[deliverable/linux.git] / include / uapi / linux / netfilter / nf_tables.h

#ifndef _LINUX_NF_TABLES_H
#define _LINUX_NF_TABLES_H

#define NFT_CHAIN_MAXNAMELEN 32

enum nft_registers {
	NFT_REG_VERDICT,
	NFT_REG_1,
	NFT_REG_2,
	NFT_REG_3,
	NFT_REG_4,
	__NFT_REG_MAX
};
#define NFT_REG_MAX	(__NFT_REG_MAX - 1)

/**
 * enum nft_verdicts - nf_tables internal verdicts
 *
 * @NFT_CONTINUE: continue evaluation of the current rule
 * @NFT_BREAK: terminate evaluation of the current rule
 * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
 * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
 * @NFT_RETURN: return to the topmost chain on the jump stack
 *
 * The nf_tables verdicts share their numeric space with the netfilter verdicts.
 */
enum nft_verdicts {
	NFT_CONTINUE	= -1,
	NFT_BREAK	= -2,
	NFT_JUMP	= -3,
	NFT_GOTO	= -4,
	NFT_RETURN	= -5,
};

/**
 * enum nf_tables_msg_types - nf_tables netlink message types
 *
 * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
 * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
 * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
 * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
 * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
 * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
 * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
 * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
 * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
 */
enum nf_tables_msg_types {
	NFT_MSG_NEWTABLE,
	NFT_MSG_GETTABLE,
	NFT_MSG_DELTABLE,
	NFT_MSG_NEWCHAIN,
	NFT_MSG_GETCHAIN,
	NFT_MSG_DELCHAIN,
	NFT_MSG_NEWRULE,
	NFT_MSG_GETRULE,
	NFT_MSG_DELRULE,
	NFT_MSG_MAX,
};

enum nft_list_attributes {
	NFTA_LIST_UNPEC,
	NFTA_LIST_ELEM,
	__NFTA_LIST_MAX
};
#define NFTA_LIST_MAX		(__NFTA_LIST_MAX - 1)

/**
 * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
 *
 * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
 * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
 */
enum nft_hook_attributes {
	NFTA_HOOK_UNSPEC,
	NFTA_HOOK_HOOKNUM,
	NFTA_HOOK_PRIORITY,
	__NFTA_HOOK_MAX
};
#define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)

/**
 * enum nft_table_attributes - nf_tables table netlink attributes
 *
 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
 */
enum nft_table_attributes {
	NFTA_TABLE_UNSPEC,
	NFTA_TABLE_NAME,
	__NFTA_TABLE_MAX
};
#define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)

/**
 * enum nft_chain_attributes - nf_tables chain netlink attributes
 *
 * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
 * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
 * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
 * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
 */
enum nft_chain_attributes {
	NFTA_CHAIN_UNSPEC,
	NFTA_CHAIN_TABLE,
	NFTA_CHAIN_HANDLE,
	NFTA_CHAIN_NAME,
	NFTA_CHAIN_HOOK,
	__NFTA_CHAIN_MAX
};
#define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)

/**
 * enum nft_rule_attributes - nf_tables rule netlink attributes
 *
 * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
 * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
 * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
 * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
 */
enum nft_rule_attributes {
	NFTA_RULE_UNSPEC,
	NFTA_RULE_TABLE,
	NFTA_RULE_CHAIN,
	NFTA_RULE_HANDLE,
	NFTA_RULE_EXPRESSIONS,
	__NFTA_RULE_MAX
};
#define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)

enum nft_data_attributes {
	NFTA_DATA_UNSPEC,
	NFTA_DATA_VALUE,
	NFTA_DATA_VERDICT,
	__NFTA_DATA_MAX
};
#define NFTA_DATA_MAX		(__NFTA_DATA_MAX - 1)

/**
 * enum nft_verdict_attributes - nf_tables verdict netlink attributes
 *
 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
 */
enum nft_verdict_attributes {
	NFTA_VERDICT_UNSPEC,
	NFTA_VERDICT_CODE,
	NFTA_VERDICT_CHAIN,
	__NFTA_VERDICT_MAX
};
#define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)

/**
 * enum nft_expr_attributes - nf_tables expression netlink attributes
 *
 * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
 * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
 */
enum nft_expr_attributes {
	NFTA_EXPR_UNSPEC,
	NFTA_EXPR_NAME,
	NFTA_EXPR_DATA,
	__NFTA_EXPR_MAX
};
#define NFTA_EXPR_MAX		(__NFTA_EXPR_MAX - 1)

/**
 * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
 *
 * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
 * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
 */
enum nft_immediate_attributes {
	NFTA_IMMEDIATE_UNSPEC,
	NFTA_IMMEDIATE_DREG,
	NFTA_IMMEDIATE_DATA,
	__NFTA_IMMEDIATE_MAX
};
#define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)

