. __NFTA_RULE_COMPAT_MAX
  297. };
  298. #define NFTA_RULE_COMPAT_MAX (__NFTA_RULE_COMPAT_MAX - 1)
  299. /**
  300. * enum nft_set_flags - nf_tables set flags
  301. *
  302. * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
  303. * @NFT_SET_CONSTANT: set contents may not change while bound
  304. * @NFT_SET_INTERVAL: set contains intervals
  305. * @NFT_SET_MAP: set is used as a dictionary
  306. * @NFT_SET_TIMEOUT: set uses timeouts
  307. * @NFT_SET_EVAL: set can be updated from the evaluation path
  308. * @NFT_SET_OBJECT: set contains stateful objects
  309. * @NFT_SET_CONCAT: set contains a concatenation
  310. * @NFT_SET_EXPR: set contains expressions
  311. */
  312. enum nft_set_flags {
  313. NFT_SET_ANONYMOUS = 0x1,
  314. NFT_SET_CONSTANT = 0x2,
  315. NFT_SET_INTERVAL = 0x4,
  316. NFT_SET_MAP = 0x8,
  317. NFT_SET_TIMEOUT = 0x10,
  318. NFT_SET_EVAL = 0x20,
  319. NFT_SET_OBJECT = 0x40,
  320. NFT_SET_CONCAT = 0x80,
  321. NFT_SET_EXPR = 0x100,
  322. };
  323. /**
  324. * enum nft_set_policies - set selection policy
  325. *
  326. * @NFT_SET_POL_PERFORMANCE: prefer high performance over low memory use
  327. * @NFT_SET_POL_MEMORY: prefer low memory use over high performance
  328. */
  329. enum nft_set_policies {
  330. NFT_SET_POL_PERFORMANCE,
  331. NFT_SET_POL_MEMORY,
  332. };
  333. /**
  334. * enum nft_set_desc_attributes - set element description
  335. *
  336. * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
  337. * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
  338. */
  339. enum nft_set_desc_attributes {
  340. NFTA_SET_DESC_UNSPEC,
  341. NFTA_SET_DESC_SIZE,
  342. NFTA_SET_DESC_CONCAT,
  343. __NFTA_SET_DESC_MAX
  344. };
  345. #define NFTA_SET_DESC_MAX (__NFTA_SET_DESC_MAX - 1)
  346. /**
  347. * enum nft_set_field_attributes - attributes of concatenated fields
  348. *
  349. * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
  350. */
  351. enum nft_set_field_attributes {
  352. NFTA_SET_FIELD_UNSPEC,
  353. NFTA_SET_FIELD_LEN,
  354. __NFTA_SET_FIELD_MAX
  355. };
  356. #define NFTA_SET_FIELD_MAX (__NFTA_SET_FIELD_MAX - 1)
  357. /**
  358. * enum nft_set_attributes - nf_tables set netlink attributes
  359. *
  360. * @NFTA_SET_TABLE: table name (NLA_STRING)
  361. * @NFTA_SET_NAME: set name (NLA_STRING)
  362. * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
  363. * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
  364. * @NFTA_SET_KEY_LEN: key data length (NLA_U32)
  365. * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
  366. * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
  367. * @NFTA_SET_POLICY: selection policy (NLA_U32)
  368. * @NFTA_SET_DESC: set description (NLA_NESTED)
  369. * @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
  370. * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
  371. * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
  372. * @NFTA_SET_USERDATA: user data (NLA_BINARY)
  373. * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
  374. * @NFTA_SET_HANDLE: set handle (NLA_U64)
  375. * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
  376. * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
  377. */
  378. enum nft_set_attributes {
  379. NFTA_SET_UNSPEC,
  380. NFTA_SET_TABLE,
  381. NFTA_SET_NAME,
  382. NFTA_SET_FLAGS,
  383. NFTA_SET_KEY_TYPE,
  384. NFTA_SET_KEY_LEN,
  385. NFTA_SET_DATA_TYPE,
  386. NFTA_SET_DATA_LEN,
  387. NFTA_SET_POLICY,
  388. NFTA_SET_DESC,
  389. NFTA_SET_ID,
  390. NFTA_SET_TIMEOUT,
  391. NFTA_SET_GC_INTERVAL,
  392. NFTA_SET_USERDATA,
  393. NFTA_SET_PAD,
  394. NFTA_SET_OBJ_TYPE,
  395. NFTA_SET_HANDLE,
  396. NFTA_SET_EXPR,
  397. NFTA_SET_EXPRESSIONS,
  398. __NFTA_SET_MAX
  399. };
  400. #define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
  401. /**
  402. * enum nft_set_elem_flags - nf_tables set element flags
  403. *
  404. * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
  405. * @NFT_SET_ELEM_CATCHALL: special catch-all element
  406. */
  407. enum nft_set_elem_flags {
  408. NFT_SET_ELEM_INTERVAL_END = 0x1,
  409. NFT_SET_ELEM_CATCHALL = 0x2,
  410. };
  411. /**
  412. * enum nft_set_elem_attributes - nf_tables set element netlink attributes
  413. *
  414. * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
  415. * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
  416. * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
  417. * @NFTA_SET_ELEM_TIMEOUT: timeout value, zero means never times out (NLA_U64)
  418. * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
  419. * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
  420. * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
  421. * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
  422. * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
  423. * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
  424. */
  425. enum nft_set_elem_attributes {
  426. NFTA_SET_ELEM_UNSPEC,
  427. NFTA_SET_ELEM_KEY,
  428. NFTA_SET_ELEM_DATA,
  429. NFTA_SET_ELEM_FLAGS,
  430. NFTA_SET_ELEM_TIMEOUT,
  431. NFTA_SET_ELEM_EXPIRATION,
  432. NFTA_SET_ELEM_USERDATA,
  433. NFTA_SET_ELEM_EXPR,
  434. NFTA_SET_ELEM_PAD,
  435. NFTA_SET_ELEM_OBJREF,
  436. NFTA_SET_ELEM_KEY_END,
  437. NFTA_SET_ELEM_EXPRESSIONS,
  438. __NFTA_SET_ELEM_MAX
  439. };
  440. #define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
  441. /**
  442. * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
  443. *
  444. * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
  445. * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
  446. * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
  447. * @NFTA_SET_ELEM_LIST_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
  448. */
  449. enum nft_set_elem_list_attributes {
  450. NFTA_SET_ELEM_LIST_UNSPEC,
  451. NFTA_SET_ELEM_LIST_TABLE,
  452. NFTA_SET_ELEM_LIST_SET,
  453. NFTA_SET_ELEM_LIST_ELEMENTS,
  454. NFTA_SET_ELEM_LIST_SET_ID,
  455. __NFTA_SET_ELEM_LIST_MAX
  456. };
  457. #define NFTA_SET_ELEM_LIST_MAX (__NFTA_SET_ELEM_LIST_MAX - 1)
  458. /**
  459. * enum nft_data_types - nf_tables data types
  460. *
  461. * @NFT_DATA_VALUE: generic data
  462. * @NFT_DATA_VERDICT: netfilter verdict
  463. *
  464. * The type of data is usually determined by the kernel directly and is not
  465. * explicitly specified by userspace. The only difference are sets, where
  466. * userspace specifies the key and mapping data types.
  467. *
  468. * The values 0xffffff00-0xffffffff are reserved for internally used types.
  469. * The remaining range can be freely used by userspace to encode types, all
  470. * values are equivalent to NFT_DATA_VALUE.
