[deliverable/linux.git] / include / uapi / linux / netfilter / nf_tables.h

#ifndef _LINUX_NF_TABLES_H
#define _LINUX_NF_TABLES_H

#define NFT_CHAIN_MAXNAMELEN 32

enum nft_registers {
	NFT_REG_VERDICT,
	NFT_REG_1,
	NFT_REG_2,
	NFT_REG_3,
	NFT_REG_4,
	__NFT_REG_MAX
};
#define NFT_REG_MAX	(__NFT_REG_MAX - 1)

/**
 * enum nft_verdicts - nf_tables internal verdicts
 *
 * @NFT_CONTINUE: continue evaluation of the current rule
 * @NFT_BREAK: terminate evaluation of the current rule
 * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
 * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
 * @NFT_RETURN: return to the topmost chain on the jump stack
 *
 * The nf_tables verdicts share their numeric space with the netfilter verdicts.
 */
enum nft_verdicts {
	NFT_CONTINUE	= -1,
	NFT_BREAK	= -2,
	NFT_JUMP	= -3,
	NFT_GOTO	= -4,
	NFT_RETURN	= -5,
};

/**
 * enum nf_tables_msg_types - nf_tables netlink message types
 *
 * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
 * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
 * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
 * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
 * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
 * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
 * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
 * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
 * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
 * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
 * @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
 * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
 * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
 * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
 * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
 */
enum nf_tables_msg_types {
	NFT_MSG_NEWTABLE,
	NFT_MSG_GETTABLE,
	NFT_MSG_DELTABLE,
	NFT_MSG_NEWCHAIN,
	NFT_MSG_GETCHAIN,
	NFT_MSG_DELCHAIN,
	NFT_MSG_NEWRULE,
	NFT_MSG_GETRULE,
	NFT_MSG_DELRULE,
	NFT_MSG_NEWSET,
	NFT_MSG_GETSET,
	NFT_MSG_DELSET,
	NFT_MSG_NEWSETELEM,
	NFT_MSG_GETSETELEM,
	NFT_MSG_DELSETELEM,
	NFT_MSG_MAX,
};

/**
 * enum nft_list_attributes - nf_tables generic list netlink attributes
 *
 * @NFTA_LIST_ELEM: list element (NLA_NESTED)
 */
enum nft_list_attributes {
	NFTA_LIST_UNPEC,
	NFTA_LIST_ELEM,
	__NFTA_LIST_MAX
};
#define NFTA_LIST_MAX		(__NFTA_LIST_MAX - 1)

/**
 * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
 *
 * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
 * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
 */
enum nft_hook_attributes {
	NFTA_HOOK_UNSPEC,
	NFTA_HOOK_HOOKNUM,
	NFTA_HOOK_PRIORITY,
	__NFTA_HOOK_MAX
};
#define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)

/**
 * enum nft_table_attributes - nf_tables table netlink attributes
 *
 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
 */
enum nft_table_attributes {
	NFTA_TABLE_UNSPEC,
	NFTA_TABLE_NAME,
	__NFTA_TABLE_MAX
};
#define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)

/**
 * enum nft_chain_attributes - nf_tables chain netlink attributes
 *
 * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
 * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
 * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
 * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
 * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
 */
enum nft_chain_attributes {
	NFTA_CHAIN_UNSPEC,
	NFTA_CHAIN_TABLE,
	NFTA_CHAIN_HANDLE,
	NFTA_CHAIN_NAME,
	NFTA_CHAIN_HOOK,
	NFTA_CHAIN_TYPE,
	__NFTA_CHAIN_MAX
};
#define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)

/**
 * enum nft_rule_attributes - nf_tables rule netlink attributes
 *
 * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
 * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
 * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
 * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
 */
enum nft_rule_attributes {
	NFTA_RULE_UNSPEC,
	NFTA_RULE_TABLE,
	NFTA_RULE_CHAIN,
	NFTA_RULE_HANDLE,
	NFTA_RULE_EXPRESSIONS,
	__NFTA_RULE_MAX
};
#define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)

/**
 * enum nft_set_flags - nf_tables set flags
 *
 * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
 * @NFT_SET_CONSTANT: set contents may not change while bound
 * @NFT_SET_INTERVAL: set contains intervals
 * @NFT_SET_MAP: set is used as a dictionary
 */
enum nft_set_flags {
	NFT_SET_ANONYMOUS		= 0x1,
	NFT_SET_CONSTANT		= 0x2,
	NFT_SET_INTERVAL		= 0x4,
	NFT_SET_MAP			= 0x8,
};

/**
 * enum nft_set_attributes - nf_tables set netlink attributes
 *
 * @NFTA_SET_TABLE: table name (NLA_STRING)
 * @NFTA_SET_NAME: set name (NLA_STRING)
 * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
 * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
 * @NFTA_SET_KEY_LEN: key data length (NLA_U32)
 * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
 * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
 */
enum nft_set_attributes {
	NFTA_SET_UNSPEC,
	NFTA_SET_TABLE,
	NFTA_SET_NAME,
	NFTA_SET_FLAGS,
	NFTA_SET_KEY_TYPE,
	NFTA_SET_KEY_LEN,
	NFTA_SET_DATA_TYPE,
	NFTA_SET_DATA_LEN,
	__NFTA_SET_MAX
};
#define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)