/**
 * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
 *
 * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
 * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
 * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
 * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
 * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
 *
 * The bitwise expression performs the following operation:
 *
 * dreg = (sreg & mask) ^ xor
 *
 * which allow to express all bitwise operations:
 *
 * 		mask	xor
 * NOT:		1	1
 * OR:		0	x
 * XOR:		1	x
 * AND:		x	0
 */
enum nft_bitwise_attributes {
	NFTA_BITWISE_UNSPEC,
	NFTA_BITWISE_SREG,
	NFTA_BITWISE_DREG,
	NFTA_BITWISE_LEN,
	NFTA_BITWISE_MASK,
	NFTA_BITWISE_XOR,
	__NFTA_BITWISE_MAX
};
#define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)

/**
 * enum nft_byteorder_ops - nf_tables byteorder operators
 *
 * @NFT_BYTEORDER_NTOH: network to host operator
 * @NFT_BYTEORDER_HTON: host to network opertaor
 */
enum nft_byteorder_ops {
	NFT_BYTEORDER_NTOH,
	NFT_BYTEORDER_HTON,
};

/**
 * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
 *
 * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
 * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
 * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
 * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
 * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
 */
enum nft_byteorder_attributes {
	NFTA_BYTEORDER_UNSPEC,
	NFTA_BYTEORDER_SREG,
	NFTA_BYTEORDER_DREG,
	NFTA_BYTEORDER_OP,
	NFTA_BYTEORDER_LEN,
	NFTA_BYTEORDER_SIZE,
	__NFTA_BYTEORDER_MAX
};
#define NFTA_BYTEORDER_MAX	(__NFTA_BYTEORDER_MAX - 1)

/**
 * enum nft_cmp_ops - nf_tables relational operator
 *
 * @NFT_CMP_EQ: equal
 * @NFT_CMP_NEQ: not equal
 * @NFT_CMP_LT: less than
 * @NFT_CMP_LTE: less than or equal to
 * @NFT_CMP_GT: greater than
 * @NFT_CMP_GTE: greater than or equal to
 */
enum nft_cmp_ops {
	NFT_CMP_EQ,
	NFT_CMP_NEQ,
	NFT_CMP_LT,
	NFT_CMP_LTE,
	NFT_CMP_GT,
	NFT_CMP_GTE,
};

/**
 * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
 *
 * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
 * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
 * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
 */
enum nft_cmp_attributes {
	NFTA_CMP_UNSPEC,
	NFTA_CMP_SREG,
	NFTA_CMP_OP,
	NFTA_CMP_DATA,
	__NFTA_CMP_MAX
};
#define NFTA_CMP_MAX		(__NFTA_CMP_MAX - 1)

enum nft_set_elem_flags {
	NFT_SE_INTERVAL_END	= 0x1,
};

enum nft_set_elem_attributes {
	NFTA_SE_UNSPEC,
	NFTA_SE_KEY,
	NFTA_SE_DATA,
	NFTA_SE_FLAGS,
	__NFTA_SE_MAX
};
#define NFTA_SE_MAX		(__NFTA_SE_MAX - 1)

enum nft_set_flags {
	NFT_SET_INTERVAL	= 0x1,
	NFT_SET_MAP		= 0x2,
};

enum nft_set_attributes {
	NFTA_SET_UNSPEC,
	NFTA_SET_FLAGS,
	NFTA_SET_SREG,
	NFTA_SET_DREG,
	NFTA_SET_KLEN,
	NFTA_SET_DLEN,
	NFTA_SET_ELEMENTS,
	__NFTA_SET_MAX
};
#define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)

enum nft_hash_flags {
	NFT_HASH_MAP		= 0x1,
};

enum nft_hash_elem_attributes {
	NFTA_HE_UNSPEC,
	NFTA_HE_KEY,
	NFTA_HE_DATA,
	__NFTA_HE_MAX
};
#define NFTA_HE_MAX		(__NFTA_HE_MAX - 1)

enum nft_hash_attributes {
	NFTA_HASH_UNSPEC,
	NFTA_HASH_FLAGS,
	NFTA_HASH_SREG,
	NFTA_HASH_DREG,
	NFTA_HASH_KLEN,
	NFTA_HASH_ELEMENTS,
	__NFTA_HASH_MAX
};
#define NFTA_HASH_MAX		(__NFTA_HASH_MAX - 1)