  471. */
  472. enum nft_data_types {
  473. NFT_DATA_VALUE,
  474. NFT_DATA_VERDICT = 0xffffff00U,
  475. };
  476. #define NFT_DATA_RESERVED_MASK 0xffffff00U
  477. /**
  478. * enum nft_data_attributes - nf_tables data netlink attributes
  479. *
  480. * @NFTA_DATA_VALUE: generic data (NLA_BINARY)
  481. * @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
  482. */
  483. enum nft_data_attributes {
  484. NFTA_DATA_UNSPEC,
  485. NFTA_DATA_VALUE,
  486. NFTA_DATA_VERDICT,
  487. __NFTA_DATA_MAX
  488. };
  489. #define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
  490. /* Maximum length of a value */
  491. #define NFT_DATA_VALUE_MAXLEN 64
  492. /**
  493. * enum nft_verdict_attributes - nf_tables verdict netlink attributes
  494. *
  495. * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
  496. * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
  497. * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
  498. */
  499. enum nft_verdict_attributes {
  500. NFTA_VERDICT_UNSPEC,
  501. NFTA_VERDICT_CODE,
  502. NFTA_VERDICT_CHAIN,
  503. NFTA_VERDICT_CHAIN_ID,
  504. __NFTA_VERDICT_MAX
  505. };
  506. #define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
  507. /**
  508. * enum nft_expr_attributes - nf_tables expression netlink attributes
  509. *
  510. * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
  511. * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
  512. */
  513. enum nft_expr_attributes {
  514. NFTA_EXPR_UNSPEC,
  515. NFTA_EXPR_NAME,
  516. NFTA_EXPR_DATA,
  517. __NFTA_EXPR_MAX
  518. };
  519. #define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1)
  520. /**
  521. * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
  522. *
  523. * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
  524. * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
  525. */
  526. enum nft_immediate_attributes {
  527. NFTA_IMMEDIATE_UNSPEC,
  528. NFTA_IMMEDIATE_DREG,
  529. NFTA_IMMEDIATE_DATA,
  530. __NFTA_IMMEDIATE_MAX
  531. };
  532. #define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1)
  533. /**
  534. * enum nft_bitwise_ops - nf_tables bitwise operations
  535. *
  536. * @NFT_BITWISE_BOOL: mask-and-xor operation used to implement NOT, AND, OR and
  537. * XOR boolean operations
  538. * @NFT_BITWISE_LSHIFT: left-shift operation
  539. * @NFT_BITWISE_RSHIFT: right-shift operation
  540. */
  541. enum nft_bitwise_ops {
  542. NFT_BITWISE_BOOL,
  543. NFT_BITWISE_LSHIFT,
  544. NFT_BITWISE_RSHIFT,
  545. };
  546. /**
  547. * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
  548. *
  549. * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
  550. * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
  551. * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
  552. * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
  553. * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
  554. * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
  555. * @NFTA_BITWISE_DATA: argument for non-boolean operations
  556. * (NLA_NESTED: nft_data_attributes)
  557. *
  558. * The bitwise expression supports boolean and shift operations. It implements
  559. * the boolean operations by performing the following operation:
  560. *
  561. * dreg = (sreg & mask) ^ xor
  562. *
  563. * with these mask and xor values:
  564. *
  565. * mask xor
  566. * NOT: 1 1
  567. * OR: ~x x
  568. * XOR: 1 x
  569. * AND: x 0
  570. */
  571. enum nft_bitwise_attributes {
  572. NFTA_BITWISE_UNSPEC,
  573. NFTA_BITWISE_SREG,
  574. NFTA_BITWISE_DREG,
  575. NFTA_BITWISE_LEN,
  576. NFTA_BITWISE_MASK,
  577. NFTA_BITWISE_XOR,
  578. NFTA_BITWISE_OP,
  579. NFTA_BITWISE_DATA,
  580. __NFTA_BITWISE_MAX
  581. };
  582. #define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1)
  583. /**
  584. * enum nft_byteorder_ops - nf_tables byteorder operators
  585. *
  586. * @NFT_BYTEORDER_NTOH: network to host operator
  587. * @NFT_BYTEORDER_HTON: host to network operator
  588. */
  589. enum nft_byteorder_ops {
  590. NFT_BYTEORDER_NTOH,
  591. NFT_BYTEORDER_HTON,
  592. };
  593. /**
  594. * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
  595. *
  596. * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
  597. * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
  598. * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
  599. * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
  600. * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
  601. */
  602. enum nft_byteorder_attributes {
  603. NFTA_BYTEORDER_UNSPEC,
  604. NFTA_BYTEORDER_SREG,
  605. NFTA_BYTEORDER_DREG,
  606. NFTA_BYTEORDER_OP,
  607. NFTA_BYTEORDER_LEN,
  608. NFTA_BYTEORDER_SIZE,
  609. __NFTA_BYTEORDER_MAX
  610. };
  611. #define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1)
  612. /**
  613. * enum nft_cmp_ops - nf_tables relational operator
  614. *
  615. * @NFT_CMP_EQ: equal
  616. * @NFT_CMP_NEQ: not equal
  617. * @NFT_CMP_LT: less than
  618. * @NFT_CMP_LTE: less than or equal to
  619. * @NFT_CMP_GT: greater than
  620. * @NFT_CMP_GTE: greater than or equal to
  621. */
  622. enum nft_cmp_ops {
  623. NFT_CMP_EQ,
  624. NFT_CMP_NEQ,
  625. NFT_CMP_LT,
  626. NFT_CMP_LTE,
  627. NFT_CMP_GT,
  628. NFT_CMP_GTE,
  629. };
  630. /**
  631. * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
  632. *
  633. * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
  634. * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
  635. * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
  636. */
  637. enum nft_cmp_attributes {
  638. NFTA_CMP_UNSPEC,
  639. NFTA_CMP_SREG,
  640. NFTA_CMP_OP,
  641. NFTA_CMP_DATA,
  642. __NFTA_CMP_MAX
  643. };
  644. #define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
  645. /**
  646. * enum nft_range_ops - nf_tables range operator
  647. *
  648. * @NFT_RANGE_EQ: equal
  649. * @NFT_RANGE_NEQ: not equal
  650. */
  651. enum nft_range_ops {
  652. NFT_RANGE_EQ,
  653. NFT_RANGE_NEQ,
  654. };
  655. /**
  656. * enum nft_range_attributes - nf_tables range expression netlink attributes
  657. *
  658. * @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
  659. * @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_range_ops)
  660. * @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
  661. * @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
  662. */
  663. enum nft_range_attributes {
  664. NFTA_RANGE_UNSPEC,
  665. NFTA_RANGE_SREG,
  666. NFTA_RANGE_OP,
  667. NFTA_RANGE_FROM_DATA,
  668. NFTA_RANGE_TO_DATA,
  669. __NFTA_RANGE_MAX
  670. };
  671. #define NFTA_RANGE_MAX (__NFTA_RANGE_MAX - 1)
  672. enum nft_lookup_flags {
  673. NFT_LOOKUP_F_INV = (1 << 0),
  674. };
  675. /**
  676. * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
  677. *
  678. * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
  679. * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
  680. * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
  681. * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
  682. * @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags)
  683. */
  684. enum nft_lookup_attributes {
  685. NFTA_LOOKUP_UNSPEC,
  686. NFTA_LOOKUP_SET,
  687. NFTA_LOOKUP_SREG,
  688. NFTA_LOOKUP_DREG,
  689. NFTA_LOOKUP_SET_ID,
  690. NFTA_LOOKUP_FLAGS,
  691. __NFTA_LOOKUP_MAX
  692. };
  693. #define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1)
  694. enum nft_dynset_ops {
  695. NFT_DYNSET_OP_ADD,
  696. NFT_DYNSET_OP_UPDATE,
  697. NFT_DYNSET_OP_DELETE,
  698. };
  699. enum nft_dynset_flags {