/**
 * enum nft_set_elem_flags - nf_tables set element flags
 *
 * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
 */
enum nft_set_elem_flags {
	NFT_SET_ELEM_INTERVAL_END	= 0x1,
};

/**
 * enum nft_set_elem_attributes - nf_tables set element netlink attributes
 *
 * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
 * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
 * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
 */
enum nft_set_elem_attributes {
	NFTA_SET_ELEM_UNSPEC,
	NFTA_SET_ELEM_KEY,
	NFTA_SET_ELEM_DATA,
	NFTA_SET_ELEM_FLAGS,
	__NFTA_SET_ELEM_MAX
};
#define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)

/**
 * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
 *
 * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
 * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
 * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
 */
enum nft_set_elem_list_attributes {
	NFTA_SET_ELEM_LIST_UNSPEC,
	NFTA_SET_ELEM_LIST_TABLE,
	NFTA_SET_ELEM_LIST_SET,
	NFTA_SET_ELEM_LIST_ELEMENTS,
	__NFTA_SET_ELEM_LIST_MAX
};
#define NFTA_SET_ELEM_LIST_MAX	(__NFTA_SET_ELEM_LIST_MAX - 1)

/**
 * enum nft_data_types - nf_tables data types
 *
 * @NFT_DATA_VALUE: generic data
 * @NFT_DATA_VERDICT: netfilter verdict
 *
 * The type of data is usually determined by the kernel directly and is not
 * explicitly specified by userspace. The only difference are sets, where
 * userspace specifies the key and mapping data types.
 *
 * The values 0xffffff00-0xffffffff are reserved for internally used types.
 * The remaining range can be freely used by userspace to encode types, all
 * values are equivalent to NFT_DATA_VALUE.
 */
enum nft_data_types {
	NFT_DATA_VALUE,
	NFT_DATA_VERDICT	= 0xffffff00U,
};

#define NFT_DATA_RESERVED_MASK	0xffffff00U

/**
 * enum nft_data_attributes - nf_tables data netlink attributes
 *
 * @NFTA_DATA_VALUE: generic data (NLA_BINARY)
 * @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
 */
enum nft_data_attributes {
	NFTA_DATA_UNSPEC,
	NFTA_DATA_VALUE,
	NFTA_DATA_VERDICT,
	__NFTA_DATA_MAX
};
#define NFTA_DATA_MAX		(__NFTA_DATA_MAX - 1)

/**
 * enum nft_verdict_attributes - nf_tables verdict netlink attributes
 *
 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
 */
enum nft_verdict_attributes {
	NFTA_VERDICT_UNSPEC,
	NFTA_VERDICT_CODE,
	NFTA_VERDICT_CHAIN,
	__NFTA_VERDICT_MAX
};
#define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)

/**
 * enum nft_expr_attributes - nf_tables expression netlink attributes
 *
 * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
 * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
 */
enum nft_expr_attributes {
	NFTA_EXPR_UNSPEC,
	NFTA_EXPR_NAME,
	NFTA_EXPR_DATA,
	__NFTA_EXPR_MAX
};
#define NFTA_EXPR_MAX		(__NFTA_EXPR_MAX - 1)

/**
 * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
 *
 * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
 * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
 */
enum nft_immediate_attributes {
	NFTA_IMMEDIATE_UNSPEC,
	NFTA_IMMEDIATE_DREG,
	NFTA_IMMEDIATE_DATA,
	__NFTA_IMMEDIATE_MAX
};
#define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)

/**
 * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
 *
 * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
 * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
 * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
 * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
 * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
 *
 * The bitwise expression performs the following operation:
 *
 * dreg = (sreg & mask) ^ xor
 *
 * which allow to express all bitwise operations:
 *
 * 		mask	xor
 * NOT:		1	1
 * OR:		0	x
 * XOR:		1	x
 * AND:		x	0
 */
enum nft_bitwise_attributes {
	NFTA_BITWISE_UNSPEC,
	NFTA_BITWISE_SREG,
	NFTA_BITWISE_DREG,
	NFTA_BITWISE_LEN,
	NFTA_BITWISE_MASK,
	NFTA_BITWISE_XOR,
	__NFTA_BITWISE_MAX
};
#define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)

/**
 * enum nft_byteorder_ops - nf_tables byteorder operators
 *
 * @NFT_BYTEORDER_NTOH: network to host operator
 * @NFT_BYTEORDER_HTON: host to network opertaor
 */
enum nft_byteorder_ops {
	NFT_BYTEORDER_NTOH,
	NFT_BYTEORDER_HTON,
};

/**
 * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
 *
 * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
 * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
 * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
 * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
 * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
 */
enum nft_byteorder_attributes {
	NFTA_BYTEORDER_UNSPEC,
	NFTA_BYTEORDER_SREG,
	NFTA_BYTEORDER_DREG,
	NFTA_BYTEORDER_OP,
	NFTA_BYTEORDER_LEN,
	NFTA_BYTEORDER_SIZE,
	__NFTA_BYTEORDER_MAX
};
#define NFTA_BYTEORDER_MAX	(__NFTA_BYTEORDER_MAX - 1)