/**
 * enum nft_payload_bases - nf_tables payload expression offset bases
 *
 * @NFT_PAYLOAD_LL_HEADER: link layer header
 * @NFT_PAYLOAD_NETWORK_HEADER: network header
 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
 */
enum nft_payload_bases {
	NFT_PAYLOAD_LL_HEADER,
	NFT_PAYLOAD_NETWORK_HEADER,
	NFT_PAYLOAD_TRANSPORT_HEADER,
};

/**
 * enum nft_payload_attributes - nf_tables payload expression netlink attributes
 *
 * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
 * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
 * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
 * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
 */
enum nft_payload_attributes {
	NFTA_PAYLOAD_UNSPEC,
	NFTA_PAYLOAD_DREG,
	NFTA_PAYLOAD_BASE,
	NFTA_PAYLOAD_OFFSET,
	NFTA_PAYLOAD_LEN,
	__NFTA_PAYLOAD_MAX
};
#define NFTA_PAYLOAD_MAX	(__NFTA_PAYLOAD_MAX - 1)

/**
 * enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
 *
 * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
 * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
 * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
 * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
 */
enum nft_exthdr_attributes {
	NFTA_EXTHDR_UNSPEC,
	NFTA_EXTHDR_DREG,
	NFTA_EXTHDR_TYPE,
	NFTA_EXTHDR_OFFSET,
	NFTA_EXTHDR_LEN,
	__NFTA_EXTHDR_MAX
};
#define NFTA_EXTHDR_MAX		(__NFTA_EXTHDR_MAX - 1)

/**
 * enum nft_meta_keys - nf_tables meta expression keys
 *
 * @NFT_META_LEN: packet length (skb->len)
 * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
 * @NFT_META_PRIORITY: packet priority (skb->priority)
 * @NFT_META_MARK: packet mark (skb->mark)
 * @NFT_META_IIF: packet input interface index (dev->ifindex)
 * @NFT_META_OIF: packet output interface index (dev->ifindex)
 * @NFT_META_IIFNAME: packet input interface name (dev->name)
 * @NFT_META_OIFNAME: packet output interface name (dev->name)
 * @NFT_META_IIFTYPE: packet input interface type (dev->type)
 * @NFT_META_OIFTYPE: packet output interface type (dev->type)
 * @NFT_META_SKUID: originating socket UID (fsuid)
 * @NFT_META_SKGID: originating socket GID (fsgid)
 * @NFT_META_NFTRACE: packet nftrace bit
 * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
 * @NFT_META_SECMARK: packet secmark (skb->secmark)
 */
enum nft_meta_keys {
	NFT_META_LEN,
	NFT_META_PROTOCOL,
	NFT_META_PRIORITY,
	NFT_META_MARK,
	NFT_META_IIF,
	NFT_META_OIF,
	NFT_META_IIFNAME,
	NFT_META_OIFNAME,
	NFT_META_IIFTYPE,
	NFT_META_OIFTYPE,
	NFT_META_SKUID,
	NFT_META_SKGID,
	NFT_META_NFTRACE,
	NFT_META_RTCLASSID,
	NFT_META_SECMARK,
};

/**
 * enum nft_meta_attributes - nf_tables meta expression netlink attributes
 *
 * @NFTA_META_DREG: destination register (NLA_U32)
 * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
 */
enum nft_meta_attributes {
	NFTA_META_UNSPEC,
	NFTA_META_DREG,
	NFTA_META_KEY,
	__NFTA_META_MAX
};
#define NFTA_META_MAX		(__NFTA_META_MAX - 1)

/**
 * enum nft_ct_keys - nf_tables ct expression keys
 *
 * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
 * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
 * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
 * @NFT_CT_MARK: conntrack mark value
 * @NFT_CT_SECMARK: conntrack secmark value
 * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
 * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
 * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
 * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
 * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
 * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
 * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
 * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
 */
enum nft_ct_keys {
	NFT_CT_STATE,
	NFT_CT_DIRECTION,
	NFT_CT_STATUS,
	NFT_CT_MARK,
	NFT_CT_SECMARK,
	NFT_CT_EXPIRATION,
	NFT_CT_HELPER,
	NFT_CT_L3PROTOCOL,
	NFT_CT_SRC,
	NFT_CT_DST,
	NFT_CT_PROTOCOL,
	NFT_CT_PROTO_SRC,
	NFT_CT_PROTO_DST,
};

/**
 * enum nft_ct_attributes - nf_tables ct expression netlink attributes
 *
 * @NFTA_CT_DREG: destination register (NLA_U32)
 * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
 * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
 */
enum nft_ct_attributes {
	NFTA_CT_UNSPEC,
	NFTA_CT_DREG,
	NFTA_CT_KEY,
	NFTA_CT_DIRECTION,
	__NFTA_CT_MAX
};
#define NFTA_CT_MAX		(__NFTA_CT_MAX - 1)