  700. NFT_DYNSET_F_INV = (1 << 0),
  701. NFT_DYNSET_F_EXPR = (1 << 1),
  702. };
  703. /**
  704. * enum nft_dynset_attributes - dynset expression attributes
  705. *
  706. * @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)
  707. * @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)
  708. * @NFTA_DYNSET_OP: operation (NLA_U32)
  709. * @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)
  710. * @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)
  711. * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
  712. * @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
  713. * @NFTA_DYNSET_FLAGS: flags (NLA_U32)
  714. * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
  715. */
  716. enum nft_dynset_attributes {
  717. NFTA_DYNSET_UNSPEC,
  718. NFTA_DYNSET_SET_NAME,
  719. NFTA_DYNSET_SET_ID,
  720. NFTA_DYNSET_OP,
  721. NFTA_DYNSET_SREG_KEY,
  722. NFTA_DYNSET_SREG_DATA,
  723. NFTA_DYNSET_TIMEOUT,
  724. NFTA_DYNSET_EXPR,
  725. NFTA_DYNSET_PAD,
  726. NFTA_DYNSET_FLAGS,
  727. NFTA_DYNSET_EXPRESSIONS,
  728. __NFTA_DYNSET_MAX,
  729. };
  730. #define NFTA_DYNSET_MAX (__NFTA_DYNSET_MAX - 1)
  731. /**
  732. * enum nft_payload_bases - nf_tables payload expression offset bases
  733. *
  734. * @NFT_PAYLOAD_LL_HEADER: link layer header
  735. * @NFT_PAYLOAD_NETWORK_HEADER: network header
  736. * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
  737. * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
  738. */
  739. enum nft_payload_bases {
  740. NFT_PAYLOAD_LL_HEADER,
  741. NFT_PAYLOAD_NETWORK_HEADER,
  742. NFT_PAYLOAD_TRANSPORT_HEADER,
  743. NFT_PAYLOAD_INNER_HEADER,
  744. NFT_PAYLOAD_TUN_HEADER,
  745. };
  746. /**
  747. * enum nft_payload_csum_types - nf_tables payload expression checksum types
  748. *
  749. * @NFT_PAYLOAD_CSUM_NONE: no checksumming
  750. * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
  751. * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
  752. */
  753. enum nft_payload_csum_types {
  754. NFT_PAYLOAD_CSUM_NONE,
  755. NFT_PAYLOAD_CSUM_INET,
  756. NFT_PAYLOAD_CSUM_SCTP,
  757. };
  758. enum nft_payload_csum_flags {
  759. NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
  760. };
  761. enum nft_inner_type {
  762. NFT_INNER_UNSPEC = 0,
  763. NFT_INNER_VXLAN,
  764. NFT_INNER_GENEVE,
  765. };
  766. enum nft_inner_flags {
  767. NFT_INNER_HDRSIZE = (1 << 0),
  768. NFT_INNER_LL = (1 << 1),
  769. NFT_INNER_NH = (1 << 2),
  770. NFT_INNER_TH = (1 << 3),
  771. };
  772. #define NFT_INNER_MASK (NFT_INNER_HDRSIZE | NFT_INNER_LL | \
  773. NFT_INNER_NH | NFT_INNER_TH)
  774. enum nft_inner_attributes {
  775. NFTA_INNER_UNSPEC,
  776. NFTA_INNER_NUM,
  777. NFTA_INNER_TYPE,
  778. NFTA_INNER_FLAGS,
  779. NFTA_INNER_HDRSIZE,
  780. NFTA_INNER_EXPR,
  781. __NFTA_INNER_MAX
  782. };
  783. #define NFTA_INNER_MAX (__NFTA_INNER_MAX - 1)
  784. /**
  785. * enum nft_payload_attributes - nf_tables payload expression netlink attributes
  786. *
  787. * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
  788. * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
  789. * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
  790. * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
  791. * @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
  792. * @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
  793. * @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
  794. * @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
  795. */
  796. enum nft_payload_attributes {
  797. NFTA_PAYLOAD_UNSPEC,
  798. NFTA_PAYLOAD_DREG,
  799. NFTA_PAYLOAD_BASE,
  800. NFTA_PAYLOAD_OFFSET,
  801. NFTA_PAYLOAD_LEN,
  802. NFTA_PAYLOAD_SREG,
  803. NFTA_PAYLOAD_CSUM_TYPE,
  804. NFTA_PAYLOAD_CSUM_OFFSET,
  805. NFTA_PAYLOAD_CSUM_FLAGS,
  806. __NFTA_PAYLOAD_MAX
  807. };
  808. #define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
  809. enum nft_exthdr_flags {
  810. NFT_EXTHDR_F_PRESENT = (1 << 0),
  811. };
  812. /**
  813. * enum nft_exthdr_op - nf_tables match options
  814. *
  815. * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
  816. * @NFT_EXTHDR_OP_TCP: match against tcp options
  817. * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
  818. * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
  819. * @NFT_EXTHDR_OP_DCCP: match against dccp otions
  820. */
  821. enum nft_exthdr_op {
  822. NFT_EXTHDR_OP_IPV6,
  823. NFT_EXTHDR_OP_TCPOPT,
  824. NFT_EXTHDR_OP_IPV4,
  825. NFT_EXTHDR_OP_SCTP,
  826. NFT_EXTHDR_OP_DCCP,
  827. __NFT_EXTHDR_OP_MAX
  828. };
  829. #define NFT_EXTHDR_OP_MAX (__NFT_EXTHDR_OP_MAX - 1)
  830. /**
  831. * enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes
  832. *
  833. * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
  834. * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
  835. * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
  836. * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
  837. * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
  838. * @NFTA_EXTHDR_OP: option match type (NLA_U32)
  839. * @NFTA_EXTHDR_SREG: source register (NLA_U32: nft_registers)
  840. */
  841. enum nft_exthdr_attributes {
  842. NFTA_EXTHDR_UNSPEC,
  843. NFTA_EXTHDR_DREG,
  844. NFTA_EXTHDR_TYPE,
  845. NFTA_EXTHDR_OFFSET,
  846. NFTA_EXTHDR_LEN,
  847. NFTA_EXTHDR_FLAGS,
  848. NFTA_EXTHDR_OP,
  849. NFTA_EXTHDR_SREG,
  850. __NFTA_EXTHDR_MAX
  851. };
  852. #define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
  853. /**
  854. * enum nft_meta_keys - nf_tables meta expression keys
  855. *
  856. * @NFT_META_LEN: packet length (skb->len)
  857. * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
  858. * @NFT_META_PRIORITY: packet priority (skb->priority)
  859. * @NFT_META_MARK: packet mark (skb->mark)
  860. * @NFT_META_IIF: packet input interface index (dev->ifindex)
  861. * @NFT_META_OIF: packet output interface index (dev->ifindex)
  862. * @NFT_META_IIFNAME: packet input interface name (dev->name)
  863. * @NFT_META_OIFNAME: packet output interface name (dev->name)
  864. * @NFT_META_IIFTYPE: packet input interface type (dev->type)
  865. * @NFT_META_OIFTYPE: packet output interface type (dev->type)
  866. * @NFT_META_SKUID: originating socket UID (fsuid)
  867. * @NFT_META_SKGID: originating socket GID (fsgid)
  868. * @NFT_META_NFTRACE: packet nftrace bit
  869. * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
  870. * @NFT_META_SECMARK: packet secmark (skb->secmark)
  871. * @NFT_META_NFPROTO: netfilter protocol
  872. * @NFT_META_L4PROTO: layer 4 protocol number
  873. * @NFT_META_BRI_IIFNAME: packet input bridge interface name
  874. * @NFT_META_BRI_OIFNAME: packet output bridge interface name
  875. * @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
  876. * @NFT_META_CPU: cpu id through smp_processor_id()
  877. * @NFT_META_IIFGROUP: packet input interface group
  878. * @NFT_META_OIFGROUP: packet output interface group
  879. * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
  880. * @NFT_META_PRANDOM: a 32bit pseudo-random number
  881. * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
  882. * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
  883. * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
  884. * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
  885. * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
  886. * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
  887. * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
  888. * @NFT_META_TIME_HOUR: hour of day (in seconds)
  889. * @NFT_META_SDIF: slave device interface index