/**
 * enum nft_cmp_ops - nf_tables relational operator
 *
 * @NFT_CMP_EQ: equal
 * @NFT_CMP_NEQ: not equal
 * @NFT_CMP_LT: less than
 * @NFT_CMP_LTE: less than or equal to
 * @NFT_CMP_GT: greater than
 * @NFT_CMP_GTE: greater than or equal to
 */
enum nft_cmp_ops {
	NFT_CMP_EQ,
	NFT_CMP_NEQ,
	NFT_CMP_LT,
	NFT_CMP_LTE,
	NFT_CMP_GT,
	NFT_CMP_GTE,
};

/**
 * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
 *
 * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
 * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
 * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
 */
enum nft_cmp_attributes {
	NFTA_CMP_UNSPEC,
	NFTA_CMP_SREG,
	NFTA_CMP_OP,
	NFTA_CMP_DATA,
	__NFTA_CMP_MAX
};
#define NFTA_CMP_MAX		(__NFTA_CMP_MAX - 1)

/**
 * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
 *
 * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
 * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
 * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
 */
enum nft_lookup_attributes {
	NFTA_LOOKUP_UNSPEC,
	NFTA_LOOKUP_SET,
	NFTA_LOOKUP_SREG,
	NFTA_LOOKUP_DREG,
	__NFTA_LOOKUP_MAX
};
#define NFTA_LOOKUP_MAX		(__NFTA_LOOKUP_MAX - 1)

/**
 * enum nft_payload_bases - nf_tables payload expression offset bases
 *
 * @NFT_PAYLOAD_LL_HEADER: link layer header
 * @NFT_PAYLOAD_NETWORK_HEADER: network header
 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
 */
enum nft_payload_bases {
	NFT_PAYLOAD_LL_HEADER,
	NFT_PAYLOAD_NETWORK_HEADER,
	NFT_PAYLOAD_TRANSPORT_HEADER,
};

/**
 * enum nft_payload_attributes - nf_tables payload expression netlink attributes
 *
 * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
 * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
 * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
 * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
 */
enum nft_payload_attributes {
	NFTA_PAYLOAD_UNSPEC,
	NFTA_PAYLOAD_DREG,
	NFTA_PAYLOAD_BASE,
	NFTA_PAYLOAD_OFFSET,
	NFTA_PAYLOAD_LEN,
	__NFTA_PAYLOAD_MAX
};
#define NFTA_PAYLOAD_MAX	(__NFTA_PAYLOAD_MAX - 1)

/**
 * enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
 *
 * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
 * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
 * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
 * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
 */
enum nft_exthdr_attributes {
	NFTA_EXTHDR_UNSPEC,
	NFTA_EXTHDR_DREG,
	NFTA_EXTHDR_TYPE,
	NFTA_EXTHDR_OFFSET,
	NFTA_EXTHDR_LEN,
	__NFTA_EXTHDR_MAX
};
#define NFTA_EXTHDR_MAX		(__NFTA_EXTHDR_MAX - 1)

/**
 * enum nft_meta_keys - nf_tables meta expression keys
 *
 * @NFT_META_LEN: packet length (skb->len)
 * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
 * @NFT_META_PRIORITY: packet priority (skb->priority)
 * @NFT_META_MARK: packet mark (skb->mark)
 * @NFT_META_IIF: packet input interface index (dev->ifindex)
 * @NFT_META_OIF: packet output interface index (dev->ifindex)
 * @NFT_META_IIFNAME: packet input interface name (dev->name)
 * @NFT_META_OIFNAME: packet output interface name (dev->name)
 * @NFT_META_IIFTYPE: packet input interface type (dev->type)
 * @NFT_META_OIFTYPE: packet output interface type (dev->type)
 * @NFT_META_SKUID: originating socket UID (fsuid)
 * @NFT_META_SKGID: originating socket GID (fsgid)
 * @NFT_META_NFTRACE: packet nftrace bit
 * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
 * @NFT_META_SECMARK: packet secmark (skb->secmark)
 */
enum nft_meta_keys {
	NFT_META_LEN,
	NFT_META_PROTOCOL,
	NFT_META_PRIORITY,
	NFT_META_MARK,
	NFT_META_IIF,
	NFT_META_OIF,
	NFT_META_IIFNAME,
	NFT_META_OIFNAME,
	NFT_META_IIFTYPE,
	NFT_META_OIFTYPE,
	NFT_META_SKUID,
	NFT_META_SKGID,
	NFT_META_NFTRACE,
	NFT_META_RTCLASSID,
	NFT_META_SECMARK,
};

/**
 * enum nft_meta_attributes - nf_tables meta expression netlink attributes
 *
 * @NFTA_META_DREG: destination register (NLA_U32)
 * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
 */
enum nft_meta_attributes {
	NFTA_META_UNSPEC,
	NFTA_META_DREG,
	NFTA_META_KEY,
	__NFTA_META_MAX
};
#define NFTA_META_MAX		(__NFTA_META_MAX - 1)

/**
 * enum nft_ct_keys - nf_tables ct expression keys
 *
 * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
 * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
 * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
 * @NFT_CT_MARK: conntrack mark value
 * @NFT_CT_SECMARK: conntrack secmark value
 * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
 * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
 * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
 * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
 * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
 * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
 * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
 * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
 */
enum nft_ct_keys {
	NFT_CT_STATE,
	NFT_CT_DIRECTION,
	NFT_CT_STATUS,
	NFT_CT_MARK,
	NFT_CT_SECMARK,
	NFT_CT_EXPIRATION,
	NFT_CT_HELPER,
	NFT_CT_L3PROTOCOL,
	NFT_CT_SRC,
	NFT_CT_DST,
	NFT_CT_PROTOCOL,
	NFT_CT_PROTO_SRC,
	NFT_CT_PROTO_DST,
};