/**
 * enum nft_limit_attributes - nf_tables limit expression netlink attributes
 *
 * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
 * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
 */
enum nft_limit_attributes {
	NFTA_LIMIT_UNSPEC,
	NFTA_LIMIT_RATE,
	NFTA_LIMIT_UNIT,
	__NFTA_LIMIT_MAX
};
#define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)

/**
 * enum nft_counter_attributes - nf_tables counter expression netlink attributes
 *
 * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
 * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
 */
enum nft_counter_attributes {
	NFTA_COUNTER_UNSPEC,
	NFTA_COUNTER_BYTES,
	NFTA_COUNTER_PACKETS,
	__NFTA_COUNTER_MAX
};
#define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)

/**
 * enum nft_log_attributes - nf_tables log expression netlink attributes
 *
 * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
 * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
 * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
 * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
 */
enum nft_log_attributes {
	NFTA_LOG_UNSPEC,
	NFTA_LOG_GROUP,
	NFTA_LOG_PREFIX,
	NFTA_LOG_SNAPLEN,
	NFTA_LOG_QTHRESHOLD,
	__NFTA_LOG_MAX
};
#define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)

/**
 * enum nft_reject_types - nf_tables reject expression reject types
 *
 * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
 * @NFT_REJECT_TCP_RST: reject using TCP RST
 */
enum nft_reject_types {
	NFT_REJECT_ICMP_UNREACH,
	NFT_REJECT_TCP_RST,
};

/**
 * enum nft_reject_attributes - nf_tables reject expression netlink attributes
 *
 * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
 * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
 */
enum nft_reject_attributes {
	NFTA_REJECT_UNSPEC,
	NFTA_REJECT_TYPE,
	NFTA_REJECT_ICMP_CODE,
	__NFTA_REJECT_MAX
};
#define NFTA_REJECT_MAX		(__NFTA_REJECT_MAX - 1)

/**
 * enum nft_nat_types - nf_tables nat expression NAT types
 *
 * @NFT_NAT_SNAT: source NAT
 * @NFT_NAT_DNAT: destination NAT
 */
enum nft_nat_types {
	NFT_NAT_SNAT,
	NFT_NAT_DNAT,
};

/**
 * enum nft_nat_attributes - nf_tables nat expression netlink attributes
 *
 * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
 * @NFTA_NAT_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
 * @NFTA_NAT_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
 * @NFTA_NAT_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
 * @NFTA_NAT_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
 */
enum nft_nat_attributes {
	NFTA_NAT_UNSPEC,
	NFTA_NAT_TYPE,
	NFTA_NAT_ADDR_MIN,
	NFTA_NAT_ADDR_MAX,
	NFTA_NAT_PROTO_MIN,
	NFTA_NAT_PROTO_MAX,
	__NFTA_NAT_MAX
};
#define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)