  890. * @NFT_META_SDIFNAME: slave device interface name
  891. * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
  892. */
  893. enum nft_meta_keys {
  894. NFT_META_LEN,
  895. NFT_META_PROTOCOL,
  896. NFT_META_PRIORITY,
  897. NFT_META_MARK,
  898. NFT_META_IIF,
  899. NFT_META_OIF,
  900. NFT_META_IIFNAME,
  901. NFT_META_OIFNAME,
  902. NFT_META_IFTYPE,
  903. #define NFT_META_IIFTYPE NFT_META_IFTYPE
  904. NFT_META_OIFTYPE,
  905. NFT_META_SKUID,
  906. NFT_META_SKGID,
  907. NFT_META_NFTRACE,
  908. NFT_META_RTCLASSID,
  909. NFT_META_SECMARK,
  910. NFT_META_NFPROTO,
  911. NFT_META_L4PROTO,
  912. NFT_META_BRI_IIFNAME,
  913. NFT_META_BRI_OIFNAME,
  914. NFT_META_PKTTYPE,
  915. NFT_META_CPU,
  916. NFT_META_IIFGROUP,
  917. NFT_META_OIFGROUP,
  918. NFT_META_CGROUP,
  919. NFT_META_PRANDOM,
  920. NFT_META_SECPATH,
  921. NFT_META_IIFKIND,
  922. NFT_META_OIFKIND,
  923. NFT_META_BRI_IIFPVID,
  924. NFT_META_BRI_IIFVPROTO,
  925. NFT_META_TIME_NS,
  926. NFT_META_TIME_DAY,
  927. NFT_META_TIME_HOUR,
  928. NFT_META_SDIF,
  929. NFT_META_SDIFNAME,
  930. NFT_META_BRI_BROUTE,
  931. __NFT_META_IIFTYPE,
  932. };
  933. /**
  934. * enum nft_rt_keys - nf_tables routing expression keys
  935. *
  936. * @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
  937. * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
  938. * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
  939. * @NFT_RT_TCPMSS: fetch current path tcp mss
  940. * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
  941. */
  942. enum nft_rt_keys {
  943. NFT_RT_CLASSID,
  944. NFT_RT_NEXTHOP4,
  945. NFT_RT_NEXTHOP6,
  946. NFT_RT_TCPMSS,
  947. NFT_RT_XFRM,
  948. __NFT_RT_MAX
  949. };
  950. #define NFT_RT_MAX (__NFT_RT_MAX - 1)
  951. /**
  952. * enum nft_hash_types - nf_tables hash expression types
  953. *
  954. * @NFT_HASH_JENKINS: Jenkins Hash
  955. * @NFT_HASH_SYM: Symmetric Hash
  956. */
  957. enum nft_hash_types {
  958. NFT_HASH_JENKINS,
  959. NFT_HASH_SYM,
  960. };
  961. /**
  962. * enum nft_hash_attributes - nf_tables hash expression netlink attributes
  963. *
  964. * @NFTA_HASH_SREG: source register (NLA_U32)
  965. * @NFTA_HASH_DREG: destination register (NLA_U32)
  966. * @NFTA_HASH_LEN: source data length (NLA_U32)
  967. * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
  968. * @NFTA_HASH_SEED: seed value (NLA_U32)
  969. * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
  970. * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
  971. * @NFTA_HASH_SET_NAME: name of the map to lookup (NLA_STRING)
  972. * @NFTA_HASH_SET_ID: id of the map (NLA_U32)
  973. */
  974. enum nft_hash_attributes {
  975. NFTA_HASH_UNSPEC,
  976. NFTA_HASH_SREG,
  977. NFTA_HASH_DREG,
  978. NFTA_HASH_LEN,
  979. NFTA_HASH_MODULUS,
  980. NFTA_HASH_SEED,
  981. NFTA_HASH_OFFSET,
  982. NFTA_HASH_TYPE,
  983. NFTA_HASH_SET_NAME, /* deprecated */
  984. NFTA_HASH_SET_ID, /* deprecated */
  985. __NFTA_HASH_MAX,
  986. };
  987. #define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
  988. /**
  989. * enum nft_meta_attributes - nf_tables meta expression netlink attributes
  990. *
  991. * @NFTA_META_DREG: destination register (NLA_U32)
  992. * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
  993. * @NFTA_META_SREG: source register (NLA_U32)
  994. */
  995. enum nft_meta_attributes {
  996. NFTA_META_UNSPEC,
  997. NFTA_META_DREG,
  998. NFTA_META_KEY,
  999. NFTA_META_SREG,
  1000. __NFTA_META_MAX
  1001. };
  1002. #define NFTA_META_MAX (__NFTA_META_MAX - 1)
  1003. /**
  1004. * enum nft_rt_attributes - nf_tables routing expression netlink attributes
  1005. *
  1006. * @NFTA_RT_DREG: destination register (NLA_U32)
  1007. * @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
  1008. */
  1009. enum nft_rt_attributes {
  1010. NFTA_RT_UNSPEC,
  1011. NFTA_RT_DREG,
  1012. NFTA_RT_KEY,
  1013. __NFTA_RT_MAX
  1014. };
  1015. #define NFTA_RT_MAX (__NFTA_RT_MAX - 1)
  1016. /**
  1017. * enum nft_socket_attributes - nf_tables socket expression netlink attributes
  1018. *
  1019. * @NFTA_SOCKET_KEY: socket key to match
  1020. * @NFTA_SOCKET_DREG: destination register
  1021. * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
  1022. */
  1023. enum nft_socket_attributes {
  1024. NFTA_SOCKET_UNSPEC,
  1025. NFTA_SOCKET_KEY,
  1026. NFTA_SOCKET_DREG,
  1027. NFTA_SOCKET_LEVEL,
  1028. __NFTA_SOCKET_MAX
  1029. };
  1030. #define NFTA_SOCKET_MAX (__NFTA_SOCKET_MAX - 1)
  1031. /*
  1032. * enum nft_socket_keys - nf_tables socket expression keys
  1033. *
  1034. * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
  1035. * @NFT_SOCKET_MARK: Value of the socket mark
  1036. * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
  1037. * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
  1038. */
  1039. enum nft_socket_keys {
  1040. NFT_SOCKET_TRANSPARENT,
  1041. NFT_SOCKET_MARK,
  1042. NFT_SOCKET_WILDCARD,
  1043. NFT_SOCKET_CGROUPV2,
  1044. __NFT_SOCKET_MAX
  1045. };
  1046. #define NFT_SOCKET_MAX (__NFT_SOCKET_MAX - 1)
  1047. /**
  1048. * enum nft_ct_keys - nf_tables ct expression keys
  1049. *
  1050. * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
  1051. * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
  1052. * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
  1053. * @NFT_CT_MARK: conntrack mark value
  1054. * @NFT_CT_SECMARK: conntrack secmark value
  1055. * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
  1056. * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
  1057. * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
  1058. * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address, deprecated)
  1059. * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address, deprecated)
  1060. * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
  1061. * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
  1062. * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
  1063. * @NFT_CT_LABELS: conntrack labels
  1064. * @NFT_CT_PKTS: conntrack packets
  1065. * @NFT_CT_BYTES: conntrack bytes
  1066. * @NFT_CT_AVGPKT: conntrack average bytes per packet
  1067. * @NFT_CT_ZONE: conntrack zone
  1068. * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
  1069. * @NFT_CT_SRC_IP: conntrack layer 3 protocol source (IPv4 address)
  1070. * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address)
  1071. * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)
  1072. * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)
  1073. * @NFT_CT_ID: conntrack id
  1074. */
  1075. enum nft_ct_keys {
  1076. NFT_CT_STATE,
  1077. NFT_CT_DIRECTION,
  1078. NFT_CT_STATUS,
  1079. NFT_CT_MARK,
  1080. NFT_CT_SECMARK,
  1081. NFT_CT_EXPIRATION,
  1082. NFT_CT_HELPER,
  1083. NFT_CT_L3PROTOCOL,
  1084. NFT_CT_SRC,
  1085. NFT_CT_DST,
  1086. NFT_CT_PROTOCOL,
  1087. NFT_CT_PROTO_SRC,
  1088. NFT_CT_PROTO_DST,
  1089. NFT_CT_LABELS,
  1090. NFT_CT_PKTS,
  1091. NFT_CT_BYTES,
  1092. NFT_CT_AVGPKT,
  1093. NFT_CT_ZONE,
  1094. NFT_CT_EVENTMASK,
  1095. NFT_CT_SRC_IP,
  1096. NFT_CT_DST_IP,
  1097. NFT_CT_SRC_IP6,
  1098. NFT_CT_DST_IP6,
  1099. NFT_CT_ID,
  1100. __NFT_CT_MAX
  1101. };
  1102. #define NFT_CT_MAX (__NFT_CT_MAX - 1)
  1103. /**
  1104. * enum nft_ct_attributes - nf_tables ct expression netlink attributes
  1105. *
  1106. * @NFTA_CT_DREG: destination register (NLA_U32)
  1107. * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
  1108. * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
  1109. * @NFTA_CT_SREG: source register (NLA_U32)
  1110. */
