Where Online Learning is simpler!

The C and C++ Include Header Files

cat -n /usr/include/linux/netfilter/nf_tables.h

     1	/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
     2	#ifndef _LINUX_NF_TABLES_H
     3	#define _LINUX_NF_TABLES_H
     4	
     5	#define NFT_NAME_MAXLEN		256
     6	#define NFT_TABLE_MAXNAMELEN	NFT_NAME_MAXLEN
     7	#define NFT_CHAIN_MAXNAMELEN	NFT_NAME_MAXLEN
     8	#define NFT_SET_MAXNAMELEN	NFT_NAME_MAXLEN
     9	#define NFT_OBJ_MAXNAMELEN	NFT_NAME_MAXLEN
    10	#define NFT_USERDATA_MAXLEN	256
    11	#define NFT_OSF_MAXGENRELEN	16
    12	
    13	/**
    14	 * enum nft_registers - nf_tables registers
    15	 *
    16	 * nf_tables used to have five registers: a verdict register and four data
    17	 * registers of size 16. The data registers have been changed to 16 registers
    18	 * of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
    19	 * map to areas of size 16, the 4 byte registers are addressed using
    20	 * NFT_REG32_00 - NFT_REG32_15.
    21	 */
    22	enum nft_registers {
    23		NFT_REG_VERDICT,
    24		NFT_REG_1,
    25		NFT_REG_2,
    26		NFT_REG_3,
    27		NFT_REG_4,
    28		__NFT_REG_MAX,
    29	
    30		NFT_REG32_00	= 8,
    31		NFT_REG32_01,
    32		NFT_REG32_02,
    33		NFT_REG32_03,
    34		NFT_REG32_04,
    35		NFT_REG32_05,
    36		NFT_REG32_06,
    37		NFT_REG32_07,
    38		NFT_REG32_08,
    39		NFT_REG32_09,
    40		NFT_REG32_10,
    41		NFT_REG32_11,
    42		NFT_REG32_12,
    43		NFT_REG32_13,
    44		NFT_REG32_14,
    45		NFT_REG32_15,
    46	};
    47	#define NFT_REG_MAX	(__NFT_REG_MAX - 1)
    48	
    49	#define NFT_REG_SIZE	16
    50	#define NFT_REG32_SIZE	4
    51	#define NFT_REG32_COUNT	(NFT_REG32_15 - NFT_REG32_00 + 1)
    52	
    53	/**
    54	 * enum nft_verdicts - nf_tables internal verdicts
    55	 *
    56	 * @NFT_CONTINUE: continue evaluation of the current rule
    57	 * @NFT_BREAK: terminate evaluation of the current rule
    58	 * @NFT_JUMP: push the current chain on the jump stack and jump to a chain
    59	 * @NFT_GOTO: jump to a chain without pushing the current chain on the jump stack
    60	 * @NFT_RETURN: return to the topmost chain on the jump stack
    61	 *
    62	 * The nf_tables verdicts share their numeric space with the netfilter verdicts.
    63	 */
    64	enum nft_verdicts {
    65		NFT_CONTINUE	= -1,
    66		NFT_BREAK	= -2,
    67		NFT_JUMP	= -3,
    68		NFT_GOTO	= -4,
    69		NFT_RETURN	= -5,
    70	};
    71	
    72	/**
    73	 * enum nf_tables_msg_types - nf_tables netlink message types
    74	 *
    75	 * @NFT_MSG_NEWTABLE: create a new table (enum nft_table_attributes)
    76	 * @NFT_MSG_GETTABLE: get a table (enum nft_table_attributes)
    77	 * @NFT_MSG_DELTABLE: delete a table (enum nft_table_attributes)
    78	 * @NFT_MSG_NEWCHAIN: create a new chain (enum nft_chain_attributes)
    79	 * @NFT_MSG_GETCHAIN: get a chain (enum nft_chain_attributes)
    80	 * @NFT_MSG_DELCHAIN: delete a chain (enum nft_chain_attributes)
    81	 * @NFT_MSG_NEWRULE: create a new rule (enum nft_rule_attributes)
    82	 * @NFT_MSG_GETRULE: get a rule (enum nft_rule_attributes)
    83	 * @NFT_MSG_DELRULE: delete a rule (enum nft_rule_attributes)
    84	 * @NFT_MSG_NEWSET: create a new set (enum nft_set_attributes)
    85	 * @NFT_MSG_GETSET: get a set (enum nft_set_attributes)
    86	 * @NFT_MSG_DELSET: delete a set (enum nft_set_attributes)
    87	 * @NFT_MSG_NEWSETELEM: create a new set element (enum nft_set_elem_attributes)
    88	 * @NFT_MSG_GETSETELEM: get a set element (enum nft_set_elem_attributes)
    89	 * @NFT_MSG_DELSETELEM: delete a set element (enum nft_set_elem_attributes)
    90	 * @NFT_MSG_NEWGEN: announce a new generation, only for events (enum nft_gen_attributes)
    91	 * @NFT_MSG_GETGEN: get the rule-set generation (enum nft_gen_attributes)
    92	 * @NFT_MSG_TRACE: trace event (enum nft_trace_attributes)
    93	 * @NFT_MSG_NEWOBJ: create a stateful object (enum nft_obj_attributes)
    94	 * @NFT_MSG_GETOBJ: get a stateful object (enum nft_obj_attributes)
    95	 * @NFT_MSG_DELOBJ: delete a stateful object (enum nft_obj_attributes)
    96	 * @NFT_MSG_GETOBJ_RESET: get and reset a stateful object (enum nft_obj_attributes)
    97	 * @NFT_MSG_NEWFLOWTABLE: add new flow table (enum nft_flowtable_attributes)
    98	 * @NFT_MSG_GETFLOWTABLE: get flow table (enum nft_flowtable_attributes)
    99	 * @NFT_MSG_DELFLOWTABLE: delete flow table (enum nft_flowtable_attributes)
   100	 * @NFT_MSG_GETRULE_RESET: get rules and reset stateful expressions (enum nft_obj_attributes)
   101	 * @NFT_MSG_DESTROYTABLE: destroy a table (enum nft_table_attributes)
   102	 * @NFT_MSG_DESTROYCHAIN: destroy a chain (enum nft_chain_attributes)
   103	 * @NFT_MSG_DESTROYRULE: destroy a rule (enum nft_rule_attributes)
   104	 * @NFT_MSG_DESTROYSET: destroy a set (enum nft_set_attributes)
   105	 * @NFT_MSG_DESTROYSETELEM: destroy a set element (enum nft_set_elem_attributes)
   106	 * @NFT_MSG_DESTROYOBJ: destroy a stateful object (enum nft_object_attributes)
   107	 * @NFT_MSG_DESTROYFLOWTABLE: destroy flow table (enum nft_flowtable_attributes)
   108	 * @NFT_MSG_GETSETELEM_RESET: get set elements and reset attached stateful expressions (enum nft_set_elem_attributes)
   109	 */
   110	enum nf_tables_msg_types {
   111		NFT_MSG_NEWTABLE,
   112		NFT_MSG_GETTABLE,
   113		NFT_MSG_DELTABLE,
   114		NFT_MSG_NEWCHAIN,
   115		NFT_MSG_GETCHAIN,
   116		NFT_MSG_DELCHAIN,
   117		NFT_MSG_NEWRULE,
   118		NFT_MSG_GETRULE,
   119		NFT_MSG_DELRULE,
   120		NFT_MSG_NEWSET,
   121		NFT_MSG_GETSET,
   122		NFT_MSG_DELSET,
   123		NFT_MSG_NEWSETELEM,
   124		NFT_MSG_GETSETELEM,
   125		NFT_MSG_DELSETELEM,
   126		NFT_MSG_NEWGEN,
   127		NFT_MSG_GETGEN,
   128		NFT_MSG_TRACE,
   129		NFT_MSG_NEWOBJ,
   130		NFT_MSG_GETOBJ,
   131		NFT_MSG_DELOBJ,
   132		NFT_MSG_GETOBJ_RESET,
   133		NFT_MSG_NEWFLOWTABLE,
   134		NFT_MSG_GETFLOWTABLE,
   135		NFT_MSG_DELFLOWTABLE,
   136		NFT_MSG_GETRULE_RESET,
   137		NFT_MSG_DESTROYTABLE,
   138		NFT_MSG_DESTROYCHAIN,
   139		NFT_MSG_DESTROYRULE,
   140		NFT_MSG_DESTROYSET,
   141		NFT_MSG_DESTROYSETELEM,
   142		NFT_MSG_DESTROYOBJ,
   143		NFT_MSG_DESTROYFLOWTABLE,
   144		NFT_MSG_GETSETELEM_RESET,
   145		NFT_MSG_MAX,
   146	};
   147	
   148	/**
   149	 * enum nft_list_attributes - nf_tables generic list netlink attributes
   150	 *
   151	 * @NFTA_LIST_ELEM: list element (NLA_NESTED)
   152	 */
   153	enum nft_list_attributes {
   154		NFTA_LIST_UNSPEC,
   155		NFTA_LIST_ELEM,
   156		__NFTA_LIST_MAX
   157	};
   158	#define NFTA_LIST_MAX		(__NFTA_LIST_MAX - 1)
   159	
   160	/**
   161	 * enum nft_hook_attributes - nf_tables netfilter hook netlink attributes
   162	 *
   163	 * @NFTA_HOOK_HOOKNUM: netfilter hook number (NLA_U32)
   164	 * @NFTA_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
   165	 * @NFTA_HOOK_DEV: netdevice name (NLA_STRING)
   166	 * @NFTA_HOOK_DEVS: list of netdevices (NLA_NESTED)
   167	 */
   168	enum nft_hook_attributes {
   169		NFTA_HOOK_UNSPEC,
   170		NFTA_HOOK_HOOKNUM,
   171		NFTA_HOOK_PRIORITY,
   172		NFTA_HOOK_DEV,
   173		NFTA_HOOK_DEVS,
   174		__NFTA_HOOK_MAX
   175	};
   176	#define NFTA_HOOK_MAX		(__NFTA_HOOK_MAX - 1)
   177	
   178	/**
   179	 * enum nft_table_flags - nf_tables table flags
   180	 *
   181	 * @NFT_TABLE_F_DORMANT: this table is not active
   182	 * @NFT_TABLE_F_OWNER:   this table is owned by a process
   183	 * @NFT_TABLE_F_PERSIST: this table shall outlive its owner
   184	 */
   185	enum nft_table_flags {
   186		NFT_TABLE_F_DORMANT	= 0x1,
   187		NFT_TABLE_F_OWNER	= 0x2,