/**
 * enum nft_ct_attributes - nf_tables ct expression netlink attributes
 *
 * @NFTA_CT_DREG: destination register (NLA_U32)
 * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
 * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
 */
enum nft_ct_attributes {
	NFTA_CT_UNSPEC,
	NFTA_CT_DREG,
	NFTA_CT_KEY,
	NFTA_CT_DIRECTION,
	__NFTA_CT_MAX
};
#define NFTA_CT_MAX		(__NFTA_CT_MAX - 1)

/**
 * enum nft_limit_attributes - nf_tables limit expression netlink attributes
 *
 * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
 * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
 */
enum nft_limit_attributes {
	NFTA_LIMIT_UNSPEC,
	NFTA_LIMIT_RATE,
	NFTA_LIMIT_UNIT,
	__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)

/**
 * enum nft_counter_attributes - nf_tables counter expression netlink attributes
 *
 * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
 * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
 */
enum nft_counter_attributes {
	NFTA_COUNTER_UNSPEC,
	NFTA_COUNTER_BYTES,
	NFTA_COUNTER_PACKETS,
	__NFTA_COUNTER_MAX
};
#define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)

/**
 * enum nft_log_attributes - nf_tables log expression netlink attributes
 *
 * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
 * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
 * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
 * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
 */
enum nft_log_attributes {
	NFTA_LOG_UNSPEC,
	NFTA_LOG_GROUP,
	NFTA_LOG_PREFIX,
	NFTA_LOG_SNAPLEN,
	NFTA_LOG_QTHRESHOLD,
	__NFTA_LOG_MAX
};
#define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)

/**
 * enum nft_reject_types - nf_tables reject expression reject types
 *
 * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
 * @NFT_REJECT_TCP_RST: reject using TCP RST
 */
enum nft_reject_types {
	NFT_REJECT_ICMP_UNREACH,
	NFT_REJECT_TCP_RST,
};

/**
 * enum nft_reject_attributes - nf_tables reject expression netlink attributes
 *
 * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
 * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
 */
enum nft_reject_attributes {
	NFTA_REJECT_UNSPEC,
	NFTA_REJECT_TYPE,
	NFTA_REJECT_ICMP_CODE,
	__NFTA_REJECT_MAX
};
#define NFTA_REJECT_MAX		(__NFTA_REJECT_MAX - 1)

/**
 * enum nft_nat_types - nf_tables nat expression NAT types
 *
 * @NFT_NAT_SNAT: source NAT
 * @NFT_NAT_DNAT: destination NAT
 */
enum nft_nat_types {
	NFT_NAT_SNAT,
	NFT_NAT_DNAT,
};

/**
 * enum nft_nat_attributes - nf_tables nat expression netlink attributes
 *
 * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
 * @NFTA_NAT_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
 * @NFTA_NAT_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
 * @NFTA_NAT_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
 * @NFTA_NAT_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
 */
enum nft_nat_attributes {
	NFTA_NAT_UNSPEC,
	NFTA_NAT_TYPE,
	NFTA_NAT_ADDR_MIN,
	NFTA_NAT_ADDR_MAX,
	NFTA_NAT_PROTO_MIN,
	NFTA_NAT_PROTO_MAX,
	__NFTA_NAT_MAX
};
#define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)