  1111. enum nft_ct_attributes {
  1112. NFTA_CT_UNSPEC,
  1113. NFTA_CT_DREG,
  1114. NFTA_CT_KEY,
  1115. NFTA_CT_DIRECTION,
  1116. NFTA_CT_SREG,
  1117. __NFTA_CT_MAX
  1118. };
  1119. #define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
  1120. /**
  1121. * enum nft_flow_attributes - ct offload expression attributes
  1122. * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
  1123. */
  1124. enum nft_offload_attributes {
  1125. NFTA_FLOW_UNSPEC,
  1126. NFTA_FLOW_TABLE_NAME,
  1127. __NFTA_FLOW_MAX,
  1128. };
  1129. #define NFTA_FLOW_MAX (__NFTA_FLOW_MAX - 1)
  1130. enum nft_limit_type {
  1131. NFT_LIMIT_PKTS,
  1132. NFT_LIMIT_PKT_BYTES
  1133. };
  1134. enum nft_limit_flags {
  1135. NFT_LIMIT_F_INV = (1 << 0),
  1136. };
  1137. /**
  1138. * enum nft_limit_attributes - nf_tables limit expression netlink attributes
  1139. *
  1140. * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
  1141. * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
  1142. * @NFTA_LIMIT_BURST: burst (NLA_U32)
  1143. * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
  1144. * @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
  1145. */
  1146. enum nft_limit_attributes {
  1147. NFTA_LIMIT_UNSPEC,
  1148. NFTA_LIMIT_RATE,
  1149. NFTA_LIMIT_UNIT,
  1150. NFTA_LIMIT_BURST,
  1151. NFTA_LIMIT_TYPE,
  1152. NFTA_LIMIT_FLAGS,
  1153. NFTA_LIMIT_PAD,
  1154. __NFTA_LIMIT_MAX
  1155. };
  1156. #define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
  1157. enum nft_connlimit_flags {
  1158. NFT_CONNLIMIT_F_INV = (1 << 0),
  1159. };
  1160. /**
  1161. * enum nft_connlimit_attributes - nf_tables connlimit expression netlink attributes
  1162. *
  1163. * @NFTA_CONNLIMIT_COUNT: number of connections (NLA_U32)
  1164. * @NFTA_CONNLIMIT_FLAGS: flags (NLA_U32: enum nft_connlimit_flags)
  1165. */
  1166. enum nft_connlimit_attributes {
  1167. NFTA_CONNLIMIT_UNSPEC,
  1168. NFTA_CONNLIMIT_COUNT,
  1169. NFTA_CONNLIMIT_FLAGS,
  1170. __NFTA_CONNLIMIT_MAX
  1171. };
  1172. #define NFTA_CONNLIMIT_MAX (__NFTA_CONNLIMIT_MAX - 1)
  1173. /**
  1174. * enum nft_counter_attributes - nf_tables counter expression netlink attributes
  1175. *
  1176. * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
  1177. * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
  1178. */
  1179. enum nft_counter_attributes {
  1180. NFTA_COUNTER_UNSPEC,
  1181. NFTA_COUNTER_BYTES,
  1182. NFTA_COUNTER_PACKETS,
  1183. NFTA_COUNTER_PAD,
  1184. __NFTA_COUNTER_MAX
  1185. };
  1186. #define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
  1187. /**
  1188. * enum nft_last_attributes - nf_tables last expression netlink attributes
  1189. *
  1190. * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
  1191. * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
  1192. */
  1193. enum nft_last_attributes {
  1194. NFTA_LAST_UNSPEC,
  1195. NFTA_LAST_SET,
  1196. NFTA_LAST_MSECS,
  1197. NFTA_LAST_PAD,
  1198. __NFTA_LAST_MAX
  1199. };
  1200. #define NFTA_LAST_MAX (__NFTA_LAST_MAX - 1)
  1201. /**
  1202. * enum nft_log_attributes - nf_tables log expression netlink attributes
  1203. *
  1204. * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U16)
  1205. * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
  1206. * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
  1207. * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U16)
  1208. * @NFTA_LOG_LEVEL: log level (NLA_U32)
  1209. * @NFTA_LOG_FLAGS: logging flags (NLA_U32)
  1210. */
  1211. enum nft_log_attributes {
  1212. NFTA_LOG_UNSPEC,
  1213. NFTA_LOG_GROUP,
  1214. NFTA_LOG_PREFIX,
  1215. NFTA_LOG_SNAPLEN,
  1216. NFTA_LOG_QTHRESHOLD,
  1217. NFTA_LOG_LEVEL,
  1218. NFTA_LOG_FLAGS,
  1219. __NFTA_LOG_MAX
  1220. };
  1221. #define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)
  1222. /**
  1223. * enum nft_log_level - nf_tables log levels
  1224. *
  1225. * @NFT_LOGLEVEL_EMERG: system is unusable
  1226. * @NFT_LOGLEVEL_ALERT: action must be taken immediately
  1227. * @NFT_LOGLEVEL_CRIT: critical conditions
  1228. * @NFT_LOGLEVEL_ERR: error conditions
  1229. * @NFT_LOGLEVEL_WARNING: warning conditions
  1230. * @NFT_LOGLEVEL_NOTICE: normal but significant condition
  1231. * @NFT_LOGLEVEL_INFO: informational
  1232. * @NFT_LOGLEVEL_DEBUG: debug-level messages
  1233. * @NFT_LOGLEVEL_AUDIT: enabling audit logging
  1234. */
  1235. enum nft_log_level {
  1236. NFT_LOGLEVEL_EMERG,
  1237. NFT_LOGLEVEL_ALERT,
  1238. NFT_LOGLEVEL_CRIT,
  1239. NFT_LOGLEVEL_ERR,
  1240. NFT_LOGLEVEL_WARNING,
  1241. NFT_LOGLEVEL_NOTICE,
  1242. NFT_LOGLEVEL_INFO,
  1243. NFT_LOGLEVEL_DEBUG,
  1244. NFT_LOGLEVEL_AUDIT,
  1245. __NFT_LOGLEVEL_MAX
  1246. };
  1247. #define NFT_LOGLEVEL_MAX (__NFT_LOGLEVEL_MAX - 1)
  1248. /**
  1249. * enum nft_queue_attributes - nf_tables queue expression netlink attributes
  1250. *
  1251. * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
  1252. * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
  1253. * @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
  1254. * @NFTA_QUEUE_SREG_QNUM: source register of queue number (NLA_U32: nft_registers)
  1255. */
  1256. enum nft_queue_attributes {
  1257. NFTA_QUEUE_UNSPEC,
  1258. NFTA_QUEUE_NUM,
  1259. NFTA_QUEUE_TOTAL,
  1260. NFTA_QUEUE_FLAGS,
  1261. NFTA_QUEUE_SREG_QNUM,
  1262. __NFTA_QUEUE_MAX
  1263. };
  1264. #define NFTA_QUEUE_MAX (__NFTA_QUEUE_MAX - 1)
  1265. #define NFT_QUEUE_FLAG_BYPASS 0x01 /* for compatibility with v2 */
  1266. #define NFT_QUEUE_FLAG_CPU_FANOUT 0x02 /* use current CPU (no hashing) */
  1267. #define NFT_QUEUE_FLAG_MASK 0x03
  1268. enum nft_quota_flags {
  1269. NFT_QUOTA_F_INV = (1 << 0),
  1270. NFT_QUOTA_F_DEPLETED = (1 << 1),
  1271. };
  1272. /**
  1273. * enum nft_quota_attributes - nf_tables quota expression netlink attributes
  1274. *
  1275. * @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
  1276. * @NFTA_QUOTA_FLAGS: flags (NLA_U32)
  1277. * @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
  1278. */
  1279. enum nft_quota_attributes {
  1280. NFTA_QUOTA_UNSPEC,
  1281. NFTA_QUOTA_BYTES,
  1282. NFTA_QUOTA_FLAGS,
  1283. NFTA_QUOTA_PAD,
  1284. NFTA_QUOTA_CONSUMED,
  1285. __NFTA_QUOTA_MAX
  1286. };
  1287. #define NFTA_QUOTA_MAX (__NFTA_QUOTA_MAX - 1)
  1288. /**
  1289. * enum nft_secmark_attributes - nf_tables secmark object netlink attributes
  1290. *
  1291. * @NFTA_SECMARK_CTX: security context (NLA_STRING)
  1292. */
  1293. enum nft_secmark_attributes {
  1294. NFTA_SECMARK_UNSPEC,
  1295. NFTA_SECMARK_CTX,
  1296. __NFTA_SECMARK_MAX,
  1297. };
  1298. #define NFTA_SECMARK_MAX (__NFTA_SECMARK_MAX - 1)
  1299. /* Max security context length */
  1300. #define NFT_SECMARK_CTX_MAXLEN 4096
  1301. /**
  1302. * enum nft_reject_types - nf_tables reject expression reject types
  1303. *
  1304. * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
  1305. * @NFT_REJECT_TCP_RST: reject using TCP RST
  1306. * @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet
  1307. */
  1308. enum nft_reject_types {
  1309. NFT_REJECT_ICMP_UNREACH,
  1310. NFT_REJECT_TCP_RST,
  1311. NFT_REJECT_ICMPX_UNREACH,
  1312. };
  1313. /**
  1314. * enum nft_reject_code - Generic reject codes for IPv4/IPv6
  1315. *
  1316. * @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable
  1317. * @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
  1318. * @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
  1319. * @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited
  1320. *
  1321. * These codes are mapped to real ICMP and ICMPv6 codes.