   188		NFT_TABLE_F_PERSIST	= 0x4,
   189	};
   190	#define NFT_TABLE_F_MASK	(NFT_TABLE_F_DORMANT | \
   191					 NFT_TABLE_F_OWNER | \
   192					 NFT_TABLE_F_PERSIST)
   193	
   194	/**
   195	 * enum nft_table_attributes - nf_tables table netlink attributes
   196	 *
   197	 * @NFTA_TABLE_NAME: name of the table (NLA_STRING)
   198	 * @NFTA_TABLE_FLAGS: bitmask of enum nft_table_flags (NLA_U32)
   199	 * @NFTA_TABLE_USE: number of chains in this table (NLA_U32)
   200	 * @NFTA_TABLE_USERDATA: user data (NLA_BINARY)
   201	 * @NFTA_TABLE_OWNER: owner of this table through netlink portID (NLA_U32)
   202	 */
   203	enum nft_table_attributes {
   204		NFTA_TABLE_UNSPEC,
   205		NFTA_TABLE_NAME,
   206		NFTA_TABLE_FLAGS,
   207		NFTA_TABLE_USE,
   208		NFTA_TABLE_HANDLE,
   209		NFTA_TABLE_PAD,
   210		NFTA_TABLE_USERDATA,
   211		NFTA_TABLE_OWNER,
   212		__NFTA_TABLE_MAX
   213	};
   214	#define NFTA_TABLE_MAX		(__NFTA_TABLE_MAX - 1)
   215	
   216	enum nft_chain_flags {
   217		NFT_CHAIN_BASE		= (1 << 0),
   218		NFT_CHAIN_HW_OFFLOAD	= (1 << 1),
   219		NFT_CHAIN_BINDING	= (1 << 2),
   220	};
   221	#define NFT_CHAIN_FLAGS		(NFT_CHAIN_BASE		| \
   222					 NFT_CHAIN_HW_OFFLOAD	| \
   223					 NFT_CHAIN_BINDING)
   224	
   225	/**
   226	 * enum nft_chain_attributes - nf_tables chain netlink attributes
   227	 *
   228	 * @NFTA_CHAIN_TABLE: name of the table containing the chain (NLA_STRING)
   229	 * @NFTA_CHAIN_HANDLE: numeric handle of the chain (NLA_U64)
   230	 * @NFTA_CHAIN_NAME: name of the chain (NLA_STRING)
   231	 * @NFTA_CHAIN_HOOK: hook specification for basechains (NLA_NESTED: nft_hook_attributes)
   232	 * @NFTA_CHAIN_POLICY: numeric policy of the chain (NLA_U32)
   233	 * @NFTA_CHAIN_USE: number of references to this chain (NLA_U32)
   234	 * @NFTA_CHAIN_TYPE: type name of the string (NLA_NUL_STRING)
   235	 * @NFTA_CHAIN_COUNTERS: counter specification of the chain (NLA_NESTED: nft_counter_attributes)
   236	 * @NFTA_CHAIN_FLAGS: chain flags
   237	 * @NFTA_CHAIN_ID: uniquely identifies a chain in a transaction (NLA_U32)
   238	 * @NFTA_CHAIN_USERDATA: user data (NLA_BINARY)
   239	 */
   240	enum nft_chain_attributes {
   241		NFTA_CHAIN_UNSPEC,
   242		NFTA_CHAIN_TABLE,
   243		NFTA_CHAIN_HANDLE,
   244		NFTA_CHAIN_NAME,
   245		NFTA_CHAIN_HOOK,
   246		NFTA_CHAIN_POLICY,
   247		NFTA_CHAIN_USE,
   248		NFTA_CHAIN_TYPE,
   249		NFTA_CHAIN_COUNTERS,
   250		NFTA_CHAIN_PAD,
   251		NFTA_CHAIN_FLAGS,
   252		NFTA_CHAIN_ID,
   253		NFTA_CHAIN_USERDATA,
   254		__NFTA_CHAIN_MAX
   255	};
   256	#define NFTA_CHAIN_MAX		(__NFTA_CHAIN_MAX - 1)
   257	
   258	/**
   259	 * enum nft_rule_attributes - nf_tables rule netlink attributes
   260	 *
   261	 * @NFTA_RULE_TABLE: name of the table containing the rule (NLA_STRING)
   262	 * @NFTA_RULE_CHAIN: name of the chain containing the rule (NLA_STRING)
   263	 * @NFTA_RULE_HANDLE: numeric handle of the rule (NLA_U64)
   264	 * @NFTA_RULE_EXPRESSIONS: list of expressions (NLA_NESTED: nft_expr_attributes)
   265	 * @NFTA_RULE_COMPAT: compatibility specifications of the rule (NLA_NESTED: nft_rule_compat_attributes)
   266	 * @NFTA_RULE_POSITION: numeric handle of the previous rule (NLA_U64)
   267	 * @NFTA_RULE_USERDATA: user data (NLA_BINARY, NFT_USERDATA_MAXLEN)
   268	 * @NFTA_RULE_ID: uniquely identifies a rule in a transaction (NLA_U32)
   269	 * @NFTA_RULE_POSITION_ID: transaction unique identifier of the previous rule (NLA_U32)
   270	 * @NFTA_RULE_CHAIN_ID: add the rule to chain by ID, alternative to @NFTA_RULE_CHAIN (NLA_U32)
   271	 */
   272	enum nft_rule_attributes {
   273		NFTA_RULE_UNSPEC,
   274		NFTA_RULE_TABLE,
   275		NFTA_RULE_CHAIN,
   276		NFTA_RULE_HANDLE,
   277		NFTA_RULE_EXPRESSIONS,
   278		NFTA_RULE_COMPAT,
   279		NFTA_RULE_POSITION,
   280		NFTA_RULE_USERDATA,
   281		NFTA_RULE_PAD,
   282		NFTA_RULE_ID,
   283		NFTA_RULE_POSITION_ID,
   284		NFTA_RULE_CHAIN_ID,
   285		__NFTA_RULE_MAX
   286	};
   287	#define NFTA_RULE_MAX		(__NFTA_RULE_MAX - 1)
   288	
   289	/**
   290	 * enum nft_rule_compat_flags - nf_tables rule compat flags
   291	 *
   292	 * @NFT_RULE_COMPAT_F_UNUSED: unused
   293	 * @NFT_RULE_COMPAT_F_INV: invert the check result
   294	 */
   295	enum nft_rule_compat_flags {
   296		NFT_RULE_COMPAT_F_UNUSED = (1 << 0),
   297		NFT_RULE_COMPAT_F_INV	= (1 << 1),
   298		NFT_RULE_COMPAT_F_MASK	= NFT_RULE_COMPAT_F_INV,
   299	};
   300	
   301	/**
   302	 * enum nft_rule_compat_attributes - nf_tables rule compat attributes
   303	 *
   304	 * @NFTA_RULE_COMPAT_PROTO: numeric value of handled protocol (NLA_U32)
   305	 * @NFTA_RULE_COMPAT_FLAGS: bitmask of enum nft_rule_compat_flags (NLA_U32)
   306	 */
   307	enum nft_rule_compat_attributes {
   308		NFTA_RULE_COMPAT_UNSPEC,
   309		NFTA_RULE_COMPAT_PROTO,
   310		NFTA_RULE_COMPAT_FLAGS,
   311		__NFTA_RULE_COMPAT_MAX
   312	};
   313	#define NFTA_RULE_COMPAT_MAX	(__NFTA_RULE_COMPAT_MAX - 1)
   314	
   315	/**
   316	 * enum nft_set_flags - nf_tables set flags
   317	 *
   318	 * @NFT_SET_ANONYMOUS: name allocation, automatic cleanup on unlink
   319	 * @NFT_SET_CONSTANT: set contents may not change while bound
   320	 * @NFT_SET_INTERVAL: set contains intervals
   321	 * @NFT_SET_MAP: set is used as a dictionary
   322	 * @NFT_SET_TIMEOUT: set uses timeouts
   323	 * @NFT_SET_EVAL: set can be updated from the evaluation path
   324	 * @NFT_SET_OBJECT: set contains stateful objects
   325	 * @NFT_SET_CONCAT: set contains a concatenation
   326	 * @NFT_SET_EXPR: set contains expressions
   327	 */
   328	enum nft_set_flags {
   329		NFT_SET_ANONYMOUS		= 0x1,
   330		NFT_SET_CONSTANT		= 0x2,
   331		NFT_SET_INTERVAL		= 0x4,
   332		NFT_SET_MAP			= 0x8,
   333		NFT_SET_TIMEOUT			= 0x10,
   334		NFT_SET_EVAL			= 0x20,
   335		NFT_SET_OBJECT			= 0x40,
   336		NFT_SET_CONCAT			= 0x80,
   337		NFT_SET_EXPR			= 0x100,
   338	};
   339	
   340	/**
   341	 * enum nft_set_policies - set selection policy
   342	 *
   343	 * @NFT_SET_POL_PERFORMANCE: prefer high performance over low memory use
   344	 * @NFT_SET_POL_MEMORY: prefer low memory use over high performance
   345	 */
   346	enum nft_set_policies {
   347		NFT_SET_POL_PERFORMANCE,
   348		NFT_SET_POL_MEMORY,
   349	};
   350	
   351	/**
   352	 * enum nft_set_desc_attributes - set element description
   353	 *
   354	 * @NFTA_SET_DESC_SIZE: number of elements in set (NLA_U32)
   355	 * @NFTA_SET_DESC_CONCAT: description of field concatenation (NLA_NESTED)
   356	 */
   357	enum nft_set_desc_attributes {
   358		NFTA_SET_DESC_UNSPEC,
   359		NFTA_SET_DESC_SIZE,
   360		NFTA_SET_DESC_CONCAT,
   361		__NFTA_SET_DESC_MAX
   362	};
   363	#define NFTA_SET_DESC_MAX	(__NFTA_SET_DESC_MAX - 1)
   364	
   365	/**
   366	 * enum nft_set_field_attributes - attributes of concatenated fields
   367	 *
   368	 * @NFTA_SET_FIELD_LEN: length of single field, in bits (NLA_U32)
   369	 */
   370	enum nft_set_field_attributes {
   371		NFTA_SET_FIELD_UNSPEC,
   372		NFTA_SET_FIELD_LEN,
   373		__NFTA_SET_FIELD_MAX
   374	};
   375	#define NFTA_SET_FIELD_MAX	(__NFTA_SET_FIELD_MAX - 1)
   376	
   377	/**
   378	 * enum nft_set_attributes - nf_tables set netlink attributes
   379	 *
   380	 * @NFTA_SET_TABLE: table name (NLA_STRING)
   381	 * @NFTA_SET_NAME: set name (NLA_STRING)
   382	 * @NFTA_SET_FLAGS: bitmask of enum nft_set_flags (NLA_U32)
   383	 * @NFTA_SET_KEY_TYPE: key data type, informational purpose only (NLA_U32)
   384	 * @NFTA_SET_KEY_LEN: key data length (NLA_U32)
   385	 * @NFTA_SET_DATA_TYPE: mapping data type (NLA_U32)
   386	 * @NFTA_SET_DATA_LEN: mapping data length (NLA_U32)