#endif /* _LINUX_NF_TABLES_H */
Commit	Line	Data
96518518 PM	1	#ifndef _LINUX_NF_TABLES_H
	2	#define _LINUX_NF_TABLES_H
	3
	4	#define NFT_CHAIN_MAXNAMELEN 32
	5
	6	enum nft_registers {
	7	NFT_REG_VERDICT,
	8	NFT_REG_1,
	9	NFT_REG_2,
	10	NFT_REG_3,
	11	NFT_REG_4,
	12	__NFT_REG_MAX
	13	};
	14	#define NFT_REG_MAX (__NFT_REG_MAX - 1)
	15
	16	/**
	17	* enum nft_verdicts - nf_tables internal verdicts
	18	*
	19	* @NFT_CONTINUE: continue evaluation of the current rule
	20	* @NFT_BREAK: terminate evaluation of the current rule
	21	* @NFT_JUMP: push the current chain on the jump stack and jump to a chain
	22	* @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
	23	* @NFT_RETURN: return to the topmost chain on the jump stack
	24	*
	25	* The nf_tables verdicts share their numeric space with the netfilter verdicts.
	26	*/
	27	enum nft_verdicts {
	28	NFT_CONTINUE = -1,
	29	NFT_BREAK = -2,
	30	NFT_JUMP = -3,
	31	NFT_GOTO = -4,
	32	NFT_RETURN = -5,
	33	};
	34
	35	/**
	36	* enum nf_tables_msg_types - nf_tables netlink message types
	37	*
	38	* @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
	39	* @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
	40	* @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
	41	* @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
	42	* @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
	43	* @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
	44	* @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
	45	* @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
	46	* @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
20a69341 PM	47	* @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
	48	* @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
	49	* @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
	50	* @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
	51	* @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
	52	* @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
96518518 PM	53	*/
	54	enum nf_tables_msg_types {
	55	NFT_MSG_NEWTABLE,
	56	NFT_MSG_GETTABLE,
	57	NFT_MSG_DELTABLE,
	58	NFT_MSG_NEWCHAIN,
	59	NFT_MSG_GETCHAIN,
	60	NFT_MSG_DELCHAIN,
	61	NFT_MSG_NEWRULE,
	62	NFT_MSG_GETRULE,
	63	NFT_MSG_DELRULE,
20a69341 PM	64	NFT_MSG_NEWSET,
	65	NFT_MSG_GETSET,
	66	NFT_MSG_DELSET,
	67	NFT_MSG_NEWSETELEM,
	68	NFT_MSG_GETSETELEM,
	69	NFT_MSG_DELSETELEM,
96518518 PM	70	NFT_MSG_MAX,
	71	};
	72
20a69341 PM	73	/**
	74	* enum nft_list_attributes - nf_tables generic list netlink attributes
	75	*
	76	* @NFTA_LIST_ELEM: list element (NLA_NESTED)
	77	*/
96518518 PM	78	enum nft_list_attributes {
	79	NFTA_LIST_UNPEC,
	80	NFTA_LIST_ELEM,
	81	__NFTA_LIST_MAX
	82	};
	83	#define NFTA_LIST_MAX (__NFTA_LIST_MAX - 1)
	84
	85	/**
	86	* enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
	87	*
	88	* @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
	89	* @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
	90	*/
	91	enum nft_hook_attributes {
	92	NFTA_HOOK_UNSPEC,
	93	NFTA_HOOK_HOOKNUM,
	94	NFTA_HOOK_PRIORITY,
	95	__NFTA_HOOK_MAX
	96	};
	97	#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
	98
	99	/**
	100	* enum nft_table_attributes - nf_tables table netlink attributes
	101	*
	102	* @NFTA_TABLE_NAME: name of the table (NLA_STRING)
	103	*/
	104	enum nft_table_attributes {
	105	NFTA_TABLE_UNSPEC,
	106	NFTA_TABLE_NAME,
	107	__NFTA_TABLE_MAX
	108	};
	109	#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
	110
	111	/**
	112	* enum nft_chain_attributes - nf_tables chain netlink attributes
	113	*
	114	* @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
	115	* @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
	116	* @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
	117	* @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
9370761c	118	* @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
96518518 PM	119	*/
	120	enum nft_chain_attributes {
	121	NFTA_CHAIN_UNSPEC,
	122	NFTA_CHAIN_TABLE,
	123	NFTA_CHAIN_HANDLE,
	124	NFTA_CHAIN_NAME,
	125	NFTA_CHAIN_HOOK,
9370761c	126	NFTA_CHAIN_TYPE,
96518518 PM	127	__NFTA_CHAIN_MAX
	128	};
	129	#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
	130
	131	/**
	132	* enum nft_rule_attributes - nf_tables rule netlink attributes
	133	*
	134	* @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
	135	* @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
	136	* @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
	137	* @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
	138	*/
	139	enum nft_rule_attributes {
	140	NFTA_RULE_UNSPEC,
	141	NFTA_RULE_TABLE,
	142	NFTA_RULE_CHAIN,
	143	NFTA_RULE_HANDLE,
	144	NFTA_RULE_EXPRESSIONS,
	145	__NFTA_RULE_MAX
	146	};
	147	#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
	148
20a69341 PM	149	/**
	150	* enum nft_set_flags - nf_tables set flags
	151	*
	152	* @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
	153	* @NFT_SET_CONSTANT: set contents may not change while bound
	154	* @NFT_SET_INTERVAL: set contains intervals
	155	* @NFT_SET_MAP: set is used as a dictionary
	156	*/
	157	enum nft_set_flags {
	158	NFT_SET_ANONYMOUS = 0x1,
	159	NFT_SET_CONSTANT = 0x2,
	160	NFT_SET_INTERVAL = 0x4,
	161	NFT_SET_MAP = 0x8,
	162	};
	163
	164	/**
	165	* enum nft_set_attributes - nf_tables set netlink attributes