  1322. */
  1323. enum nft_reject_inet_code {
  1324. NFT_REJECT_ICMPX_NO_ROUTE = 0,
  1325. NFT_REJECT_ICMPX_PORT_UNREACH,
  1326. NFT_REJECT_ICMPX_HOST_UNREACH,
  1327. NFT_REJECT_ICMPX_ADMIN_PROHIBITED,
  1328. __NFT_REJECT_ICMPX_MAX
  1329. };
  1330. #define NFT_REJECT_ICMPX_MAX (__NFT_REJECT_ICMPX_MAX - 1)
  1331. /**
  1332. * enum nft_reject_attributes - nf_tables reject expression netlink attributes
  1333. *
  1334. * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
  1335. * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
  1336. */
  1337. enum nft_reject_attributes {
  1338. NFTA_REJECT_UNSPEC,
  1339. NFTA_REJECT_TYPE,
  1340. NFTA_REJECT_ICMP_CODE,
  1341. __NFTA_REJECT_MAX
  1342. };
  1343. #define NFTA_REJECT_MAX (__NFTA_REJECT_MAX - 1)
  1344. /**
  1345. * enum nft_nat_types - nf_tables nat expression NAT types
  1346. *
  1347. * @NFT_NAT_SNAT: source NAT
  1348. * @NFT_NAT_DNAT: destination NAT
  1349. */
  1350. enum nft_nat_types {
  1351. NFT_NAT_SNAT,
  1352. NFT_NAT_DNAT,
  1353. };
  1354. /**
  1355. * enum nft_nat_attributes - nf_tables nat expression netlink attributes
  1356. *
  1357. * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
  1358. * @NFTA_NAT_FAMILY: NAT family (NLA_U32)
  1359. * @NFTA_NAT_REG_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
  1360. * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
  1361. * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
  1362. * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
  1363. * @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
  1364. */
  1365. enum nft_nat_attributes {
  1366. NFTA_NAT_UNSPEC,
  1367. NFTA_NAT_TYPE,
  1368. NFTA_NAT_FAMILY,
  1369. NFTA_NAT_REG_ADDR_MIN,
  1370. NFTA_NAT_REG_ADDR_MAX,
  1371. NFTA_NAT_REG_PROTO_MIN,
  1372. NFTA_NAT_REG_PROTO_MAX,
  1373. NFTA_NAT_FLAGS,
  1374. __NFTA_NAT_MAX
  1375. };
  1376. #define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
  1377. /**
  1378. * enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
  1379. *
  1380. * NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
  1381. * NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
  1382. * NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
  1383. */
  1384. enum nft_tproxy_attributes {
  1385. NFTA_TPROXY_UNSPEC,
  1386. NFTA_TPROXY_FAMILY,
  1387. NFTA_TPROXY_REG_ADDR,
  1388. NFTA_TPROXY_REG_PORT,
  1389. __NFTA_TPROXY_MAX
  1390. };
  1391. #define NFTA_TPROXY_MAX (__NFTA_TPROXY_MAX - 1)
  1392. /**
  1393. * enum nft_masq_attributes - nf_tables masquerade expression attributes
  1394. *
  1395. * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
  1396. * @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
  1397. * @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
  1398. */
  1399. enum nft_masq_attributes {
  1400. NFTA_MASQ_UNSPEC,
  1401. NFTA_MASQ_FLAGS,
  1402. NFTA_MASQ_REG_PROTO_MIN,
  1403. NFTA_MASQ_REG_PROTO_MAX,
  1404. __NFTA_MASQ_MAX
  1405. };
  1406. #define NFTA_MASQ_MAX (__NFTA_MASQ_MAX - 1)
  1407. /**
  1408. * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
  1409. *
  1410. * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
  1411. * @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
  1412. * @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
  1413. */
  1414. enum nft_redir_attributes {
  1415. NFTA_REDIR_UNSPEC,
  1416. NFTA_REDIR_REG_PROTO_MIN,
  1417. NFTA_REDIR_REG_PROTO_MAX,
  1418. NFTA_REDIR_FLAGS,
  1419. __NFTA_REDIR_MAX
  1420. };
  1421. #define NFTA_REDIR_MAX (__NFTA_REDIR_MAX - 1)
  1422. /**
  1423. * enum nft_dup_attributes - nf_tables dup expression netlink attributes
  1424. *
  1425. * @NFTA_DUP_SREG_ADDR: source register of address (NLA_U32: nft_registers)
  1426. * @NFTA_DUP_SREG_DEV: source register of output interface (NLA_U32: nft_register)
  1427. */
  1428. enum nft_dup_attributes {
  1429. NFTA_DUP_UNSPEC,
  1430. NFTA_DUP_SREG_ADDR,
  1431. NFTA_DUP_SREG_DEV,
  1432. __NFTA_DUP_MAX
  1433. };
  1434. #define NFTA_DUP_MAX (__NFTA_DUP_MAX - 1)
  1435. /**
  1436. * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
  1437. *
  1438. * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
  1439. * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register)
  1440. * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto)
  1441. */
  1442. enum nft_fwd_attributes {
  1443. NFTA_FWD_UNSPEC,
  1444. NFTA_FWD_SREG_DEV,
  1445. NFTA_FWD_SREG_ADDR,
  1446. NFTA_FWD_NFPROTO,
  1447. __NFTA_FWD_MAX
  1448. };
  1449. #define NFTA_FWD_MAX (__NFTA_FWD_MAX - 1)
  1450. /**
  1451. * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
  1452. *
  1453. * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
  1454. * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
  1455. * @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
  1456. * @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
  1457. * @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
  1458. */
  1459. enum nft_objref_attributes {
  1460. NFTA_OBJREF_UNSPEC,
  1461. NFTA_OBJREF_IMM_TYPE,
  1462. NFTA_OBJREF_IMM_NAME,
  1463. NFTA_OBJREF_SET_SREG,
  1464. NFTA_OBJREF_SET_NAME,
  1465. NFTA_OBJREF_SET_ID,
  1466. __NFTA_OBJREF_MAX
  1467. };
  1468. #define NFTA_OBJREF_MAX (__NFTA_OBJREF_MAX - 1)
  1469. /**
  1470. * enum nft_gen_attributes - nf_tables ruleset generation attributes
  1471. *
  1472. * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
  1473. */
  1474. enum nft_gen_attributes {
  1475. NFTA_GEN_UNSPEC,
  1476. NFTA_GEN_ID,
  1477. NFTA_GEN_PROC_PID,
  1478. NFTA_GEN_PROC_NAME,
  1479. __NFTA_GEN_MAX
  1480. };
  1481. #define NFTA_GEN_MAX (__NFTA_GEN_MAX - 1)
  1482. /*
  1483. * enum nft_fib_attributes - nf_tables fib expression netlink attributes
  1484. *
  1485. * @NFTA_FIB_DREG: destination register (NLA_U32)
  1486. * @NFTA_FIB_RESULT: desired result (NLA_U32)
  1487. * @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)
  1488. *
  1489. * The FIB expression performs a route lookup according
  1490. * to the packet data.