   387	 * @NFTA_SET_POLICY: selection policy (NLA_U32)
   388	 * @NFTA_SET_DESC: set description (NLA_NESTED)
   389	 * @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
   390	 * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
   391	 * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
   392	 * @NFTA_SET_USERDATA: user data (NLA_BINARY)
   393	 * @NFTA_SET_OBJ_TYPE: stateful object type (NLA_U32: NFT_OBJECT_*)
   394	 * @NFTA_SET_HANDLE: set handle (NLA_U64)
   395	 * @NFTA_SET_EXPR: set expression (NLA_NESTED: nft_expr_attributes)
   396	 * @NFTA_SET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
   397	 * @NFTA_SET_TYPE: set backend type (NLA_STRING)
   398	 * @NFTA_SET_COUNT: number of set elements (NLA_U32)
   399	 */
   400	enum nft_set_attributes {
   401		NFTA_SET_UNSPEC,
   402		NFTA_SET_TABLE,
   403		NFTA_SET_NAME,
   404		NFTA_SET_FLAGS,
   405		NFTA_SET_KEY_TYPE,
   406		NFTA_SET_KEY_LEN,
   407		NFTA_SET_DATA_TYPE,
   408		NFTA_SET_DATA_LEN,
   409		NFTA_SET_POLICY,
   410		NFTA_SET_DESC,
   411		NFTA_SET_ID,
   412		NFTA_SET_TIMEOUT,
   413		NFTA_SET_GC_INTERVAL,
   414		NFTA_SET_USERDATA,
   415		NFTA_SET_PAD,
   416		NFTA_SET_OBJ_TYPE,
   417		NFTA_SET_HANDLE,
   418		NFTA_SET_EXPR,
   419		NFTA_SET_EXPRESSIONS,
   420		NFTA_SET_TYPE,
   421		NFTA_SET_COUNT,
   422		__NFTA_SET_MAX
   423	};
   424	#define NFTA_SET_MAX		(__NFTA_SET_MAX - 1)
   425	
   426	/**
   427	 * enum nft_set_elem_flags - nf_tables set element flags
   428	 *
   429	 * @NFT_SET_ELEM_INTERVAL_END: element ends the previous interval
   430	 * @NFT_SET_ELEM_CATCHALL: special catch-all element
   431	 */
   432	enum nft_set_elem_flags {
   433		NFT_SET_ELEM_INTERVAL_END	= 0x1,
   434		NFT_SET_ELEM_CATCHALL		= 0x2,
   435	};
   436	
   437	/**
   438	 * enum nft_set_elem_attributes - nf_tables set element netlink attributes
   439	 *
   440	 * @NFTA_SET_ELEM_KEY: key value (NLA_NESTED: nft_data)
   441	 * @NFTA_SET_ELEM_DATA: data value of mapping (NLA_NESTED: nft_data_attributes)
   442	 * @NFTA_SET_ELEM_FLAGS: bitmask of nft_set_elem_flags (NLA_U32)
   443	 * @NFTA_SET_ELEM_TIMEOUT: timeout value, zero means never times out (NLA_U64)
   444	 * @NFTA_SET_ELEM_EXPIRATION: expiration time (NLA_U64)
   445	 * @NFTA_SET_ELEM_USERDATA: user data (NLA_BINARY)
   446	 * @NFTA_SET_ELEM_EXPR: expression (NLA_NESTED: nft_expr_attributes)
   447	 * @NFTA_SET_ELEM_OBJREF: stateful object reference (NLA_STRING)
   448	 * @NFTA_SET_ELEM_KEY_END: closing key value (NLA_NESTED: nft_data)
   449	 * @NFTA_SET_ELEM_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
   450	 */
   451	enum nft_set_elem_attributes {
   452		NFTA_SET_ELEM_UNSPEC,
   453		NFTA_SET_ELEM_KEY,
   454		NFTA_SET_ELEM_DATA,
   455		NFTA_SET_ELEM_FLAGS,
   456		NFTA_SET_ELEM_TIMEOUT,
   457		NFTA_SET_ELEM_EXPIRATION,
   458		NFTA_SET_ELEM_USERDATA,
   459		NFTA_SET_ELEM_EXPR,
   460		NFTA_SET_ELEM_PAD,
   461		NFTA_SET_ELEM_OBJREF,
   462		NFTA_SET_ELEM_KEY_END,
   463		NFTA_SET_ELEM_EXPRESSIONS,
   464		__NFTA_SET_ELEM_MAX
   465	};
   466	#define NFTA_SET_ELEM_MAX	(__NFTA_SET_ELEM_MAX - 1)
   467	
   468	/**
   469	 * enum nft_set_elem_list_attributes - nf_tables set element list netlink attributes
   470	 *
   471	 * @NFTA_SET_ELEM_LIST_TABLE: table of the set to be changed (NLA_STRING)
   472	 * @NFTA_SET_ELEM_LIST_SET: name of the set to be changed (NLA_STRING)
   473	 * @NFTA_SET_ELEM_LIST_ELEMENTS: list of set elements (NLA_NESTED: nft_set_elem_attributes)
   474	 * @NFTA_SET_ELEM_LIST_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
   475	 */
   476	enum nft_set_elem_list_attributes {
   477		NFTA_SET_ELEM_LIST_UNSPEC,
   478		NFTA_SET_ELEM_LIST_TABLE,
   479		NFTA_SET_ELEM_LIST_SET,
   480		NFTA_SET_ELEM_LIST_ELEMENTS,
   481		NFTA_SET_ELEM_LIST_SET_ID,
   482		__NFTA_SET_ELEM_LIST_MAX
   483	};
   484	#define NFTA_SET_ELEM_LIST_MAX	(__NFTA_SET_ELEM_LIST_MAX - 1)
   485	
   486	/**
   487	 * enum nft_data_types - nf_tables data types
   488	 *
   489	 * @NFT_DATA_VALUE: generic data
   490	 * @NFT_DATA_VERDICT: netfilter verdict
   491	 *
   492	 * The type of data is usually determined by the kernel directly and is not
   493	 * explicitly specified by userspace. The only difference are sets, where
   494	 * userspace specifies the key and mapping data types.
   495	 *
   496	 * The values 0xffffff00-0xffffffff are reserved for internally used types.
   497	 * The remaining range can be freely used by userspace to encode types, all
   498	 * values are equivalent to NFT_DATA_VALUE.
   499	 */
   500	enum nft_data_types {
   501		NFT_DATA_VALUE,
   502		NFT_DATA_VERDICT	= 0xffffff00U,
   503	};
   504	
   505	#define NFT_DATA_RESERVED_MASK	0xffffff00U
   506	
   507	/**
   508	 * enum nft_data_attributes - nf_tables data netlink attributes
   509	 *
   510	 * @NFTA_DATA_VALUE: generic data (NLA_BINARY)
   511	 * @NFTA_DATA_VERDICT: nf_tables verdict (NLA_NESTED: nft_verdict_attributes)
   512	 */
   513	enum nft_data_attributes {
   514		NFTA_DATA_UNSPEC,
   515		NFTA_DATA_VALUE,
   516		NFTA_DATA_VERDICT,
   517		__NFTA_DATA_MAX
   518	};
   519	#define NFTA_DATA_MAX		(__NFTA_DATA_MAX - 1)
   520	
   521	/* Maximum length of a value */
   522	#define NFT_DATA_VALUE_MAXLEN	64
   523	
   524	/**
   525	 * enum nft_verdict_attributes - nf_tables verdict netlink attributes
   526	 *
   527	 * @NFTA_VERDICT_CODE: nf_tables verdict (NLA_U32: enum nft_verdicts)
   528	 * @NFTA_VERDICT_CHAIN: jump target chain name (NLA_STRING)
   529	 * @NFTA_VERDICT_CHAIN_ID: jump target chain ID (NLA_U32)
   530	 */
   531	enum nft_verdict_attributes {
   532		NFTA_VERDICT_UNSPEC,
   533		NFTA_VERDICT_CODE,
   534		NFTA_VERDICT_CHAIN,
   535		NFTA_VERDICT_CHAIN_ID,
   536		__NFTA_VERDICT_MAX
   537	};
   538	#define NFTA_VERDICT_MAX	(__NFTA_VERDICT_MAX - 1)
   539	
   540	/**
   541	 * enum nft_expr_attributes - nf_tables expression netlink attributes
   542	 *
   543	 * @NFTA_EXPR_NAME: name of the expression type (NLA_STRING)
   544	 * @NFTA_EXPR_DATA: type specific data (NLA_NESTED)
   545	 */
   546	enum nft_expr_attributes {
   547		NFTA_EXPR_UNSPEC,
   548		NFTA_EXPR_NAME,
   549		NFTA_EXPR_DATA,
   550		__NFTA_EXPR_MAX
   551	};
   552	#define NFTA_EXPR_MAX		(__NFTA_EXPR_MAX - 1)
   553	
   554	/**
   555	 * enum nft_immediate_attributes - nf_tables immediate expression netlink attributes
   556	 *
   557	 * @NFTA_IMMEDIATE_DREG: destination register to load data into (NLA_U32)
   558	 * @NFTA_IMMEDIATE_DATA: data to load (NLA_NESTED: nft_data_attributes)
   559	 */
   560	enum nft_immediate_attributes {
   561		NFTA_IMMEDIATE_UNSPEC,
   562		NFTA_IMMEDIATE_DREG,
   563		NFTA_IMMEDIATE_DATA,
   564		__NFTA_IMMEDIATE_MAX
   565	};
   566	#define NFTA_IMMEDIATE_MAX	(__NFTA_IMMEDIATE_MAX - 1)
   567	
   568	/**
   569	 * enum nft_bitwise_ops - nf_tables bitwise operations
   570	 *
   571	 * @NFT_BITWISE_MASK_XOR: mask-and-xor operation used to implement NOT, AND, OR
   572	 *                        and XOR boolean operations
   573	 * @NFT_BITWISE_LSHIFT: left-shift operation
   574	 * @NFT_BITWISE_RSHIFT: right-shift operation
   575	 * @NFT_BITWISE_AND: and operation
   576	 * @NFT_BITWISE_OR: or operation
   577	 * @NFT_BITWISE_XOR: xor operation
   578	 */
   579	enum nft_bitwise_ops {
   580		NFT_BITWISE_MASK_XOR,
   581		NFT_BITWISE_LSHIFT,
   582		NFT_BITWISE_RSHIFT,
   583		NFT_BITWISE_AND,
   584		NFT_BITWISE_OR,
   585		NFT_BITWISE_XOR,
   586	};
   587	/*
   588	 * Old name for NFT_BITWISE_MASK_XOR.  Retained for backwards-compatibility.