#endif /* _LINUX_NF_TABLES_H */
Commit	Line	Data
96518518 PM	1	#ifndef _LINUX_NF_TABLES_H
	2	#define _LINUX_NF_TABLES_H
	3
	4	#define NFT_CHAIN_MAXNAMELEN 32
	5
	6	enum nft_registers {
	7	NFT_REG_VERDICT,
	8	NFT_REG_1,
	9	NFT_REG_2,
	10	NFT_REG_3,
	11	NFT_REG_4,
	12	__NFT_REG_MAX
	13	};
	14	#define NFT_REG_MAX (__NFT_REG_MAX - 1)
	15
	16	/**
	17	* enum nft_verdicts - nf_tables internal verdicts
	18	*
	19	* @NFT_CONTINUE: continue evaluation of the current rule
	20	* @NFT_BREAK: terminate evaluation of the current rule
	21	* @NFT_JUMP: push the current chain on the jump stack and jump to a chain
	22	* @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
	23	* @NFT_RETURN: return to the topmost chain on the jump stack
	24	*
	25	* The nf_tables verdicts share their numeric space with the netfilter verdicts.
	26	*/
	27	enum nft_verdicts {
	28	NFT_CONTINUE = -1,
	29	NFT_BREAK = -2,
	30	NFT_JUMP = -3,
	31	NFT_GOTO = -4,
	32	NFT_RETURN = -5,
	33	};
	34
	35	/**
	36	* enum nf_tables_msg_types - nf_tables netlink message types
	37	*
	38	* @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
	39	* @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
	40	* @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
	41	* @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
	42	* @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
	43	* @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
	44	* @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
	45	* @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
	46	* @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
	47	*/
	48	enum nf_tables_msg_types {
	49	NFT_MSG_NEWTABLE,
	50	NFT_MSG_GETTABLE,
	51	NFT_MSG_DELTABLE,
	52	NFT_MSG_NEWCHAIN,
	53	NFT_MSG_GETCHAIN,
	54	NFT_MSG_DELCHAIN,
	55	NFT_MSG_NEWRULE,
	56	NFT_MSG_GETRULE,
	57	NFT_MSG_DELRULE,
	58	NFT_MSG_MAX,
	59	};
	60
	61	enum nft_list_attributes {
	62	NFTA_LIST_UNPEC,
	63	NFTA_LIST_ELEM,
	64	__NFTA_LIST_MAX
65	};
66	#define NFTA_LIST_MAX (__NFTA_LIST_MAX - 1)
67
68	/**
69	* enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
70	*
71	* @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
72	* @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
73	*/
74	enum nft_hook_attributes {
75	NFTA_HOOK_UNSPEC,
76	NFTA_HOOK_HOOKNUM,
77	NFTA_HOOK_PRIORITY,
78	__NFTA_HOOK_MAX
79	};
80	#define NFTA_HOOK_MAX (__NFTA_HOOK_MAX - 1)
81
82	/**
83	* enum nft_table_attributes - nf_tables table netlink attributes
84	*
85	* @NFTA_TABLE_NAME: name of the table (NLA_STRING)
86	*/
87	enum nft_table_attributes {
88	NFTA_TABLE_UNSPEC,
89	NFTA_TABLE_NAME,
90	__NFTA_TABLE_MAX
91	};
92	#define NFTA_TABLE_MAX (__NFTA_TABLE_MAX - 1)
93
94	/**
95	* enum nft_chain_attributes - nf_tables chain netlink attributes
96	*
97	* @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
98	* @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
99	* @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
100	* @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
101	*/
102	enum nft_chain_attributes {
103	NFTA_CHAIN_UNSPEC,
104	NFTA_CHAIN_TABLE,
105	NFTA_CHAIN_HANDLE,
106	NFTA_CHAIN_NAME,
107	NFTA_CHAIN_HOOK,
108	__NFTA_CHAIN_MAX
109	};
110	#define NFTA_CHAIN_MAX (__NFTA_CHAIN_MAX - 1)
111
112	/**
113	* enum nft_rule_attributes - nf_tables rule netlink attributes
114	*
115	* @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
116	* @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
117	* @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
118	* @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
119	*/
120	enum nft_rule_attributes {
121	NFTA_RULE_UNSPEC,
122	NFTA_RULE_TABLE,
123	NFTA_RULE_CHAIN,
124	NFTA_RULE_HANDLE,
125	NFTA_RULE_EXPRESSIONS,
126	__NFTA_RULE_MAX
127	};
128	#define NFTA_RULE_MAX (__NFTA_RULE_MAX - 1)
129
130	enum nft_data_attributes {
131	NFTA_DATA_UNSPEC,
132	NFTA_DATA_VALUE,
133	NFTA_DATA_VERDICT,
134	__NFTA_DATA_MAX
135	};
136	#define NFTA_DATA_MAX (__NFTA_DATA_MAX - 1)
137
138	/**
139	* enum nft_verdict_attributes - nf_tables verdict netlink attributes
140	*
141	* @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
142	* @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
143	*/
144	enum nft_verdict_attributes {