  1491. */
  1492. enum nft_fib_attributes {
  1493. NFTA_FIB_UNSPEC,
  1494. NFTA_FIB_DREG,
  1495. NFTA_FIB_RESULT,
  1496. NFTA_FIB_FLAGS,
  1497. __NFTA_FIB_MAX
  1498. };
  1499. #define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)
  1500. enum nft_fib_result {
  1501. NFT_FIB_RESULT_UNSPEC,
  1502. NFT_FIB_RESULT_OIF,
  1503. NFT_FIB_RESULT_OIFNAME,
  1504. NFT_FIB_RESULT_ADDRTYPE,
  1505. __NFT_FIB_RESULT_MAX
  1506. };
  1507. #define NFT_FIB_RESULT_MAX (__NFT_FIB_RESULT_MAX - 1)
  1508. enum nft_fib_flags {
  1509. NFTA_FIB_F_SADDR = 1 << 0, /* look up src */
  1510. NFTA_FIB_F_DADDR = 1 << 1, /* look up dst */
  1511. NFTA_FIB_F_MARK = 1 << 2, /* use skb->mark */
  1512. NFTA_FIB_F_IIF = 1 << 3, /* restrict to iif */
  1513. NFTA_FIB_F_OIF = 1 << 4, /* restrict to oif */
  1514. NFTA_FIB_F_PRESENT = 1 << 5, /* check existence only */
  1515. };
  1516. enum nft_ct_helper_attributes {
  1517. NFTA_CT_HELPER_UNSPEC,
  1518. NFTA_CT_HELPER_NAME,
  1519. NFTA_CT_HELPER_L3PROTO,
  1520. NFTA_CT_HELPER_L4PROTO,
  1521. __NFTA_CT_HELPER_MAX,
  1522. };
  1523. #define NFTA_CT_HELPER_MAX (__NFTA_CT_HELPER_MAX - 1)
  1524. enum nft_ct_timeout_timeout_attributes {
  1525. NFTA_CT_TIMEOUT_UNSPEC,
  1526. NFTA_CT_TIMEOUT_L3PROTO,
  1527. NFTA_CT_TIMEOUT_L4PROTO,
  1528. NFTA_CT_TIMEOUT_DATA,
  1529. __NFTA_CT_TIMEOUT_MAX,
  1530. };
  1531. #define NFTA_CT_TIMEOUT_MAX (__NFTA_CT_TIMEOUT_MAX - 1)
  1532. enum nft_ct_expectation_attributes {
  1533. NFTA_CT_EXPECT_UNSPEC,
  1534. NFTA_CT_EXPECT_L3PROTO,
  1535. NFTA_CT_EXPECT_L4PROTO,
  1536. NFTA_CT_EXPECT_DPORT,
  1537. NFTA_CT_EXPECT_TIMEOUT,
  1538. NFTA_CT_EXPECT_SIZE,
  1539. __NFTA_CT_EXPECT_MAX,
  1540. };
  1541. #define NFTA_CT_EXPECT_MAX (__NFTA_CT_EXPECT_MAX - 1)
  1542. #define NFT_OBJECT_UNSPEC 0
  1543. #define NFT_OBJECT_COUNTER 1
  1544. #define NFT_OBJECT_QUOTA 2
  1545. #define NFT_OBJECT_CT_HELPER 3
  1546. #define NFT_OBJECT_LIMIT 4
  1547. #define NFT_OBJECT_CONNLIMIT 5
  1548. #define NFT_OBJECT_TUNNEL 6
  1549. #define NFT_OBJECT_CT_TIMEOUT 7
  1550. #define NFT_OBJECT_SECMARK 8
  1551. #define NFT_OBJECT_CT_EXPECT 9
  1552. #define NFT_OBJECT_SYNPROXY 10
  1553. #define __NFT_OBJECT_MAX 11
  1554. #define NFT_OBJECT_MAX (__NFT_OBJECT_MAX - 1)
  1555. /**
  1556. * enum nft_object_attributes - nf_tables stateful object netlink attributes
  1557. *
  1558. * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
  1559. * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
  1560. * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
  1561. * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
  1562. * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
  1563. * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
  1564. * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
  1565. */
  1566. enum nft_object_attributes {
  1567. NFTA_OBJ_UNSPEC,
  1568. NFTA_OBJ_TABLE,
  1569. NFTA_OBJ_NAME,
  1570. NFTA_OBJ_TYPE,
  1571. NFTA_OBJ_DATA,
  1572. NFTA_OBJ_USE,
  1573. NFTA_OBJ_HANDLE,
  1574. NFTA_OBJ_PAD,
  1575. NFTA_OBJ_USERDATA,
  1576. __NFTA_OBJ_MAX
  1577. };
  1578. #define NFTA_OBJ_MAX (__NFTA_OBJ_MAX - 1)
  1579. /**
  1580. * enum nft_flowtable_flags - nf_tables flowtable flags
  1581. *
  1582. * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
  1583. * @NFT_FLOWTABLE_COUNTER: enable flow counters
  1584. */
  1585. enum nft_flowtable_flags {
  1586. NFT_FLOWTABLE_HW_OFFLOAD = 0x1,
  1587. NFT_FLOWTABLE_COUNTER = 0x2,
  1588. NFT_FLOWTABLE_MASK = (NFT_FLOWTABLE_HW_OFFLOAD |
  1589. NFT_FLOWTABLE_COUNTER)
  1590. };
  1591. /**
  1592. * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
  1593. *
  1594. * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
  1595. * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
  1596. * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED)
  1597. * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
  1598. * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
  1599. * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
  1600. */
  1601. enum nft_flowtable_attributes {
  1602. NFTA_FLOWTABLE_UNSPEC,
  1603. NFTA_FLOWTABLE_TABLE,
  1604. NFTA_FLOWTABLE_NAME,
  1605. NFTA_FLOWTABLE_HOOK,
  1606. NFTA_FLOWTABLE_USE,
  1607. NFTA_FLOWTABLE_HANDLE,
  1608. NFTA_FLOWTABLE_PAD,
  1609. NFTA_FLOWTABLE_FLAGS,
  1610. __NFTA_FLOWTABLE_MAX
  1611. };
  1612. #define NFTA_FLOWTABLE_MAX (__NFTA_FLOWTABLE_MAX - 1)
  1613. /**
  1614. * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
  1615. *
  1616. * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
  1617. * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
  1618. * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
  1619. */
  1620. enum nft_flowtable_hook_attributes {
  1621. NFTA_FLOWTABLE_HOOK_UNSPEC,
  1622. NFTA_FLOWTABLE_HOOK_NUM,
  1623. NFTA_FLOWTABLE_HOOK_PRIORITY,
  1624. NFTA_FLOWTABLE_HOOK_DEVS,
  1625. __NFTA_FLOWTABLE_HOOK_MAX
  1626. };
  1627. #define NFTA_FLOWTABLE_HOOK_MAX (__NFTA_FLOWTABLE_HOOK_MAX - 1)
  1628. /**
  1629. * enum nft_osf_attributes - nftables osf expression netlink attributes
  1630. *
  1631. * @NFTA_OSF_DREG: destination register (NLA_U32: nft_registers)
  1632. * @NFTA_OSF_TTL: Value of the TTL osf option (NLA_U8)
  1633. * @NFTA_OSF_FLAGS: flags (NLA_U32)
  1634. */
  1635. enum nft_osf_attributes {
  1636. NFTA_OSF_UNSPEC,
  1637. NFTA_OSF_DREG,
  1638. NFTA_OSF_TTL,
  1639. NFTA_OSF_FLAGS,
  1640. __NFTA_OSF_MAX,
  1641. };
  1642. #define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1)
  1643. enum nft_osf_flags {
  1644. NFT_OSF_F_VERSION = (1 << 0),
  1645. };
  1646. /**
  1647. * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
  1648. *
  1649. * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
  1650. * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
  1651. * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
  1652. */
  1653. enum nft_synproxy_attributes {
  1654. NFTA_SYNPROXY_UNSPEC,
  1655. NFTA_SYNPROXY_MSS,
  1656. NFTA_SYNPROXY_WSCALE,
  1657. NFTA_SYNPROXY_FLAGS,
  1658. __NFTA_SYNPROXY_MAX,
  1659. };
  1660. #define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
  1661. /**
  1662. * enum nft_device_attributes - nf_tables device netlink attributes
  1663. *
  1664. * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
  1665. */
  1666. enum nft_devices_attributes {
  1667. NFTA_DEVICE_UNSPEC,
  1668. NFTA_DEVICE_NAME,
  1669. __NFTA_DEVICE_MAX
  1670. };
  1671. #define NFTA_DEVICE_MAX (__NFTA_DEVICE_MAX - 1)
  1672. /*
  1673. * enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
  1674. *
  1675. * @NFTA_XFRM_DREG: destination register (NLA_U32)
  1676. * @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
  1677. * @NFTA_XFRM_DIR: direction (NLA_U8)
  1678. * @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
  1679. */
  1680. enum nft_xfrm_attributes {
  1681. NFTA_XFRM_UNSPEC,
  1682. NFTA_XFRM_DREG,
  1683. NFTA_XFRM_KEY,