	166	*
	167	* @NFTA_SET_TABLE: table name (NLA_STRING)
	168	* @NFTA_SET_NAME: set name (NLA_STRING)
	169	* @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
	170	* @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
	171	* @NFTA_SET_KEY_LEN: key data length (NLA_U32)
	172	* @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
	173	* @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
	174	*/
	175	enum nft_set_attributes {
	176	NFTA_SET_UNSPEC,
	177	NFTA_SET_TABLE,
	178	NFTA_SET_NAME,
	179	NFTA_SET_FLAGS,
	180	NFTA_SET_KEY_TYPE,
	181	NFTA_SET_KEY_LEN,
	182	NFTA_SET_DATA_TYPE,
	183	NFTA_SET_DATA_LEN,
	184	__NFTA_SET_MAX
	185	};
	186	#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
	187
	188	/**
	189	* enum nft_set_elem_flags - nf_tables set element flags
	190	*
	191	* @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
	192	*/
	193	enum nft_set_elem_flags {
	194	NFT_SET_ELEM_INTERVAL_END = 0x1,
	195	};
	196
	197	/**
	198	* enum nft_set_elem_attributes - nf_tables set element netlink attributes
	199	*
	200	* @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
	201	* @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
	202	* @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
	203	*/
	204	enum nft_set_elem_attributes {
	205	NFTA_SET_ELEM_UNSPEC,
	206	NFTA_SET_ELEM_KEY,
	207	NFTA_SET_ELEM_DATA,
	208	NFTA_SET_ELEM_FLAGS,
	209	__NFTA_SET_ELEM_MAX
	210	};
	211	#define NFTA_SET_ELEM_MAX (__NFTA_SET_ELEM_MAX - 1)
	212
213	/**
214	* enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
215	*
216	* @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
217	* @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
218	* @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
219	*/
220	enum nft_set_elem_list_attributes {
221	NFTA_SET_ELEM_LIST_UNSPEC,
222	NFTA_SET_ELEM_LIST_TABLE,
223	NFTA_SET_ELEM_LIST_SET,
224	NFTA_SET_ELEM_LIST_ELEMENTS,
225	__NFTA_SET_ELEM_LIST_MAX
226	};
227	#define NFTA_SET_ELEM_LIST_MAX (__NFTA_SET_ELEM_LIST_MAX - 1)
228
229	/**
230	* enum nft_data_types - nf_tables data types
231	*
232	* @NFT_DATA_VALUE: generic data
233	* @NFT_DATA_VERDICT: netfilter verdict
234	*
235	* The type of data is usually determined by the kernel directly and is not
236	* explicitly specified by userspace. The only difference are sets, where
237	* userspace specifies the key and mapping data types.
238	*
239	* The values 0xffffff00-0xffffffff are reserved for internally used types.
240	* The remaining range can be freely used by userspace to encode types, all
241	* values are equivalent to NFT_DATA_VALUE.
242	*/
243	enum nft_data_types {
244	NFT_DATA_VALUE,
245	NFT_DATA_VERDICT = 0xffffff00U,
246	};
247
248	#define NFT_DATA_RESERVED_MASK 0xffffff00U
249
250	/**
251	* enum nft_data_attributes - nf_tables data netlink attributes
252	*
253	* @NFTA_DATA_VALUE: generic data (NLA_BINARY)
254	* @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
255	*/
96518518 PM	256	enum nft_data_attributes {
	257	NFTA_DATA_UNSPEC,
	258	NFTA_DATA_VALUE,
	259	NFTA_DATA_VERDICT,
	260	__NFTA_DATA_MAX
	261	};
	262	#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
	263
	264	/**
	265	* enum nft_verdict_attributes - nf_tables verdict netlink attributes
	266	*
	267	* @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
	268	* @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
	269	*/
	270	enum nft_verdict_attributes {
	271	NFTA_VERDICT_UNSPEC,
	272	NFTA_VERDICT_CODE,
	273	NFTA_VERDICT_CHAIN,
	274	__NFTA_VERDICT_MAX
	275	};
	276	#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
	277
	278	/**
	279	* enum nft_expr_attributes - nf_tables expression netlink attributes
	280	*
	281	* @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
	282	* @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
	283	*/
	284	enum nft_expr_attributes {
	285	NFTA_EXPR_UNSPEC,
	286	NFTA_EXPR_NAME,
	287	NFTA_EXPR_DATA,
	288	__NFTA_EXPR_MAX
	289	};
	290	#define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1)
	291
	292	/**
	293	* enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
	294	*
	295	* @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
	296	* @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
	297	*/
	298	enum nft_immediate_attributes {
	299	NFTA_IMMEDIATE_UNSPEC,
	300	NFTA_IMMEDIATE_DREG,
	301	NFTA_IMMEDIATE_DATA,
	302	__NFTA_IMMEDIATE_MAX
	303	};
	304	#define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1)
	305
	306	/**
	307	* enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
	308	*
	309	* @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
	310	* @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
	311	* @NFTA_BITWISE_LEN: length of operands (NLA_U32)
	312	* @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
	313	* @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
	314	*
	315	* The bitwise expression performs the following operation:
	316	*
	317	* dreg = (sreg & mask) ^ xor
	318	*
	319	* which allow to express all bitwise operations:
320	*
321	* mask xor
322	* NOT: 1 1
323	* OR: 0 x
324	* XOR: 1 x
325	* AND: x 0
326	*/
327	enum nft_bitwise_attributes {
328	NFTA_BITWISE_UNSPEC,
329	NFTA_BITWISE_SREG,
330	NFTA_BITWISE_DREG,
331	NFTA_BITWISE_LEN,