145	NFTA_VERDICT_UNSPEC,
146	NFTA_VERDICT_CODE,
147	NFTA_VERDICT_CHAIN,
148	__NFTA_VERDICT_MAX
149	};
150	#define NFTA_VERDICT_MAX (__NFTA_VERDICT_MAX - 1)
151
152	/**
153	* enum nft_expr_attributes - nf_tables expression netlink attributes
154	*
155	* @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
156	* @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
157	*/
158	enum nft_expr_attributes {
159	NFTA_EXPR_UNSPEC,
160	NFTA_EXPR_NAME,
161	NFTA_EXPR_DATA,
162	__NFTA_EXPR_MAX
163	};
164	#define NFTA_EXPR_MAX (__NFTA_EXPR_MAX - 1)
165
166	/**
167	* enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
168	*
169	* @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
170	* @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
171	*/
172	enum nft_immediate_attributes {
173	NFTA_IMMEDIATE_UNSPEC,
174	NFTA_IMMEDIATE_DREG,
175	NFTA_IMMEDIATE_DATA,
176	__NFTA_IMMEDIATE_MAX
177	};
178	#define NFTA_IMMEDIATE_MAX (__NFTA_IMMEDIATE_MAX - 1)
179
180	/**
181	* enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
182	*
183	* @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
184	* @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
185	* @NFTA_BITWISE_LEN: length of operands (NLA_U32)
186	* @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
187	* @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
188	*
189	* The bitwise expression performs the following operation:
190	*
191	* dreg = (sreg & mask) ^ xor
192	*
193	* which allow to express all bitwise operations:
194	*
195	* mask xor
196	* NOT: 1 1
197	* OR: 0 x
198	* XOR: 1 x
199	* AND: x 0
200	*/
201	enum nft_bitwise_attributes {
202	NFTA_BITWISE_UNSPEC,
203	NFTA_BITWISE_SREG,
204	NFTA_BITWISE_DREG,
205	NFTA_BITWISE_LEN,
206	NFTA_BITWISE_MASK,
207	NFTA_BITWISE_XOR,
208	__NFTA_BITWISE_MAX
209	};
210	#define NFTA_BITWISE_MAX (__NFTA_BITWISE_MAX - 1)
211
212	/**
213	* enum nft_byteorder_ops - nf_tables byteorder operators
214	*
215	* @NFT_BYTEORDER_NTOH: network to host operator
216	* @NFT_BYTEORDER_HTON: host to network opertaor
217	*/
218	enum nft_byteorder_ops {
219	NFT_BYTEORDER_NTOH,
220	NFT_BYTEORDER_HTON,
221	};
222
223	/**
224	* enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
225	*
226	* @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
227	* @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
228	* @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
229	* @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
230	* @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
231	*/
232	enum nft_byteorder_attributes {
233	NFTA_BYTEORDER_UNSPEC,
234	NFTA_BYTEORDER_SREG,
235	NFTA_BYTEORDER_DREG,
236	NFTA_BYTEORDER_OP,
237	NFTA_BYTEORDER_LEN,
238	NFTA_BYTEORDER_SIZE,
239	__NFTA_BYTEORDER_MAX
240	};
241	#define NFTA_BYTEORDER_MAX (__NFTA_BYTEORDER_MAX - 1)
242
243	/**
244	* enum nft_cmp_ops - nf_tables relational operator
245	*
246	* @NFT_CMP_EQ: equal
247	* @NFT_CMP_NEQ: not equal
248	* @NFT_CMP_LT: less than
249	* @NFT_CMP_LTE: less than or equal to
250	* @NFT_CMP_GT: greater than
251	* @NFT_CMP_GTE: greater than or equal to
252	*/
253	enum nft_cmp_ops {
254	NFT_CMP_EQ,
255	NFT_CMP_NEQ,
256	NFT_CMP_LT,
257	NFT_CMP_LTE,
258	NFT_CMP_GT,
259	NFT_CMP_GTE,
260	};
261
262	/**
263	* enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
264	*
265	* @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
266	* @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
267	* @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
268	*/
269	enum nft_cmp_attributes {
270	NFTA_CMP_UNSPEC,
271	NFTA_CMP_SREG,
272	NFTA_CMP_OP,
273	NFTA_CMP_DATA,
274	__NFTA_CMP_MAX
275	};
276	#define NFTA_CMP_MAX (__NFTA_CMP_MAX - 1)
277
278	enum nft_set_elem_flags {
279	NFT_SE_INTERVAL_END = 0x1,
280	};
281
282	enum nft_set_elem_attributes {
283	NFTA_SE_UNSPEC,
284	NFTA_SE_KEY,
285	NFTA_SE_DATA,
286	NFTA_SE_FLAGS,
287	__NFTA_SE_MAX
288	};
289	#define NFTA_SE_MAX (__NFTA_SE_MAX - 1)
290
291	enum nft_set_flags {
292	NFT_SET_INTERVAL = 0x1,
293	NFT_SET_MAP = 0x2,
294	};
295
296	enum nft_set_attributes {
297	NFTA_SET_UNSPEC,
298	NFTA_SET_FLAGS,
299	NFTA_SET_SREG,
300	NFTA_SET_DREG,
301	NFTA_SET_KLEN,
302	NFTA_SET_DLEN,
303	NFTA_SET_ELEMENTS,
304	__NFTA_SET_MAX
305	};