   589	 */
   590	#define NFT_BITWISE_BOOL NFT_BITWISE_MASK_XOR
   591	
   592	/**
   593	 * enum nft_bitwise_attributes - nf_tables bitwise expression netlink attributes
   594	 *
   595	 * @NFTA_BITWISE_SREG: source register (NLA_U32: nft_registers)
   596	 * @NFTA_BITWISE_DREG: destination register (NLA_U32: nft_registers)
   597	 * @NFTA_BITWISE_LEN: length of operands (NLA_U32)
   598	 * @NFTA_BITWISE_MASK: mask value (NLA_NESTED: nft_data_attributes)
   599	 * @NFTA_BITWISE_XOR: xor value (NLA_NESTED: nft_data_attributes)
   600	 * @NFTA_BITWISE_OP: type of operation (NLA_U32: nft_bitwise_ops)
   601	 * @NFTA_BITWISE_DATA: argument for non-boolean operations
   602	 *                     (NLA_NESTED: nft_data_attributes)
   603	 * @NFTA_BITWISE_SREG2: second source register (NLA_U32: nft_registers)
   604	 *
   605	 * The bitwise expression supports boolean and shift operations.  It implements
   606	 * the boolean operations by performing the following operation:
   607	 *
   608	 * dreg = (sreg & mask) ^ xor
   609	 *
   610	 * with these mask and xor values:
   611	 *
   612	 * 		mask	xor
   613	 * NOT:		1	1
   614	 * OR:		~x	x
   615	 * XOR:		1	x
   616	 * AND:		x	0
   617	 */
   618	enum nft_bitwise_attributes {
   619		NFTA_BITWISE_UNSPEC,
   620		NFTA_BITWISE_SREG,
   621		NFTA_BITWISE_DREG,
   622		NFTA_BITWISE_LEN,
   623		NFTA_BITWISE_MASK,
   624		NFTA_BITWISE_XOR,
   625		NFTA_BITWISE_OP,
   626		NFTA_BITWISE_DATA,
   627		NFTA_BITWISE_SREG2,
   628		__NFTA_BITWISE_MAX
   629	};
   630	#define NFTA_BITWISE_MAX	(__NFTA_BITWISE_MAX - 1)
   631	
   632	/**
   633	 * enum nft_byteorder_ops - nf_tables byteorder operators
   634	 *
   635	 * @NFT_BYTEORDER_NTOH: network to host operator
   636	 * @NFT_BYTEORDER_HTON: host to network operator
   637	 */
   638	enum nft_byteorder_ops {
   639		NFT_BYTEORDER_NTOH,
   640		NFT_BYTEORDER_HTON,
   641	};
   642	
   643	/**
   644	 * enum nft_byteorder_attributes - nf_tables byteorder expression netlink attributes
   645	 *
   646	 * @NFTA_BYTEORDER_SREG: source register (NLA_U32: nft_registers)
   647	 * @NFTA_BYTEORDER_DREG: destination register (NLA_U32: nft_registers)
   648	 * @NFTA_BYTEORDER_OP: operator (NLA_U32: enum nft_byteorder_ops)
   649	 * @NFTA_BYTEORDER_LEN: length of the data (NLA_U32)
   650	 * @NFTA_BYTEORDER_SIZE: data size in bytes (NLA_U32: 2 or 4)
   651	 */
   652	enum nft_byteorder_attributes {
   653		NFTA_BYTEORDER_UNSPEC,
   654		NFTA_BYTEORDER_SREG,
   655		NFTA_BYTEORDER_DREG,
   656		NFTA_BYTEORDER_OP,
   657		NFTA_BYTEORDER_LEN,
   658		NFTA_BYTEORDER_SIZE,
   659		__NFTA_BYTEORDER_MAX
   660	};
   661	#define NFTA_BYTEORDER_MAX	(__NFTA_BYTEORDER_MAX - 1)
   662	
   663	/**
   664	 * enum nft_cmp_ops - nf_tables relational operator
   665	 *
   666	 * @NFT_CMP_EQ: equal
   667	 * @NFT_CMP_NEQ: not equal
   668	 * @NFT_CMP_LT: less than
   669	 * @NFT_CMP_LTE: less than or equal to
   670	 * @NFT_CMP_GT: greater than
   671	 * @NFT_CMP_GTE: greater than or equal to
   672	 */
   673	enum nft_cmp_ops {
   674		NFT_CMP_EQ,
   675		NFT_CMP_NEQ,
   676		NFT_CMP_LT,
   677		NFT_CMP_LTE,
   678		NFT_CMP_GT,
   679		NFT_CMP_GTE,
   680	};
   681	
   682	/**
   683	 * enum nft_cmp_attributes - nf_tables cmp expression netlink attributes
   684	 *
   685	 * @NFTA_CMP_SREG: source register of data to compare (NLA_U32: nft_registers)
   686	 * @NFTA_CMP_OP: cmp operation (NLA_U32: nft_cmp_ops)
   687	 * @NFTA_CMP_DATA: data to compare against (NLA_NESTED: nft_data_attributes)
   688	 */
   689	enum nft_cmp_attributes {
   690		NFTA_CMP_UNSPEC,
   691		NFTA_CMP_SREG,
   692		NFTA_CMP_OP,
   693		NFTA_CMP_DATA,
   694		__NFTA_CMP_MAX
   695	};
   696	#define NFTA_CMP_MAX		(__NFTA_CMP_MAX - 1)
   697	
   698	/**
   699	 * enum nft_range_ops - nf_tables range operator
   700	 *
   701	 * @NFT_RANGE_EQ: equal
   702	 * @NFT_RANGE_NEQ: not equal
   703	 */
   704	enum nft_range_ops {
   705		NFT_RANGE_EQ,
   706		NFT_RANGE_NEQ,
   707	};
   708	
   709	/**
   710	 * enum nft_range_attributes - nf_tables range expression netlink attributes
   711	 *
   712	 * @NFTA_RANGE_SREG: source register of data to compare (NLA_U32: nft_registers)
   713	 * @NFTA_RANGE_OP: cmp operation (NLA_U32: nft_range_ops)
   714	 * @NFTA_RANGE_FROM_DATA: data range from (NLA_NESTED: nft_data_attributes)
   715	 * @NFTA_RANGE_TO_DATA: data range to (NLA_NESTED: nft_data_attributes)
   716	 */
   717	enum nft_range_attributes {
   718		NFTA_RANGE_UNSPEC,
   719		NFTA_RANGE_SREG,
   720		NFTA_RANGE_OP,
   721		NFTA_RANGE_FROM_DATA,
   722		NFTA_RANGE_TO_DATA,
   723		__NFTA_RANGE_MAX
   724	};
   725	#define NFTA_RANGE_MAX		(__NFTA_RANGE_MAX - 1)
   726	
   727	enum nft_lookup_flags {
   728		NFT_LOOKUP_F_INV = (1 << 0),
   729	};
   730	
   731	/**
   732	 * enum nft_lookup_attributes - nf_tables set lookup expression netlink attributes
   733	 *
   734	 * @NFTA_LOOKUP_SET: name of the set where to look for (NLA_STRING)
   735	 * @NFTA_LOOKUP_SREG: source register of the data to look for (NLA_U32: nft_registers)
   736	 * @NFTA_LOOKUP_DREG: destination register (NLA_U32: nft_registers)
   737	 * @NFTA_LOOKUP_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
   738	 * @NFTA_LOOKUP_FLAGS: flags (NLA_U32: enum nft_lookup_flags)
   739	 */
   740	enum nft_lookup_attributes {
   741		NFTA_LOOKUP_UNSPEC,
   742		NFTA_LOOKUP_SET,
   743		NFTA_LOOKUP_SREG,
   744		NFTA_LOOKUP_DREG,
   745		NFTA_LOOKUP_SET_ID,
   746		NFTA_LOOKUP_FLAGS,
   747		__NFTA_LOOKUP_MAX
   748	};
   749	#define NFTA_LOOKUP_MAX		(__NFTA_LOOKUP_MAX - 1)
   750	
   751	enum nft_dynset_ops {
   752		NFT_DYNSET_OP_ADD,
   753		NFT_DYNSET_OP_UPDATE,
   754		NFT_DYNSET_OP_DELETE,
   755	};
   756	
   757	enum nft_dynset_flags {
   758		NFT_DYNSET_F_INV	= (1 << 0),
   759		NFT_DYNSET_F_EXPR	= (1 << 1),
   760	};
   761	
   762	/**
   763	 * enum nft_dynset_attributes - dynset expression attributes
   764	 *
   765	 * @NFTA_DYNSET_SET_NAME: name of set the to add data to (NLA_STRING)
   766	 * @NFTA_DYNSET_SET_ID: uniquely identifier of the set in the transaction (NLA_U32)
   767	 * @NFTA_DYNSET_OP: operation (NLA_U32)
   768	 * @NFTA_DYNSET_SREG_KEY: source register of the key (NLA_U32)
   769	 * @NFTA_DYNSET_SREG_DATA: source register of the data (NLA_U32)
   770	 * @NFTA_DYNSET_TIMEOUT: timeout value for the new element (NLA_U64)
   771	 * @NFTA_DYNSET_EXPR: expression (NLA_NESTED: nft_expr_attributes)
   772	 * @NFTA_DYNSET_FLAGS: flags (NLA_U32)
   773	 * @NFTA_DYNSET_EXPRESSIONS: list of expressions (NLA_NESTED: nft_list_attributes)
   774	 */
   775	enum nft_dynset_attributes {
   776		NFTA_DYNSET_UNSPEC,
   777		NFTA_DYNSET_SET_NAME,
   778		NFTA_DYNSET_SET_ID,
   779		NFTA_DYNSET_OP,
   780		NFTA_DYNSET_SREG_KEY,
   781		NFTA_DYNSET_SREG_DATA,
   782		NFTA_DYNSET_TIMEOUT,
   783		NFTA_DYNSET_EXPR,
   784		NFTA_DYNSET_PAD,
   785		NFTA_DYNSET_FLAGS,
   786		NFTA_DYNSET_EXPRESSIONS,
   787		__NFTA_DYNSET_MAX,
   788	};
   789	#define NFTA_DYNSET_MAX		(__NFTA_DYNSET_MAX - 1)
   790	
   791	/**
   792	 * enum nft_payload_bases - nf_tables payload expression offset bases
   793	 *
   794	 * @NFT_PAYLOAD_LL_HEADER: link layer header
   795	 * @NFT_PAYLOAD_NETWORK_HEADER: network header
   796	 * @NFT_PAYLOAD_TRANSPORT_HEADER: transport header
   797	 * @NFT_PAYLOAD_INNER_HEADER: inner header / payload
   798	 */
   799	enum nft_payload_bases {
   800		NFT_PAYLOAD_LL_HEADER,
   801		NFT_PAYLOAD_NETWORK_HEADER,
   802		NFT_PAYLOAD_TRANSPORT_HEADER,
   803		NFT_PAYLOAD_INNER_HEADER,
   804		NFT_PAYLOAD_TUN_HEADER,
   805	};
   806	
   807	/**
   808	 * enum nft_payload_csum_types - nf_tables payload expression checksum types
   809	 *
   810	 * @NFT_PAYLOAD_CSUM_NONE: no checksumming
   811	 * @NFT_PAYLOAD_CSUM_INET: internet checksum (RFC 791)
   812	 * @NFT_PAYLOAD_CSUM_SCTP: CRC-32c, for use in SCTP header (RFC 3309)
   813	 */
   814	enum nft_payload_csum_types {
   815		NFT_PAYLOAD_CSUM_NONE,
   816		NFT_PAYLOAD_CSUM_INET,
   817		NFT_PAYLOAD_CSUM_SCTP,
   818	};
   819	
   820	enum nft_payload_csum_flags {
   821		NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0),
   822	};
   823	