332	NFTA_BITWISE_MASK,
333	NFTA_BITWISE_XOR,
334	__NFTA_BITWISE_MAX
335	};
336	#define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1)
337
338	/**
339	* enum nft_byteorder_ops - nf_tables byteorder operators
340	*
341	* @NFT_BYTEORDER_NTOH: network to host operator
342	* @NFT_BYTEORDER_HTON: host to network opertaor
343	*/
344	enum nft_byteorder_ops {
345	NFT_BYTEORDER_NTOH,
346	NFT_BYTEORDER_HTON,
347	};
348
349	/**
350	* enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
351	*
352	* @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
353	* @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
354	* @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
355	* @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
356	* @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
357	*/
358	enum nft_byteorder_attributes {
359	NFTA_BYTEORDER_UNSPEC,
360	NFTA_BYTEORDER_SREG,
361	NFTA_BYTEORDER_DREG,
362	NFTA_BYTEORDER_OP,
363	NFTA_BYTEORDER_LEN,
364	NFTA_BYTEORDER_SIZE,
365	__NFTA_BYTEORDER_MAX
366	};
367	#define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1)
368
369	/**
370	* enum nft_cmp_ops - nf_tables relational operator
371	*
372	* @NFT_CMP_EQ: equal
373	* @NFT_CMP_NEQ: not equal
374	* @NFT_CMP_LT: less than
375	* @NFT_CMP_LTE: less than or equal to
376	* @NFT_CMP_GT: greater than
377	* @NFT_CMP_GTE: greater than or equal to
378	*/
379	enum nft_cmp_ops {
380	NFT_CMP_EQ,
381	NFT_CMP_NEQ,
382	NFT_CMP_LT,
383	NFT_CMP_LTE,
384	NFT_CMP_GT,
385	NFT_CMP_GTE,
386	};
387
388	/**
389	* enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
390	*
391	* @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
392	* @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
393	* @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
394	*/
395	enum nft_cmp_attributes {
396	NFTA_CMP_UNSPEC,
397	NFTA_CMP_SREG,
398	NFTA_CMP_OP,
399	NFTA_CMP_DATA,
400	__NFTA_CMP_MAX
401	};
402	#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
403
20a69341 PM	404	/**
	405	* enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
	406	*
	407	* @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
	408	* @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
	409	* @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
	410	*/
	411	enum nft_lookup_attributes {
	412	NFTA_LOOKUP_UNSPEC,
	413	NFTA_LOOKUP_SET,
	414	NFTA_LOOKUP_SREG,
	415	NFTA_LOOKUP_DREG,
	416	__NFTA_LOOKUP_MAX
96518518	417	};
20a69341	418	#define NFTA_LOOKUP_MAX (__NFTA_LOOKUP_MAX - 1)
96518518 PM	419
	420	/**
	421	* enum nft_payload_bases - nf_tables payload expression offset bases
	422	*
	423	* @NFT_PAYLOAD_LL_HEADER: link layer header
	424	* @NFT_PAYLOAD_NETWORK_HEADER: network header
	425	* @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
	426	*/
	427	enum nft_payload_bases {
	428	NFT_PAYLOAD_LL_HEADER,
	429	NFT_PAYLOAD_NETWORK_HEADER,
	430	NFT_PAYLOAD_TRANSPORT_HEADER,
	431	};
	432
	433	/**
	434	* enum nft_payload_attributes - nf_tables payload expression netlink attributes
	435	*
	436	* @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
	437	* @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
	438	* @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
	439	* @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
	440	*/
	441	enum nft_payload_attributes {
	442	NFTA_PAYLOAD_UNSPEC,
	443	NFTA_PAYLOAD_DREG,
	444	NFTA_PAYLOAD_BASE,
	445	NFTA_PAYLOAD_OFFSET,
	446	NFTA_PAYLOAD_LEN,
	447	__NFTA_PAYLOAD_MAX
	448	};
	449	#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
	450
	451	/**
	452	* enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
	453	*
	454	* @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
	455	* @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
	456	* @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
	457	* @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
	458	*/
	459	enum nft_exthdr_attributes {
	460	NFTA_EXTHDR_UNSPEC,
	461	NFTA_EXTHDR_DREG,
	462	NFTA_EXTHDR_TYPE,
	463	NFTA_EXTHDR_OFFSET,
	464	NFTA_EXTHDR_LEN,
	465	__NFTA_EXTHDR_MAX
	466	};
	467	#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
	468
	469	/**
	470	* enum nft_meta_keys - nf_tables meta expression keys
	471	*
	472	* @NFT_META_LEN: packet length (skb->len)
	473	* @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
	474	* @NFT_META_PRIORITY: packet priority (skb->priority)
	475	* @NFT_META_MARK: packet mark (skb->mark)
	476	* @NFT_META_IIF: packet input interface index (dev->ifindex)
	477	* @NFT_META_OIF: packet output interface index (dev->ifindex)
	478	* @NFT_META_IIFNAME: packet input interface name (dev->name)
	479	* @NFT_META_OIFNAME: packet output interface name (dev->name)
	480	* @NFT_META_IIFTYPE: packet input interface type (dev->type)
	481	* @NFT_META_OIFTYPE: packet output interface type (dev->type)
	482	* @NFT_META_SKUID: originating socket UID (fsuid)
483	* @NFT_META_SKGID: originating socket GID (fsgid)
484	* @NFT_META_NFTRACE: packet nftrace bit
485	* @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
486	* @NFT_META_SECMARK: packet secmark (skb->secmark)
487	*/
488	enum nft_meta_keys {
489	NFT_META_LEN,
490	NFT_META_PROTOCOL,
491	NFT_META_PRIORITY,
492	NFT_META_MARK,
493	NFT_META_IIF,
494	NFT_META_OIF,
495	NFT_META_IIFNAME,
496	NFT_META_OIFNAME,