306	#define NFTA_SET_MAX (__NFTA_SET_MAX - 1)
307
308	enum nft_hash_flags {
309	NFT_HASH_MAP = 0x1,
310	};
311
312	enum nft_hash_elem_attributes {
313	NFTA_HE_UNSPEC,
314	NFTA_HE_KEY,
315	NFTA_HE_DATA,
316	__NFTA_HE_MAX
317	};
318	#define NFTA_HE_MAX (__NFTA_HE_MAX - 1)
319
320	enum nft_hash_attributes {
321	NFTA_HASH_UNSPEC,
322	NFTA_HASH_FLAGS,
323	NFTA_HASH_SREG,
324	NFTA_HASH_DREG,
325	NFTA_HASH_KLEN,
326	NFTA_HASH_ELEMENTS,
327	__NFTA_HASH_MAX
328	};
329	#define NFTA_HASH_MAX (__NFTA_HASH_MAX - 1)
330
331	/**
332	* enum nft_payload_bases - nf_tables payload expression offset bases
333	*
334	* @NFT_PAYLOAD_LL_HEADER: link layer header
335	* @NFT_PAYLOAD_NETWORK_HEADER: network header
336	* @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
337	*/
338	enum nft_payload_bases {
339	NFT_PAYLOAD_LL_HEADER,
340	NFT_PAYLOAD_NETWORK_HEADER,
341	NFT_PAYLOAD_TRANSPORT_HEADER,
342	};
343
344	/**
345	* enum nft_payload_attributes - nf_tables payload expression netlink attributes
346	*
347	* @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
348	* @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
349	* @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
350	* @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
351	*/
352	enum nft_payload_attributes {
353	NFTA_PAYLOAD_UNSPEC,
354	NFTA_PAYLOAD_DREG,
355	NFTA_PAYLOAD_BASE,
356	NFTA_PAYLOAD_OFFSET,
357	NFTA_PAYLOAD_LEN,
358	__NFTA_PAYLOAD_MAX
359	};
360	#define NFTA_PAYLOAD_MAX (__NFTA_PAYLOAD_MAX - 1)
361
362	/**
363	* enum nft_exthdr_attributes - nf_tables IPv6 extension header expression netlink attributes
364	*
365	* @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
366	* @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
367	* @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
368	* @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
369	*/
370	enum nft_exthdr_attributes {
371	NFTA_EXTHDR_UNSPEC,
372	NFTA_EXTHDR_DREG,
373	NFTA_EXTHDR_TYPE,
374	NFTA_EXTHDR_OFFSET,
375	NFTA_EXTHDR_LEN,
376	__NFTA_EXTHDR_MAX
377	};
378	#define NFTA_EXTHDR_MAX (__NFTA_EXTHDR_MAX - 1)
379
380	/**
381	* enum nft_meta_keys - nf_tables meta expression keys
382	*
383	* @NFT_META_LEN: packet length (skb->len)
384	* @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
385	* @NFT_META_PRIORITY: packet priority (skb->priority)
386	* @NFT_META_MARK: packet mark (skb->mark)
387	* @NFT_META_IIF: packet input interface index (dev->ifindex)
388	* @NFT_META_OIF: packet output interface index (dev->ifindex)
389	* @NFT_META_IIFNAME: packet input interface name (dev->name)
390	* @NFT_META_OIFNAME: packet output interface name (dev->name)
391	* @NFT_META_IIFTYPE: packet input interface type (dev->type)
392	* @NFT_META_OIFTYPE: packet output interface type (dev->type)
393	* @NFT_META_SKUID: originating socket UID (fsuid)
394	* @NFT_META_SKGID: originating socket GID (fsgid)
395	* @NFT_META_NFTRACE: packet nftrace bit
396	* @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
397	* @NFT_META_SECMARK: packet secmark (skb->secmark)
398	*/
399	enum nft_meta_keys {
400	NFT_META_LEN,
401	NFT_META_PROTOCOL,
402	NFT_META_PRIORITY,
403	NFT_META_MARK,
404	NFT_META_IIF,
405	NFT_META_OIF,
406	NFT_META_IIFNAME,
407	NFT_META_OIFNAME,
408	NFT_META_IIFTYPE,
409	NFT_META_OIFTYPE,
410	NFT_META_SKUID,
411	NFT_META_SKGID,
412	NFT_META_NFTRACE,
413	NFT_META_RTCLASSID,
414	NFT_META_SECMARK,
415	};
416
417	/**
418	* enum nft_meta_attributes - nf_tables meta expression netlink attributes
419	*
420	* @NFTA_META_DREG: destination register (NLA_U32)
421	* @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
422	*/
423	enum nft_meta_attributes {
424	NFTA_META_UNSPEC,
425	NFTA_META_DREG,
426	NFTA_META_KEY,
427	__NFTA_META_MAX
428	};
429	#define NFTA_META_MAX (__NFTA_META_MAX - 1)
430
431	/**
432	* enum nft_ct_keys - nf_tables ct expression keys
433	*
434	* @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
435	* @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
436	* @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
437	* @NFT_CT_MARK: conntrack mark value
438	* @NFT_CT_SECMARK: conntrack secmark value
439	* @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