  1684. NFTA_XFRM_DIR,
  1685. NFTA_XFRM_SPNUM,
  1686. __NFTA_XFRM_MAX
  1687. };
  1688. #define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
  1689. enum nft_xfrm_keys {
  1690. NFT_XFRM_KEY_UNSPEC,
  1691. NFT_XFRM_KEY_DADDR_IP4,
  1692. NFT_XFRM_KEY_DADDR_IP6,
  1693. NFT_XFRM_KEY_SADDR_IP4,
  1694. NFT_XFRM_KEY_SADDR_IP6,
  1695. NFT_XFRM_KEY_REQID,
  1696. NFT_XFRM_KEY_SPI,
  1697. __NFT_XFRM_KEY_MAX,
  1698. };
  1699. #define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
  1700. /**
  1701. * enum nft_trace_attributes - nf_tables trace netlink attributes
  1702. *
  1703. * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
  1704. * @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)
  1705. * @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)
  1706. * @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)
  1707. * @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)
  1708. * @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)
  1709. * @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)
  1710. * @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)
  1711. * @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)
  1712. * @NFTA_TRACE_IIF: indev ifindex (NLA_U32)
  1713. * @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)
  1714. * @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)
  1715. * @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)
  1716. * @NFTA_TRACE_MARK: nfmark (NLA_U32)
  1717. * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
  1718. * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
  1719. */
  1720. enum nft_trace_attributes {
  1721. NFTA_TRACE_UNSPEC,
  1722. NFTA_TRACE_TABLE,
  1723. NFTA_TRACE_CHAIN,
  1724. NFTA_TRACE_RULE_HANDLE,
  1725. NFTA_TRACE_TYPE,
  1726. NFTA_TRACE_VERDICT,
  1727. NFTA_TRACE_ID,
  1728. NFTA_TRACE_LL_HEADER,
  1729. NFTA_TRACE_NETWORK_HEADER,
  1730. NFTA_TRACE_TRANSPORT_HEADER,
  1731. NFTA_TRACE_IIF,
  1732. NFTA_TRACE_IIFTYPE,
  1733. NFTA_TRACE_OIF,
  1734. NFTA_TRACE_OIFTYPE,
  1735. NFTA_TRACE_MARK,
  1736. NFTA_TRACE_NFPROTO,
  1737. NFTA_TRACE_POLICY,
  1738. NFTA_TRACE_PAD,
  1739. __NFTA_TRACE_MAX
  1740. };
  1741. #define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
  1742. enum nft_trace_types {
  1743. NFT_TRACETYPE_UNSPEC,
  1744. NFT_TRACETYPE_POLICY,
  1745. NFT_TRACETYPE_RETURN,
  1746. NFT_TRACETYPE_RULE,
  1747. __NFT_TRACETYPE_MAX
  1748. };
  1749. #define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
  1750. /**
  1751. * enum nft_ng_attributes - nf_tables number generator expression netlink attributes
  1752. *
  1753. * @NFTA_NG_DREG: destination register (NLA_U32)
  1754. * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
  1755. * @NFTA_NG_TYPE: operation type (NLA_U32)
  1756. * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
  1757. * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
  1758. * @NFTA_NG_SET_ID: id of the map (NLA_U32)
  1759. */
  1760. enum nft_ng_attributes {
  1761. NFTA_NG_UNSPEC,
  1762. NFTA_NG_DREG,
  1763. NFTA_NG_MODULUS,
  1764. NFTA_NG_TYPE,
  1765. NFTA_NG_OFFSET,
  1766. NFTA_NG_SET_NAME, /* deprecated */
  1767. NFTA_NG_SET_ID, /* deprecated */
  1768. __NFTA_NG_MAX
  1769. };
  1770. #define NFTA_NG_MAX (__NFTA_NG_MAX - 1)
  1771. enum nft_ng_types {
  1772. NFT_NG_INCREMENTAL,
  1773. NFT_NG_RANDOM,
  1774. __NFT_NG_MAX
  1775. };
  1776. #define NFT_NG_MAX (__NFT_NG_MAX - 1)
  1777. enum nft_tunnel_key_ip_attributes {
  1778. NFTA_TUNNEL_KEY_IP_UNSPEC,
  1779. NFTA_TUNNEL_KEY_IP_SRC,
  1780. NFTA_TUNNEL_KEY_IP_DST,
  1781. __NFTA_TUNNEL_KEY_IP_MAX
  1782. };
  1783. #define NFTA_TUNNEL_KEY_IP_MAX (__NFTA_TUNNEL_KEY_IP_MAX - 1)
  1784. enum nft_tunnel_ip6_attributes {
  1785. NFTA_TUNNEL_KEY_IP6_UNSPEC,
  1786. NFTA_TUNNEL_KEY_IP6_SRC,
  1787. NFTA_TUNNEL_KEY_IP6_DST,
  1788. NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
  1789. __NFTA_TUNNEL_KEY_IP6_MAX
  1790. };
  1791. #define NFTA_TUNNEL_KEY_IP6_MAX (__NFTA_TUNNEL_KEY_IP6_MAX - 1)
  1792. enum nft_tunnel_opts_attributes {
  1793. NFTA_TUNNEL_KEY_OPTS_UNSPEC,
  1794. NFTA_TUNNEL_KEY_OPTS_VXLAN,
  1795. NFTA_TUNNEL_KEY_OPTS_ERSPAN,
  1796. NFTA_TUNNEL_KEY_OPTS_GENEVE,
  1797. __NFTA_TUNNEL_KEY_OPTS_MAX
  1798. };
  1799. #define NFTA_TUNNEL_KEY_OPTS_MAX (__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
  1800. enum nft_tunnel_opts_vxlan_attributes {
  1801. NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
  1802. NFTA_TUNNEL_KEY_VXLAN_GBP,
  1803. __NFTA_TUNNEL_KEY_VXLAN_MAX
  1804. };
  1805. #define NFTA_TUNNEL_KEY_VXLAN_MAX (__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
  1806. enum nft_tunnel_opts_erspan_attributes {
  1807. NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
  1808. NFTA_TUNNEL_KEY_ERSPAN_VERSION,
  1809. NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
  1810. NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
  1811. NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
  1812. __NFTA_TUNNEL_KEY_ERSPAN_MAX
  1813. };
  1814. #define NFTA_TUNNEL_KEY_ERSPAN_MAX (__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
  1815. enum nft_tunnel_opts_geneve_attributes {
  1816. NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
  1817. NFTA_TUNNEL_KEY_GENEVE_CLASS,
  1818. NFTA_TUNNEL_KEY_GENEVE_TYPE,
  1819. NFTA_TUNNEL_KEY_GENEVE_DATA,
  1820. __NFTA_TUNNEL_KEY_GENEVE_MAX
  1821. };
  1822. #define NFTA_TUNNEL_KEY_GENEVE_MAX (__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
  1823. enum nft_tunnel_flags {
  1824. NFT_TUNNEL_F_ZERO_CSUM_TX = (1 << 0),
  1825. NFT_TUNNEL_F_DONT_FRAGMENT = (1 << 1),
  1826. NFT_TUNNEL_F_SEQ_NUMBER = (1 << 2),
  1827. };
  1828. #define NFT_TUNNEL_F_MASK (NFT_TUNNEL_F_ZERO_CSUM_TX | \
  1829. NFT_TUNNEL_F_DONT_FRAGMENT | \
  1830. NFT_TUNNEL_F_SEQ_NUMBER)
  1831. enum nft_tunnel_key_attributes {
  1832. NFTA_TUNNEL_KEY_UNSPEC,
  1833. NFTA_TUNNEL_KEY_ID,
  1834. NFTA_TUNNEL_KEY_IP,
  1835. NFTA_TUNNEL_KEY_IP6,
  1836. NFTA_TUNNEL_KEY_FLAGS,
  1837. NFTA_TUNNEL_KEY_TOS,
  1838. NFTA_TUNNEL_KEY_TTL,
  1839. NFTA_TUNNEL_KEY_SPORT,
  1840. NFTA_TUNNEL_KEY_DPORT,
  1841. NFTA_TUNNEL_KEY_OPTS,
  1842. __NFTA_TUNNEL_KEY_MAX
  1843. };
  1844. #define NFTA_TUNNEL_KEY_MAX (__NFTA_TUNNEL_KEY_MAX - 1)
  1845. enum nft_tunnel_keys {
  1846. NFT_TUNNEL_PATH,
  1847. NFT_TUNNEL_ID,
  1848. __NFT_TUNNEL_MAX
  1849. };
  1850. #define NFT_TUNNEL_MAX (__NFT_TUNNEL_MAX - 1)
  1851. enum nft_tunnel_mode {
  1852. NFT_TUNNEL_MODE_NONE,
  1853. NFT_TUNNEL_MODE_RX,
  1854. NFT_TUNNEL_MODE_TX,
  1855. __NFT_TUNNEL_MODE_MAX
  1856. };
  1857. #define NFT_TUNNEL_MODE_MAX (__NFT_TUNNEL_MODE_MAX - 1)
  1858. enum nft_tunnel_attributes {
  1859. NFTA_TUNNEL_UNSPEC,
  1860. NFTA_TUNNEL_KEY,
  1861. NFTA_TUNNEL_DREG,
  1862. NFTA_TUNNEL_MODE,
  1863. __NFTA_TUNNEL_MAX
  1864. };
  1865. #define NFTA_TUNNEL_MAX (__NFTA_TUNNEL_MAX - 1)
  1866. #endif /* _LINUX_NF_TABLES_H */