   824	enum nft_inner_type {
   825		NFT_INNER_UNSPEC	= 0,
   826		NFT_INNER_VXLAN,
   827		NFT_INNER_GENEVE,
   828	};
   829	
   830	enum nft_inner_flags {
   831		NFT_INNER_HDRSIZE	= (1 << 0),
   832		NFT_INNER_LL		= (1 << 1),
   833		NFT_INNER_NH		= (1 << 2),
   834		NFT_INNER_TH		= (1 << 3),
   835	};
   836	#define NFT_INNER_MASK		(NFT_INNER_HDRSIZE | NFT_INNER_LL | \
   837					 NFT_INNER_NH | NFT_INNER_TH)
   838	
   839	enum nft_inner_attributes {
   840		NFTA_INNER_UNSPEC,
   841		NFTA_INNER_NUM,
   842		NFTA_INNER_TYPE,
   843		NFTA_INNER_FLAGS,
   844		NFTA_INNER_HDRSIZE,
   845		NFTA_INNER_EXPR,
   846		__NFTA_INNER_MAX
   847	};
   848	#define NFTA_INNER_MAX	(__NFTA_INNER_MAX - 1)
   849	
   850	/**
   851	 * enum nft_payload_attributes - nf_tables payload expression netlink attributes
   852	 *
   853	 * @NFTA_PAYLOAD_DREG: destination register to load data into (NLA_U32: nft_registers)
   854	 * @NFTA_PAYLOAD_BASE: payload base (NLA_U32: nft_payload_bases)
   855	 * @NFTA_PAYLOAD_OFFSET: payload offset relative to base (NLA_U32)
   856	 * @NFTA_PAYLOAD_LEN: payload length (NLA_U32)
   857	 * @NFTA_PAYLOAD_SREG: source register to load data from (NLA_U32: nft_registers)
   858	 * @NFTA_PAYLOAD_CSUM_TYPE: checksum type (NLA_U32)
   859	 * @NFTA_PAYLOAD_CSUM_OFFSET: checksum offset relative to base (NLA_U32)
   860	 * @NFTA_PAYLOAD_CSUM_FLAGS: checksum flags (NLA_U32)
   861	 */
   862	enum nft_payload_attributes {
   863		NFTA_PAYLOAD_UNSPEC,
   864		NFTA_PAYLOAD_DREG,
   865		NFTA_PAYLOAD_BASE,
   866		NFTA_PAYLOAD_OFFSET,
   867		NFTA_PAYLOAD_LEN,
   868		NFTA_PAYLOAD_SREG,
   869		NFTA_PAYLOAD_CSUM_TYPE,
   870		NFTA_PAYLOAD_CSUM_OFFSET,
   871		NFTA_PAYLOAD_CSUM_FLAGS,
   872		__NFTA_PAYLOAD_MAX
   873	};
   874	#define NFTA_PAYLOAD_MAX	(__NFTA_PAYLOAD_MAX - 1)
   875	
   876	enum nft_exthdr_flags {
   877		NFT_EXTHDR_F_PRESENT = (1 << 0),
   878	};
   879	
   880	/**
   881	 * enum nft_exthdr_op - nf_tables match options
   882	 *
   883	 * @NFT_EXTHDR_OP_IPV6: match against ipv6 extension headers
   884	 * @NFT_EXTHDR_OP_TCPOPT: match against tcp options
   885	 * @NFT_EXTHDR_OP_IPV4: match against ipv4 options
   886	 * @NFT_EXTHDR_OP_SCTP: match against sctp chunks
   887	 * @NFT_EXTHDR_OP_DCCP: match against dccp otions
   888	 */
   889	enum nft_exthdr_op {
   890		NFT_EXTHDR_OP_IPV6,
   891		NFT_EXTHDR_OP_TCPOPT,
   892		NFT_EXTHDR_OP_IPV4,
   893		NFT_EXTHDR_OP_SCTP,
   894		NFT_EXTHDR_OP_DCCP,
   895		__NFT_EXTHDR_OP_MAX
   896	};
   897	#define NFT_EXTHDR_OP_MAX	(__NFT_EXTHDR_OP_MAX - 1)
   898	
   899	/**
   900	 * enum nft_exthdr_attributes - nf_tables extension header expression netlink attributes
   901	 *
   902	 * @NFTA_EXTHDR_DREG: destination register (NLA_U32: nft_registers)
   903	 * @NFTA_EXTHDR_TYPE: extension header type (NLA_U8)
   904	 * @NFTA_EXTHDR_OFFSET: extension header offset (NLA_U32)
   905	 * @NFTA_EXTHDR_LEN: extension header length (NLA_U32)
   906	 * @NFTA_EXTHDR_FLAGS: extension header flags (NLA_U32)
   907	 * @NFTA_EXTHDR_OP: option match type (NLA_U32)
   908	 * @NFTA_EXTHDR_SREG: source register (NLA_U32: nft_registers)
   909	 */
   910	enum nft_exthdr_attributes {
   911		NFTA_EXTHDR_UNSPEC,
   912		NFTA_EXTHDR_DREG,
   913		NFTA_EXTHDR_TYPE,
   914		NFTA_EXTHDR_OFFSET,
   915		NFTA_EXTHDR_LEN,
   916		NFTA_EXTHDR_FLAGS,
   917		NFTA_EXTHDR_OP,
   918		NFTA_EXTHDR_SREG,
   919		__NFTA_EXTHDR_MAX
   920	};
   921	#define NFTA_EXTHDR_MAX		(__NFTA_EXTHDR_MAX - 1)
   922	
   923	/**
   924	 * enum nft_meta_keys - nf_tables meta expression keys
   925	 *
   926	 * @NFT_META_LEN: packet length (skb->len)
   927	 * @NFT_META_PROTOCOL: packet ethertype protocol (skb->protocol), invalid in OUTPUT
   928	 * @NFT_META_PRIORITY: packet priority (skb->priority)
   929	 * @NFT_META_MARK: packet mark (skb->mark)
   930	 * @NFT_META_IIF: packet input interface index (dev->ifindex)
   931	 * @NFT_META_OIF: packet output interface index (dev->ifindex)
   932	 * @NFT_META_IIFNAME: packet input interface name (dev->name)
   933	 * @NFT_META_OIFNAME: packet output interface name (dev->name)
   934	 * @NFT_META_IIFTYPE: packet input interface type (dev->type)
   935	 * @NFT_META_OIFTYPE: packet output interface type (dev->type)
   936	 * @NFT_META_SKUID: originating socket UID (fsuid)
   937	 * @NFT_META_SKGID: originating socket GID (fsgid)
   938	 * @NFT_META_NFTRACE: packet nftrace bit
   939	 * @NFT_META_RTCLASSID: realm value of packet's route (skb->dst->tclassid)
   940	 * @NFT_META_SECMARK: packet secmark (skb->secmark)
   941	 * @NFT_META_NFPROTO: netfilter protocol
   942	 * @NFT_META_L4PROTO: layer 4 protocol number
   943	 * @NFT_META_BRI_IIFNAME: packet input bridge interface name
   944	 * @NFT_META_BRI_OIFNAME: packet output bridge interface name
   945	 * @NFT_META_PKTTYPE: packet type (skb->pkt_type), special handling for loopback
   946	 * @NFT_META_CPU: cpu id through smp_processor_id()
   947	 * @NFT_META_IIFGROUP: packet input interface group
   948	 * @NFT_META_OIFGROUP: packet output interface group
   949	 * @NFT_META_CGROUP: socket control group (skb->sk->sk_classid)
   950	 * @NFT_META_PRANDOM: a 32bit pseudo-random number
   951	 * @NFT_META_SECPATH: boolean, secpath_exists (!!skb->sp)
   952	 * @NFT_META_IIFKIND: packet input interface kind name (dev->rtnl_link_ops->kind)
   953	 * @NFT_META_OIFKIND: packet output interface kind name (dev->rtnl_link_ops->kind)
   954	 * @NFT_META_BRI_IIFPVID: packet input bridge port pvid
   955	 * @NFT_META_BRI_IIFVPROTO: packet input bridge vlan proto
   956	 * @NFT_META_TIME_NS: time since epoch (in nanoseconds)
   957	 * @NFT_META_TIME_DAY: day of week (from 0 = Sunday to 6 = Saturday)
   958	 * @NFT_META_TIME_HOUR: hour of day (in seconds)
   959	 * @NFT_META_SDIF: slave device interface index
   960	 * @NFT_META_SDIFNAME: slave device interface name
   961	 * @NFT_META_BRI_BROUTE: packet br_netfilter_broute bit
   962	 * @NFT_META_BRI_IIFHWADDR: packet input bridge interface ethernet address
   963	 */
   964	enum nft_meta_keys {
   965		NFT_META_LEN,
   966		NFT_META_PROTOCOL,
   967		NFT_META_PRIORITY,
   968		NFT_META_MARK,
   969		NFT_META_IIF,
   970		NFT_META_OIF,
   971		NFT_META_IIFNAME,
   972		NFT_META_OIFNAME,
   973		NFT_META_IFTYPE,
   974	#define NFT_META_IIFTYPE	NFT_META_IFTYPE
   975		NFT_META_OIFTYPE,
   976		NFT_META_SKUID,
   977		NFT_META_SKGID,
   978		NFT_META_NFTRACE,
   979		NFT_META_RTCLASSID,
   980		NFT_META_SECMARK,
   981		NFT_META_NFPROTO,
   982		NFT_META_L4PROTO,
   983		NFT_META_BRI_IIFNAME,
   984		NFT_META_BRI_OIFNAME,
   985		NFT_META_PKTTYPE,
   986		NFT_META_CPU,
   987		NFT_META_IIFGROUP,
   988		NFT_META_OIFGROUP,
   989		NFT_META_CGROUP,
   990		NFT_META_PRANDOM,
   991		NFT_META_SECPATH,
   992		NFT_META_IIFKIND,
   993		NFT_META_OIFKIND,
   994		NFT_META_BRI_IIFPVID,
   995		NFT_META_BRI_IIFVPROTO,
   996		NFT_META_TIME_NS,
   997		NFT_META_TIME_DAY,
   998		NFT_META_TIME_HOUR,
   999		NFT_META_SDIF,
  1000		NFT_META_SDIFNAME,
  1001		NFT_META_BRI_BROUTE,
  1002		__NFT_META_IIFTYPE,
  1003		NFT_META_BRI_IIFHWADDR,
  1004	};
  1005	
  1006	/**
  1007	 * enum nft_rt_keys - nf_tables routing expression keys
  1008	 *
  1009	 * @NFT_RT_CLASSID: realm value of packet's route (skb->dst->tclassid)
  1010	 * @NFT_RT_NEXTHOP4: routing nexthop for IPv4
  1011	 * @NFT_RT_NEXTHOP6: routing nexthop for IPv6
  1012	 * @NFT_RT_TCPMSS: fetch current path tcp mss
  1013	 * @NFT_RT_XFRM: boolean, skb->dst->xfrm != NULL
  1014	 */
  1015	enum nft_rt_keys {
  1016		NFT_RT_CLASSID,
  1017		NFT_RT_NEXTHOP4,
  1018		NFT_RT_NEXTHOP6,
  1019		NFT_RT_TCPMSS,
  1020		NFT_RT_XFRM,
  1021		__NFT_RT_MAX
  1022	};
  1023	#define NFT_RT_MAX		(__NFT_RT_MAX - 1)
  1024	
  1025	/**
  1026	 * enum nft_hash_types - nf_tables hash expression types
  1027	 *
  1028	 * @NFT_HASH_JENKINS: Jenkins Hash
  1029	 * @NFT_HASH_SYM: Symmetric Hash
  1030	 */
  1031	enum nft_hash_types {
  1032		NFT_HASH_JENKINS,
  1033		NFT_HASH_SYM,
  1034	};
  1035	
  1036	/**
  1037	 * enum nft_hash_attributes - nf_tables hash expression netlink attributes
  1038	 *
  1039	 * @NFTA_HASH_SREG: source register (NLA_U32)