497	NFT_META_IIFTYPE,
498	NFT_META_OIFTYPE,
499	NFT_META_SKUID,
500	NFT_META_SKGID,
501	NFT_META_NFTRACE,
502	NFT_META_RTCLASSID,
503	NFT_META_SECMARK,
504	};
505
506	/**
507	* enum nft_meta_attributes - nf_tables meta expression netlink attributes
508	*
509	* @NFTA_META_DREG: destination register (NLA_U32)
510	* @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
511	*/
512	enum nft_meta_attributes {
513	NFTA_META_UNSPEC,
514	NFTA_META_DREG,
515	NFTA_META_KEY,
516	__NFTA_META_MAX
517	};
518	#define NFTA_META_MAX (__NFTA_META_MAX - 1)
519
520	/**
521	* enum nft_ct_keys - nf_tables ct expression keys
522	*
523	* @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
524	* @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
525	* @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
526	* @NFT_CT_MARK: conntrack mark value
527	* @NFT_CT_SECMARK: conntrack secmark value
528	* @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
529	* @NFT_CT_HELPER: connection tracking helper assigned to conntrack
530	* @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
531	* @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
532	* @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
533	* @NFT_CT_PROTOCOL: conntrack layer 4 protocol
534	* @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
535	* @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
536	*/
537	enum nft_ct_keys {
538	NFT_CT_STATE,
539	NFT_CT_DIRECTION,
540	NFT_CT_STATUS,
541	NFT_CT_MARK,
542	NFT_CT_SECMARK,
543	NFT_CT_EXPIRATION,
544	NFT_CT_HELPER,
545	NFT_CT_L3PROTOCOL,
546	NFT_CT_SRC,
547	NFT_CT_DST,
548	NFT_CT_PROTOCOL,
549	NFT_CT_PROTO_SRC,
550	NFT_CT_PROTO_DST,
551	};
552
553	/**
554	* enum nft_ct_attributes - nf_tables ct expression netlink attributes
555	*
556	* @NFTA_CT_DREG: destination register (NLA_U32)
557	* @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
558	* @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
559	*/
560	enum nft_ct_attributes {
561	NFTA_CT_UNSPEC,
562	NFTA_CT_DREG,
563	NFTA_CT_KEY,
564	NFTA_CT_DIRECTION,
565	__NFTA_CT_MAX
566	};
567	#define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
568
569	/**
570	* enum nft_limit_attributes - nf_tables limit expression netlink attributes
571	*
572	* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
573	* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
574	*/
575	enum nft_limit_attributes {
576	NFTA_LIMIT_UNSPEC,
577	NFTA_LIMIT_RATE,
578	NFTA_LIMIT_UNIT,
579	__NFTA_LIMIT_MAX
580	};
581	#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
582
583	/**
584	* enum nft_counter_attributes - nf_tables counter expression netlink attributes
585	*
586	* @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
587	* @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
588	*/
589	enum nft_counter_attributes {
590	NFTA_COUNTER_UNSPEC,
591	NFTA_COUNTER_BYTES,
592	NFTA_COUNTER_PACKETS,
593	__NFTA_COUNTER_MAX
594	};
595	#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
596
597	/**
598	* enum nft_log_attributes - nf_tables log expression netlink attributes
599	*
600	* @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
601	* @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
602	* @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
603	* @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
604	*/
605	enum nft_log_attributes {
606	NFTA_LOG_UNSPEC,
607	NFTA_LOG_GROUP,
608	NFTA_LOG_PREFIX,
609	NFTA_LOG_SNAPLEN,
610	NFTA_LOG_QTHRESHOLD,
611	__NFTA_LOG_MAX
612	};
613	#define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)
614
615	/**
616	* enum nft_reject_types - nf_tables reject expression reject types
617	*
618	* @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
619	* @NFT_REJECT_TCP_RST: reject using TCP RST
620	*/
621	enum nft_reject_types {
622	NFT_REJECT_ICMP_UNREACH,
623	NFT_REJECT_TCP_RST,
624	};
625
626	/**
627	* enum nft_reject_attributes - nf_tables reject expression netlink attributes
628	*
629	* @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
630	* @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
631	*/
632	enum nft_reject_attributes {
633	NFTA_REJECT_UNSPEC,
634	NFTA_REJECT_TYPE,
635	NFTA_REJECT_ICMP_CODE,
636	__NFTA_REJECT_MAX
637	};
638	#define NFTA_REJECT_MAX (__NFTA_REJECT_MAX - 1)
639
640	/**
641	* enum nft_nat_types - nf_tables nat expression NAT types
642	*
643	* @NFT_NAT_SNAT: source NAT
644	* @NFT_NAT_DNAT: destination NAT
645	*/
646	enum nft_nat_types {
647	NFT_NAT_SNAT,
648	NFT_NAT_DNAT,
649	};
650
651	/**
652	* enum nft_nat_attributes - nf_tables nat expression netlink attributes
653	*
654	* @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
655	* @NFTA_NAT_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
656	* @NFTA_NAT_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
657	* @NFTA_NAT_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
658	* @NFTA_NAT_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
659	*/
660	enum nft_nat_attributes {
661	NFTA_NAT_UNSPEC,
662	NFTA_NAT_TYPE,
663	NFTA_NAT_ADDR_MIN,
664	NFTA_NAT_ADDR_MAX,
665	NFTA_NAT_PROTO_MIN,
666	NFTA_NAT_PROTO_MAX,
667	__NFTA_NAT_MAX
668	};
669	#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
670
671	#endif /* _LINUX_NF_TABLES_H */