440	* @NFT_CT_HELPER: connection tracking helper assigned to conntrack
441	* @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
442	* @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address)
443	* @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address)
444	* @NFT_CT_PROTOCOL: conntrack layer 4 protocol
445	* @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
446	* @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
447	*/
448	enum nft_ct_keys {
449	NFT_CT_STATE,
450	NFT_CT_DIRECTION,
451	NFT_CT_STATUS,
452	NFT_CT_MARK,
453	NFT_CT_SECMARK,
454	NFT_CT_EXPIRATION,
455	NFT_CT_HELPER,
456	NFT_CT_L3PROTOCOL,
457	NFT_CT_SRC,
458	NFT_CT_DST,
459	NFT_CT_PROTOCOL,
460	NFT_CT_PROTO_SRC,
461	NFT_CT_PROTO_DST,
462	};
463
464	/**
465	* enum nft_ct_attributes - nf_tables ct expression netlink attributes
466	*
467	* @NFTA_CT_DREG: destination register (NLA_U32)
468	* @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
469	* @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
470	*/
471	enum nft_ct_attributes {
472	NFTA_CT_UNSPEC,
473	NFTA_CT_DREG,
474	NFTA_CT_KEY,
475	NFTA_CT_DIRECTION,
476	__NFTA_CT_MAX
477	};
478	#define NFTA_CT_MAX (__NFTA_CT_MAX - 1)
479
480	/**
481	* enum nft_limit_attributes - nf_tables limit expression netlink attributes
482	*
483	* @NFTA_LIMIT_RATE: refill rate (NLA_U64)
484	* @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
485	*/
486	enum nft_limit_attributes {
487	NFTA_LIMIT_UNSPEC,
488	NFTA_LIMIT_RATE,
489	NFTA_LIMIT_UNIT,
490	__NFTA_LIMIT_MAX
491	};
492	#define NFTA_LIMIT_MAX (__NFTA_LIMIT_MAX - 1)
493
494	/**
495	* enum nft_counter_attributes - nf_tables counter expression netlink attributes
496	*
497	* @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
498	* @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
499	*/
500	enum nft_counter_attributes {
501	NFTA_COUNTER_UNSPEC,
502	NFTA_COUNTER_BYTES,
503	NFTA_COUNTER_PACKETS,
504	__NFTA_COUNTER_MAX
505	};
506	#define NFTA_COUNTER_MAX (__NFTA_COUNTER_MAX - 1)
507
508	/**
509	* enum nft_log_attributes - nf_tables log expression netlink attributes
510	*
511	* @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U32)
512	* @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
513	* @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
514	* @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U32)
515	*/
516	enum nft_log_attributes {
517	NFTA_LOG_UNSPEC,
518	NFTA_LOG_GROUP,
519	NFTA_LOG_PREFIX,
520	NFTA_LOG_SNAPLEN,
521	NFTA_LOG_QTHRESHOLD,
522	__NFTA_LOG_MAX
523	};
524	#define NFTA_LOG_MAX (__NFTA_LOG_MAX - 1)
525
526	/**
527	* enum nft_reject_types - nf_tables reject expression reject types
528	*
529	* @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
530	* @NFT_REJECT_TCP_RST: reject using TCP RST
531	*/
532	enum nft_reject_types {
533	NFT_REJECT_ICMP_UNREACH,
534	NFT_REJECT_TCP_RST,
535	};
536
537	/**
538	* enum nft_reject_attributes - nf_tables reject expression netlink attributes
539	*
540	* @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
541	* @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
542	*/
543	enum nft_reject_attributes {
544	NFTA_REJECT_UNSPEC,
545	NFTA_REJECT_TYPE,
546	NFTA_REJECT_ICMP_CODE,
547	__NFTA_REJECT_MAX
548	};
549	#define NFTA_REJECT_MAX (__NFTA_REJECT_MAX - 1)
550
551	/**
552	* enum nft_nat_types - nf_tables nat expression NAT types
553	*
554	* @NFT_NAT_SNAT: source NAT
555	* @NFT_NAT_DNAT: destination NAT
556	*/
557	enum nft_nat_types {
558	NFT_NAT_SNAT,
559	NFT_NAT_DNAT,
560	};
561
562	/**
563	* enum nft_nat_attributes - nf_tables nat expression netlink attributes
564	*
565	* @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
566	* @NFTA_NAT_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
567	* @NFTA_NAT_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
568	* @NFTA_NAT_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
569	* @NFTA_NAT_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
570	*/
571	enum nft_nat_attributes {
572	NFTA_NAT_UNSPEC,
573	NFTA_NAT_TYPE,
574	NFTA_NAT_ADDR_MIN,
575	NFTA_NAT_ADDR_MAX,
576	NFTA_NAT_PROTO_MIN,
577	NFTA_NAT_PROTO_MAX,
578	__NFTA_NAT_MAX
579	};
580	#define NFTA_NAT_MAX (__NFTA_NAT_MAX - 1)
581
582	#endif /* _LINUX_NF_TABLES_H */