  1040	 * @NFTA_HASH_DREG: destination register (NLA_U32)
  1041	 * @NFTA_HASH_LEN: source data length (NLA_U32)
  1042	 * @NFTA_HASH_MODULUS: modulus value (NLA_U32)
  1043	 * @NFTA_HASH_SEED: seed value (NLA_U32)
  1044	 * @NFTA_HASH_OFFSET: add this offset value to hash result (NLA_U32)
  1045	 * @NFTA_HASH_TYPE: hash operation (NLA_U32: nft_hash_types)
  1046	 * @NFTA_HASH_SET_NAME: name of the map to lookup (NLA_STRING)
  1047	 * @NFTA_HASH_SET_ID: id of the map (NLA_U32)
  1048	 */
  1049	enum nft_hash_attributes {
  1050		NFTA_HASH_UNSPEC,
  1051		NFTA_HASH_SREG,
  1052		NFTA_HASH_DREG,
  1053		NFTA_HASH_LEN,
  1054		NFTA_HASH_MODULUS,
  1055		NFTA_HASH_SEED,
  1056		NFTA_HASH_OFFSET,
  1057		NFTA_HASH_TYPE,
  1058		NFTA_HASH_SET_NAME,	/* deprecated */
  1059		NFTA_HASH_SET_ID,	/* deprecated */
  1060		__NFTA_HASH_MAX,
  1061	};
  1062	#define NFTA_HASH_MAX	(__NFTA_HASH_MAX - 1)
  1063	
  1064	/**
  1065	 * enum nft_meta_attributes - nf_tables meta expression netlink attributes
  1066	 *
  1067	 * @NFTA_META_DREG: destination register (NLA_U32)
  1068	 * @NFTA_META_KEY: meta data item to load (NLA_U32: nft_meta_keys)
  1069	 * @NFTA_META_SREG: source register (NLA_U32)
  1070	 */
  1071	enum nft_meta_attributes {
  1072		NFTA_META_UNSPEC,
  1073		NFTA_META_DREG,
  1074		NFTA_META_KEY,
  1075		NFTA_META_SREG,
  1076		__NFTA_META_MAX
  1077	};
  1078	#define NFTA_META_MAX		(__NFTA_META_MAX - 1)
  1079	
  1080	/**
  1081	 * enum nft_rt_attributes - nf_tables routing expression netlink attributes
  1082	 *
  1083	 * @NFTA_RT_DREG: destination register (NLA_U32)
  1084	 * @NFTA_RT_KEY: routing data item to load (NLA_U32: nft_rt_keys)
  1085	 */
  1086	enum nft_rt_attributes {
  1087		NFTA_RT_UNSPEC,
  1088		NFTA_RT_DREG,
  1089		NFTA_RT_KEY,
  1090		__NFTA_RT_MAX
  1091	};
  1092	#define NFTA_RT_MAX		(__NFTA_RT_MAX - 1)
  1093	
  1094	/**
  1095	 * enum nft_socket_attributes - nf_tables socket expression netlink attributes
  1096	 *
  1097	 * @NFTA_SOCKET_KEY: socket key to match
  1098	 * @NFTA_SOCKET_DREG: destination register
  1099	 * @NFTA_SOCKET_LEVEL: cgroups2 ancestor level (only for cgroupsv2)
  1100	 */
  1101	enum nft_socket_attributes {
  1102		NFTA_SOCKET_UNSPEC,
  1103		NFTA_SOCKET_KEY,
  1104		NFTA_SOCKET_DREG,
  1105		NFTA_SOCKET_LEVEL,
  1106		__NFTA_SOCKET_MAX
  1107	};
  1108	#define NFTA_SOCKET_MAX		(__NFTA_SOCKET_MAX - 1)
  1109	
  1110	/*
  1111	 * enum nft_socket_keys - nf_tables socket expression keys
  1112	 *
  1113	 * @NFT_SOCKET_TRANSPARENT: Value of the IP(V6)_TRANSPARENT socket option
  1114	 * @NFT_SOCKET_MARK: Value of the socket mark
  1115	 * @NFT_SOCKET_WILDCARD: Whether the socket is zero-bound (e.g. 0.0.0.0 or ::0)
  1116	 * @NFT_SOCKET_CGROUPV2: Match on cgroups version 2
  1117	 */
  1118	enum nft_socket_keys {
  1119		NFT_SOCKET_TRANSPARENT,
  1120		NFT_SOCKET_MARK,
  1121		NFT_SOCKET_WILDCARD,
  1122		NFT_SOCKET_CGROUPV2,
  1123		__NFT_SOCKET_MAX
  1124	};
  1125	#define NFT_SOCKET_MAX	(__NFT_SOCKET_MAX - 1)
  1126	
  1127	/**
  1128	 * enum nft_ct_keys - nf_tables ct expression keys
  1129	 *
  1130	 * @NFT_CT_STATE: conntrack state (bitmask of enum ip_conntrack_info)
  1131	 * @NFT_CT_DIRECTION: conntrack direction (enum ip_conntrack_dir)
  1132	 * @NFT_CT_STATUS: conntrack status (bitmask of enum ip_conntrack_status)
  1133	 * @NFT_CT_MARK: conntrack mark value
  1134	 * @NFT_CT_SECMARK: conntrack secmark value
  1135	 * @NFT_CT_EXPIRATION: relative conntrack expiration time in ms
  1136	 * @NFT_CT_HELPER: connection tracking helper assigned to conntrack
  1137	 * @NFT_CT_L3PROTOCOL: conntrack layer 3 protocol
  1138	 * @NFT_CT_SRC: conntrack layer 3 protocol source (IPv4/IPv6 address, deprecated)
  1139	 * @NFT_CT_DST: conntrack layer 3 protocol destination (IPv4/IPv6 address, deprecated)
  1140	 * @NFT_CT_PROTOCOL: conntrack layer 4 protocol
  1141	 * @NFT_CT_PROTO_SRC: conntrack layer 4 protocol source
  1142	 * @NFT_CT_PROTO_DST: conntrack layer 4 protocol destination
  1143	 * @NFT_CT_LABELS: conntrack labels
  1144	 * @NFT_CT_PKTS: conntrack packets
  1145	 * @NFT_CT_BYTES: conntrack bytes
  1146	 * @NFT_CT_AVGPKT: conntrack average bytes per packet
  1147	 * @NFT_CT_ZONE: conntrack zone
  1148	 * @NFT_CT_EVENTMASK: ctnetlink events to be generated for this conntrack
  1149	 * @NFT_CT_SRC_IP: conntrack layer 3 protocol source (IPv4 address)
  1150	 * @NFT_CT_DST_IP: conntrack layer 3 protocol destination (IPv4 address)
  1151	 * @NFT_CT_SRC_IP6: conntrack layer 3 protocol source (IPv6 address)
  1152	 * @NFT_CT_DST_IP6: conntrack layer 3 protocol destination (IPv6 address)
  1153	 * @NFT_CT_ID: conntrack id
  1154	 */
  1155	enum nft_ct_keys {
  1156		NFT_CT_STATE,
  1157		NFT_CT_DIRECTION,
  1158		NFT_CT_STATUS,
  1159		NFT_CT_MARK,
  1160		NFT_CT_SECMARK,
  1161		NFT_CT_EXPIRATION,
  1162		NFT_CT_HELPER,
  1163		NFT_CT_L3PROTOCOL,
  1164		NFT_CT_SRC,
  1165		NFT_CT_DST,
  1166		NFT_CT_PROTOCOL,
  1167		NFT_CT_PROTO_SRC,
  1168		NFT_CT_PROTO_DST,
  1169		NFT_CT_LABELS,
  1170		NFT_CT_PKTS,
  1171		NFT_CT_BYTES,
  1172		NFT_CT_AVGPKT,
  1173		NFT_CT_ZONE,
  1174		NFT_CT_EVENTMASK,
  1175		NFT_CT_SRC_IP,
  1176		NFT_CT_DST_IP,
  1177		NFT_CT_SRC_IP6,
  1178		NFT_CT_DST_IP6,
  1179		NFT_CT_ID,
  1180		__NFT_CT_MAX
  1181	};
  1182	#define NFT_CT_MAX		(__NFT_CT_MAX - 1)
  1183	
  1184	/**
  1185	 * enum nft_ct_attributes - nf_tables ct expression netlink attributes
  1186	 *
  1187	 * @NFTA_CT_DREG: destination register (NLA_U32)
  1188	 * @NFTA_CT_KEY: conntrack data item to load (NLA_U32: nft_ct_keys)
  1189	 * @NFTA_CT_DIRECTION: direction in case of directional keys (NLA_U8)
  1190	 * @NFTA_CT_SREG: source register (NLA_U32)
  1191	 */
  1192	enum nft_ct_attributes {
  1193		NFTA_CT_UNSPEC,
  1194		NFTA_CT_DREG,
  1195		NFTA_CT_KEY,
  1196		NFTA_CT_DIRECTION,
  1197		NFTA_CT_SREG,
  1198		__NFTA_CT_MAX
  1199	};
  1200	#define NFTA_CT_MAX		(__NFTA_CT_MAX - 1)
  1201	
  1202	/**
  1203	 * enum nft_offload_attributes - ct offload expression attributes
  1204	 * @NFTA_FLOW_TABLE_NAME: flow table name (NLA_STRING)
  1205	 */
  1206	enum nft_offload_attributes {
  1207		NFTA_FLOW_UNSPEC,
  1208		NFTA_FLOW_TABLE_NAME,
  1209		__NFTA_FLOW_MAX,
  1210	};
  1211	#define NFTA_FLOW_MAX		(__NFTA_FLOW_MAX - 1)
  1212	
  1213	enum nft_limit_type {
  1214		NFT_LIMIT_PKTS,
  1215		NFT_LIMIT_PKT_BYTES
  1216	};
  1217	
  1218	enum nft_limit_flags {
  1219		NFT_LIMIT_F_INV	= (1 << 0),
  1220	};
  1221	
  1222	/**
  1223	 * enum nft_limit_attributes - nf_tables limit expression netlink attributes
  1224	 *
  1225	 * @NFTA_LIMIT_RATE: refill rate (NLA_U64)
  1226	 * @NFTA_LIMIT_UNIT: refill unit (NLA_U64)
  1227	 * @NFTA_LIMIT_BURST: burst (NLA_U32)
  1228	 * @NFTA_LIMIT_TYPE: type of limit (NLA_U32: enum nft_limit_type)
  1229	 * @NFTA_LIMIT_FLAGS: flags (NLA_U32: enum nft_limit_flags)
  1230	 */
  1231	enum nft_limit_attributes {
  1232		NFTA_LIMIT_UNSPEC,
  1233		NFTA_LIMIT_RATE,
  1234		NFTA_LIMIT_UNIT,
  1235		NFTA_LIMIT_BURST,
  1236		NFTA_LIMIT_TYPE,
  1237		NFTA_LIMIT_FLAGS,
  1238		NFTA_LIMIT_PAD,
  1239		__NFTA_LIMIT_MAX
  1240	};
  1241	#define NFTA_LIMIT_MAX		(__NFTA_LIMIT_MAX - 1)
  1242	
  1243	enum nft_connlimit_flags {
  1244		NFT_CONNLIMIT_F_INV	= (1 << 0),
  1245	};
  1246	
  1247	/**
  1248	 * enum nft_connlimit_attributes - nf_tables connlimit expression netlink attributes
  1249	 *
  1250	 * @NFTA_CONNLIMIT_COUNT: number of connections (NLA_U32)
  1251	 * @NFTA_CONNLIMIT_FLAGS: flags (NLA_U32: enum nft_connlimit_flags)
  1252	 */
  1253	enum nft_connlimit_attributes {
  1254		NFTA_CONNLIMIT_UNSPEC,
  1255		NFTA_CONNLIMIT_COUNT,
  1256		NFTA_CONNLIMIT_FLAGS,
  1257		__NFTA_CONNLIMIT_MAX
  1258	};
  1259	#define NFTA_CONNLIMIT_MAX	(__NFTA_CONNLIMIT_MAX - 1)
  1260	
  1261	/**
  1262	 * enum nft_counter_attributes - nf_tables counter expression netlink attributes
  1263	 *
  1264	 * @NFTA_COUNTER_BYTES: number of bytes (NLA_U64)
  1265	 * @NFTA_COUNTER_PACKETS: number of packets (NLA_U64)
  1266	 */
  1267	enum nft_counter_attributes {
  1268		NFTA_COUNTER_UNSPEC,
  1269		NFTA_COUNTER_BYTES,
  1270		NFTA_COUNTER_PACKETS,
  1271		NFTA_COUNTER_PAD,
  1272		__NFTA_COUNTER_MAX
  1273	};
  1274	#define NFTA_COUNTER_MAX	(__NFTA_COUNTER_MAX - 1)
  1275	
  1276	/**
  1277	 * enum nft_last_attributes - nf_tables last expression netlink attributes
  1278	 *
  1279	 * @NFTA_LAST_SET: last update has been set, zero means never updated (NLA_U32)
  1280	 * @NFTA_LAST_MSECS: milliseconds since last update (NLA_U64)
  1281	 */
  1282	enum nft_last_attributes {
  1283		NFTA_LAST_UNSPEC,
  1284		NFTA_LAST_SET,
  1285		NFTA_LAST_MSECS,
  1286		NFTA_LAST_PAD,
  1287		__NFTA_LAST_MAX
  1288	};
  1289	#define NFTA_LAST_MAX	(__NFTA_LAST_MAX - 1)
  1290	
  1291	/**
  1292	 * enum nft_log_attributes - nf_tables log expression netlink attributes
  1293	 *
  1294	 * @NFTA_LOG_GROUP: netlink group to send messages to (NLA_U16)
  1295	 * @NFTA_LOG_PREFIX: prefix to prepend to log messages (NLA_STRING)
  1296	 * @NFTA_LOG_SNAPLEN: length of payload to include in netlink message (NLA_U32)
  1297	 * @NFTA_LOG_QTHRESHOLD: queue threshold (NLA_U16)
  1298	 * @NFTA_LOG_LEVEL: log level (NLA_U32)
  1299	 * @NFTA_LOG_FLAGS: logging flags (NLA_U32)
  1300	 */
  1301	enum nft_log_attributes {
  1302		NFTA_LOG_UNSPEC,
  1303		NFTA_LOG_GROUP,
  1304		NFTA_LOG_PREFIX,
  1305		NFTA_LOG_SNAPLEN,
  1306		NFTA_LOG_QTHRESHOLD,
  1307		NFTA_LOG_LEVEL,
  1308		NFTA_LOG_FLAGS,
  1309		__NFTA_LOG_MAX
  1310	};
  1311	#define NFTA_LOG_MAX		(__NFTA_LOG_MAX - 1)
  1312	
  1313	/**
  1314	 * enum nft_log_level - nf_tables log levels
  1315	 *
  1316	 * @NFT_LOGLEVEL_EMERG: system is unusable
  1317	 * @NFT_LOGLEVEL_ALERT: action must be taken immediately
  1318	 * @NFT_LOGLEVEL_CRIT: critical conditions
  1319	 * @NFT_LOGLEVEL_ERR: error conditions
  1320	 * @NFT_LOGLEVEL_WARNING: warning conditions
  1321	 * @NFT_LOGLEVEL_NOTICE: normal but significant condition
  1322	 * @NFT_LOGLEVEL_INFO: informational
  1323	 * @NFT_LOGLEVEL_DEBUG: debug-level messages
  1324	 * @NFT_LOGLEVEL_AUDIT: enabling audit logging
  1325	 */
  1326	enum nft_log_level {
  1327		NFT_LOGLEVEL_EMERG,
  1328		NFT_LOGLEVEL_ALERT,
  1329		NFT_LOGLEVEL_CRIT,
  1330		NFT_LOGLEVEL_ERR,
  1331		NFT_LOGLEVEL_WARNING,
  1332		NFT_LOGLEVEL_NOTICE,
  1333		NFT_LOGLEVEL_INFO,
  1334		NFT_LOGLEVEL_DEBUG,
  1335		NFT_LOGLEVEL_AUDIT,
  1336		__NFT_LOGLEVEL_MAX
  1337	};
  1338	#define NFT_LOGLEVEL_MAX	(__NFT_LOGLEVEL_MAX - 1)
  1339	
  1340	/**
  1341	 * enum nft_queue_attributes - nf_tables queue expression netlink attributes
  1342	 *
  1343	 * @NFTA_QUEUE_NUM: netlink queue to send messages to (NLA_U16)
  1344	 * @NFTA_QUEUE_TOTAL: number of queues to load balance packets on (NLA_U16)
  1345	 * @NFTA_QUEUE_FLAGS: various flags (NLA_U16)
  1346	 * @NFTA_QUEUE_SREG_QNUM: source register of queue number (NLA_U32: nft_registers)
  1347	 */
  1348	enum nft_queue_attributes {
  1349		NFTA_QUEUE_UNSPEC,
  1350		NFTA_QUEUE_NUM,
  1351		NFTA_QUEUE_TOTAL,
  1352		NFTA_QUEUE_FLAGS,
  1353		NFTA_QUEUE_SREG_QNUM,
  1354		__NFTA_QUEUE_MAX
  1355	};
  1356	#define NFTA_QUEUE_MAX		(__NFTA_QUEUE_MAX - 1)
  1357	
  1358	#define NFT_QUEUE_FLAG_BYPASS		0x01 /* for compatibility with v2 */
  1359	#define NFT_QUEUE_FLAG_CPU_FANOUT	0x02 /* use current CPU (no hashing) */
  1360	#define NFT_QUEUE_FLAG_MASK		0x03
  1361	
  1362	enum nft_quota_flags {
  1363		NFT_QUOTA_F_INV		= (1 << 0),
  1364		NFT_QUOTA_F_DEPLETED	= (1 << 1),
  1365	};
  1366	
  1367	/**
  1368	 * enum nft_quota_attributes - nf_tables quota expression netlink attributes
  1369	 *
  1370	 * @NFTA_QUOTA_BYTES: quota in bytes (NLA_U16)
  1371	 * @NFTA_QUOTA_FLAGS: flags (NLA_U32)
  1372	 * @NFTA_QUOTA_CONSUMED: quota already consumed in bytes (NLA_U64)
  1373	 */
  1374	enum nft_quota_attributes {
  1375		NFTA_QUOTA_UNSPEC,
  1376		NFTA_QUOTA_BYTES,
  1377		NFTA_QUOTA_FLAGS,
  1378		NFTA_QUOTA_PAD,
  1379		NFTA_QUOTA_CONSUMED,
  1380		__NFTA_QUOTA_MAX
  1381	};
  1382	#define NFTA_QUOTA_MAX		(__NFTA_QUOTA_MAX - 1)
  1383	
  1384	/**
  1385	 * enum nft_secmark_attributes - nf_tables secmark object netlink attributes
  1386	 *
  1387	 * @NFTA_SECMARK_CTX: security context (NLA_STRING)
  1388	 */
  1389	enum nft_secmark_attributes {
  1390		NFTA_SECMARK_UNSPEC,
  1391		NFTA_SECMARK_CTX,
  1392		__NFTA_SECMARK_MAX,
  1393	};
  1394	#define NFTA_SECMARK_MAX	(__NFTA_SECMARK_MAX - 1)
  1395	
  1396	/* Max security context length */
  1397	#define NFT_SECMARK_CTX_MAXLEN		4096
  1398	
  1399	/**
  1400	 * enum nft_reject_types - nf_tables reject expression reject types
  1401	 *
  1402	 * @NFT_REJECT_ICMP_UNREACH: reject using ICMP unreachable
  1403	 * @NFT_REJECT_TCP_RST: reject using TCP RST
  1404	 * @NFT_REJECT_ICMPX_UNREACH: abstracted ICMP unreachable for bridge and inet
  1405	 */
  1406	enum nft_reject_types {
  1407		NFT_REJECT_ICMP_UNREACH,
  1408		NFT_REJECT_TCP_RST,
  1409		NFT_REJECT_ICMPX_UNREACH,
  1410	};
  1411	
  1412	/**
  1413	 * enum nft_reject_inet_code - Generic reject codes for IPv4/IPv6
  1414	 *
  1415	 * @NFT_REJECT_ICMPX_NO_ROUTE: no route to host / network unreachable
  1416	 * @NFT_REJECT_ICMPX_PORT_UNREACH: port unreachable
  1417	 * @NFT_REJECT_ICMPX_HOST_UNREACH: host unreachable
  1418	 * @NFT_REJECT_ICMPX_ADMIN_PROHIBITED: administratively prohibited
  1419	 *
  1420	 * These codes are mapped to real ICMP and ICMPv6 codes.
  1421	 */
  1422	enum nft_reject_inet_code {
  1423		NFT_REJECT_ICMPX_NO_ROUTE	= 0,
  1424		NFT_REJECT_ICMPX_PORT_UNREACH,
  1425		NFT_REJECT_ICMPX_HOST_UNREACH,
  1426		NFT_REJECT_ICMPX_ADMIN_PROHIBITED,
  1427		__NFT_REJECT_ICMPX_MAX
  1428	};
  1429	#define NFT_REJECT_ICMPX_MAX	(__NFT_REJECT_ICMPX_MAX - 1)
  1430	
  1431	/**
  1432	 * enum nft_reject_attributes - nf_tables reject expression netlink attributes
  1433	 *
  1434	 * @NFTA_REJECT_TYPE: packet type to use (NLA_U32: nft_reject_types)
  1435	 * @NFTA_REJECT_ICMP_CODE: ICMP code to use (NLA_U8)
  1436	 */
  1437	enum nft_reject_attributes {
  1438		NFTA_REJECT_UNSPEC,
  1439		NFTA_REJECT_TYPE,
  1440		NFTA_REJECT_ICMP_CODE,
  1441		__NFTA_REJECT_MAX
  1442	};
  1443	#define NFTA_REJECT_MAX		(__NFTA_REJECT_MAX - 1)
  1444	
  1445	/**
  1446	 * enum nft_nat_types - nf_tables nat expression NAT types
  1447	 *
  1448	 * @NFT_NAT_SNAT: source NAT
  1449	 * @NFT_NAT_DNAT: destination NAT
  1450	 */
  1451	enum nft_nat_types {
  1452		NFT_NAT_SNAT,
  1453		NFT_NAT_DNAT,
  1454	};
  1455	
  1456	/**
  1457	 * enum nft_nat_attributes - nf_tables nat expression netlink attributes
  1458	 *
  1459	 * @NFTA_NAT_TYPE: NAT type (NLA_U32: nft_nat_types)
  1460	 * @NFTA_NAT_FAMILY: NAT family (NLA_U32)
  1461	 * @NFTA_NAT_REG_ADDR_MIN: source register of address range start (NLA_U32: nft_registers)
  1462	 * @NFTA_NAT_REG_ADDR_MAX: source register of address range end (NLA_U32: nft_registers)
  1463	 * @NFTA_NAT_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
  1464	 * @NFTA_NAT_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
  1465	 * @NFTA_NAT_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
  1466	 */
  1467	enum nft_nat_attributes {
  1468		NFTA_NAT_UNSPEC,
  1469		NFTA_NAT_TYPE,
  1470		NFTA_NAT_FAMILY,
  1471		NFTA_NAT_REG_ADDR_MIN,
  1472		NFTA_NAT_REG_ADDR_MAX,
  1473		NFTA_NAT_REG_PROTO_MIN,
  1474		NFTA_NAT_REG_PROTO_MAX,
  1475		NFTA_NAT_FLAGS,
  1476		__NFTA_NAT_MAX
  1477	};
  1478	#define NFTA_NAT_MAX		(__NFTA_NAT_MAX - 1)
  1479	
  1480	/**
  1481	 * enum nft_tproxy_attributes - nf_tables tproxy expression netlink attributes
  1482	 *
  1483	 * @NFTA_TPROXY_FAMILY: Target address family (NLA_U32: nft_registers)
  1484	 * @NFTA_TPROXY_REG_ADDR: Target address register (NLA_U32: nft_registers)
  1485	 * @NFTA_TPROXY_REG_PORT: Target port register (NLA_U32: nft_registers)
  1486	 */
  1487	enum nft_tproxy_attributes {
  1488		NFTA_TPROXY_UNSPEC,
  1489		NFTA_TPROXY_FAMILY,
  1490		NFTA_TPROXY_REG_ADDR,
  1491		NFTA_TPROXY_REG_PORT,
  1492		__NFTA_TPROXY_MAX
  1493	};
  1494	#define NFTA_TPROXY_MAX		(__NFTA_TPROXY_MAX - 1)
  1495	
  1496	/**
  1497	 * enum nft_masq_attributes - nf_tables masquerade expression attributes
  1498	 *
  1499	 * @NFTA_MASQ_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
  1500	 * @NFTA_MASQ_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
  1501	 * @NFTA_MASQ_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
  1502	 */
  1503	enum nft_masq_attributes {
  1504		NFTA_MASQ_UNSPEC,
  1505		NFTA_MASQ_FLAGS,
  1506		NFTA_MASQ_REG_PROTO_MIN,
  1507		NFTA_MASQ_REG_PROTO_MAX,
  1508		__NFTA_MASQ_MAX
  1509	};
  1510	#define NFTA_MASQ_MAX		(__NFTA_MASQ_MAX - 1)
  1511	
  1512	/**
  1513	 * enum nft_redir_attributes - nf_tables redirect expression netlink attributes
  1514	 *
  1515	 * @NFTA_REDIR_REG_PROTO_MIN: source register of proto range start (NLA_U32: nft_registers)
  1516	 * @NFTA_REDIR_REG_PROTO_MAX: source register of proto range end (NLA_U32: nft_registers)
  1517	 * @NFTA_REDIR_FLAGS: NAT flags (see NF_NAT_RANGE_* in linux/netfilter/nf_nat.h) (NLA_U32)
  1518	 */
  1519	enum nft_redir_attributes {
  1520		NFTA_REDIR_UNSPEC,
  1521		NFTA_REDIR_REG_PROTO_MIN,
  1522		NFTA_REDIR_REG_PROTO_MAX,
  1523		NFTA_REDIR_FLAGS,
  1524		__NFTA_REDIR_MAX
  1525	};
  1526	#define NFTA_REDIR_MAX		(__NFTA_REDIR_MAX - 1)
  1527	
  1528	/**
  1529	 * enum nft_dup_attributes - nf_tables dup expression netlink attributes
  1530	 *
  1531	 * @NFTA_DUP_SREG_ADDR: source register of address (NLA_U32: nft_registers)
  1532	 * @NFTA_DUP_SREG_DEV: source register of output interface (NLA_U32: nft_register)
  1533	 */
  1534	enum nft_dup_attributes {
  1535		NFTA_DUP_UNSPEC,
  1536		NFTA_DUP_SREG_ADDR,
  1537		NFTA_DUP_SREG_DEV,
  1538		__NFTA_DUP_MAX
  1539	};
  1540	#define NFTA_DUP_MAX		(__NFTA_DUP_MAX - 1)
  1541	
  1542	/**
  1543	 * enum nft_fwd_attributes - nf_tables fwd expression netlink attributes
  1544	 *
  1545	 * @NFTA_FWD_SREG_DEV: source register of output interface (NLA_U32: nft_register)
  1546	 * @NFTA_FWD_SREG_ADDR: source register of destination address (NLA_U32: nft_register)
  1547	 * @NFTA_FWD_NFPROTO: layer 3 family of source register address (NLA_U32: enum nfproto)
  1548	 */
  1549	enum nft_fwd_attributes {
  1550		NFTA_FWD_UNSPEC,
  1551		NFTA_FWD_SREG_DEV,
  1552		NFTA_FWD_SREG_ADDR,
  1553		NFTA_FWD_NFPROTO,
  1554		__NFTA_FWD_MAX
  1555	};
  1556	#define NFTA_FWD_MAX	(__NFTA_FWD_MAX - 1)
  1557	
  1558	/**
  1559	 * enum nft_objref_attributes - nf_tables stateful object expression netlink attributes
  1560	 *
  1561	 * @NFTA_OBJREF_IMM_TYPE: object type for immediate reference (NLA_U32: nft_register)
  1562	 * @NFTA_OBJREF_IMM_NAME: object name for immediate reference (NLA_STRING)
  1563	 * @NFTA_OBJREF_SET_SREG: source register of the data to look for (NLA_U32: nft_registers)
  1564	 * @NFTA_OBJREF_SET_NAME: name of the set where to look for (NLA_STRING)
  1565	 * @NFTA_OBJREF_SET_ID: id of the set where to look for in this transaction (NLA_U32)
  1566	 */
  1567	enum nft_objref_attributes {
  1568		NFTA_OBJREF_UNSPEC,
  1569		NFTA_OBJREF_IMM_TYPE,
  1570		NFTA_OBJREF_IMM_NAME,
  1571		NFTA_OBJREF_SET_SREG,
  1572		NFTA_OBJREF_SET_NAME,
  1573		NFTA_OBJREF_SET_ID,
  1574		__NFTA_OBJREF_MAX
  1575	};
  1576	#define NFTA_OBJREF_MAX	(__NFTA_OBJREF_MAX - 1)
  1577	
  1578	/**
  1579	 * enum nft_gen_attributes - nf_tables ruleset generation attributes
  1580	 *
  1581	 * @NFTA_GEN_ID: Ruleset generation ID (NLA_U32)
  1582	 */
  1583	enum nft_gen_attributes {
  1584		NFTA_GEN_UNSPEC,
  1585		NFTA_GEN_ID,
  1586		NFTA_GEN_PROC_PID,
  1587		NFTA_GEN_PROC_NAME,
  1588		__NFTA_GEN_MAX
  1589	};
  1590	#define NFTA_GEN_MAX		(__NFTA_GEN_MAX - 1)
  1591	
  1592	/*
  1593	 * enum nft_fib_attributes - nf_tables fib expression netlink attributes
  1594	 *
  1595	 * @NFTA_FIB_DREG: destination register (NLA_U32)
  1596	 * @NFTA_FIB_RESULT: desired result (NLA_U32)
  1597	 * @NFTA_FIB_FLAGS: flowi fields to initialize when querying the FIB (NLA_U32)
  1598	 *
  1599	 * The FIB expression performs a route lookup according
  1600	 * to the packet data.
  1601	 */
  1602	enum nft_fib_attributes {
  1603		NFTA_FIB_UNSPEC,
  1604		NFTA_FIB_DREG,
  1605		NFTA_FIB_RESULT,
  1606		NFTA_FIB_FLAGS,
  1607		__NFTA_FIB_MAX
  1608	};
  1609	#define NFTA_FIB_MAX (__NFTA_FIB_MAX - 1)
  1610	
  1611	enum nft_fib_result {
  1612		NFT_FIB_RESULT_UNSPEC,
  1613		NFT_FIB_RESULT_OIF,
  1614		NFT_FIB_RESULT_OIFNAME,
  1615		NFT_FIB_RESULT_ADDRTYPE,
  1616		__NFT_FIB_RESULT_MAX
  1617	};
  1618	#define NFT_FIB_RESULT_MAX	(__NFT_FIB_RESULT_MAX - 1)
  1619	
  1620	enum nft_fib_flags {
  1621		NFTA_FIB_F_SADDR	= 1 << 0,	/* look up src */
  1622		NFTA_FIB_F_DADDR	= 1 << 1,	/* look up dst */
  1623		NFTA_FIB_F_MARK		= 1 << 2,	/* use skb->mark */
  1624		NFTA_FIB_F_IIF		= 1 << 3,	/* restrict to iif */
  1625		NFTA_FIB_F_OIF		= 1 << 4,	/* restrict to oif */
  1626		NFTA_FIB_F_PRESENT	= 1 << 5,	/* check existence only */
  1627	};
  1628	
  1629	enum nft_ct_helper_attributes {
  1630		NFTA_CT_HELPER_UNSPEC,
  1631		NFTA_CT_HELPER_NAME,
  1632		NFTA_CT_HELPER_L3PROTO,
  1633		NFTA_CT_HELPER_L4PROTO,
  1634		__NFTA_CT_HELPER_MAX,
  1635	};
  1636	#define NFTA_CT_HELPER_MAX	(__NFTA_CT_HELPER_MAX - 1)
  1637	
  1638	enum nft_ct_timeout_timeout_attributes {
  1639		NFTA_CT_TIMEOUT_UNSPEC,
  1640		NFTA_CT_TIMEOUT_L3PROTO,
  1641		NFTA_CT_TIMEOUT_L4PROTO,
  1642		NFTA_CT_TIMEOUT_DATA,
  1643		__NFTA_CT_TIMEOUT_MAX,
  1644	};
  1645	#define NFTA_CT_TIMEOUT_MAX	(__NFTA_CT_TIMEOUT_MAX - 1)
  1646	
  1647	enum nft_ct_expectation_attributes {
  1648		NFTA_CT_EXPECT_UNSPEC,
  1649		NFTA_CT_EXPECT_L3PROTO,
  1650		NFTA_CT_EXPECT_L4PROTO,
  1651		NFTA_CT_EXPECT_DPORT,
  1652		NFTA_CT_EXPECT_TIMEOUT,
  1653		NFTA_CT_EXPECT_SIZE,
  1654		__NFTA_CT_EXPECT_MAX,
  1655	};
  1656	#define NFTA_CT_EXPECT_MAX	(__NFTA_CT_EXPECT_MAX - 1)
  1657	
  1658	#define NFT_OBJECT_UNSPEC	0
  1659	#define NFT_OBJECT_COUNTER	1
  1660	#define NFT_OBJECT_QUOTA	2
  1661	#define NFT_OBJECT_CT_HELPER	3
  1662	#define NFT_OBJECT_LIMIT	4
  1663	#define NFT_OBJECT_CONNLIMIT	5
  1664	#define NFT_OBJECT_TUNNEL	6
  1665	#define NFT_OBJECT_CT_TIMEOUT	7
  1666	#define NFT_OBJECT_SECMARK	8
  1667	#define NFT_OBJECT_CT_EXPECT	9
  1668	#define NFT_OBJECT_SYNPROXY	10
  1669	#define __NFT_OBJECT_MAX	11
  1670	#define NFT_OBJECT_MAX		(__NFT_OBJECT_MAX - 1)
  1671	
  1672	/**
  1673	 * enum nft_object_attributes - nf_tables stateful object netlink attributes
  1674	 *
  1675	 * @NFTA_OBJ_TABLE: name of the table containing the expression (NLA_STRING)
  1676	 * @NFTA_OBJ_NAME: name of this expression type (NLA_STRING)
  1677	 * @NFTA_OBJ_TYPE: stateful object type (NLA_U32)
  1678	 * @NFTA_OBJ_DATA: stateful object data (NLA_NESTED)
  1679	 * @NFTA_OBJ_USE: number of references to this expression (NLA_U32)
  1680	 * @NFTA_OBJ_HANDLE: object handle (NLA_U64)
  1681	 * @NFTA_OBJ_USERDATA: user data (NLA_BINARY)
  1682	 */
  1683	enum nft_object_attributes {
  1684		NFTA_OBJ_UNSPEC,
  1685		NFTA_OBJ_TABLE,
  1686		NFTA_OBJ_NAME,
  1687		NFTA_OBJ_TYPE,
  1688		NFTA_OBJ_DATA,
  1689		NFTA_OBJ_USE,
  1690		NFTA_OBJ_HANDLE,
  1691		NFTA_OBJ_PAD,
  1692		NFTA_OBJ_USERDATA,
  1693		__NFTA_OBJ_MAX
  1694	};
  1695	#define NFTA_OBJ_MAX		(__NFTA_OBJ_MAX - 1)
  1696	
  1697	/**
  1698	 * enum nft_flowtable_flags - nf_tables flowtable flags
  1699	 *
  1700	 * @NFT_FLOWTABLE_HW_OFFLOAD: flowtable hardware offload is enabled
  1701	 * @NFT_FLOWTABLE_COUNTER: enable flow counters
  1702	 */
  1703	enum nft_flowtable_flags {
  1704		NFT_FLOWTABLE_HW_OFFLOAD	= 0x1,
  1705		NFT_FLOWTABLE_COUNTER		= 0x2,
  1706		NFT_FLOWTABLE_MASK		= (NFT_FLOWTABLE_HW_OFFLOAD |
  1707						   NFT_FLOWTABLE_COUNTER)
  1708	};
  1709	
  1710	/**
  1711	 * enum nft_flowtable_attributes - nf_tables flow table netlink attributes
  1712	 *
  1713	 * @NFTA_FLOWTABLE_TABLE: name of the table containing the expression (NLA_STRING)
  1714	 * @NFTA_FLOWTABLE_NAME: name of this flow table (NLA_STRING)
  1715	 * @NFTA_FLOWTABLE_HOOK: netfilter hook configuration (NLA_NESTED)
  1716	 * @NFTA_FLOWTABLE_USE: number of references to this flow table (NLA_U32)
  1717	 * @NFTA_FLOWTABLE_HANDLE: object handle (NLA_U64)
  1718	 * @NFTA_FLOWTABLE_FLAGS: flags (NLA_U32)
  1719	 */
  1720	enum nft_flowtable_attributes {
  1721		NFTA_FLOWTABLE_UNSPEC,
  1722		NFTA_FLOWTABLE_TABLE,
  1723		NFTA_FLOWTABLE_NAME,
  1724		NFTA_FLOWTABLE_HOOK,
  1725		NFTA_FLOWTABLE_USE,
  1726		NFTA_FLOWTABLE_HANDLE,
  1727		NFTA_FLOWTABLE_PAD,
  1728		NFTA_FLOWTABLE_FLAGS,
  1729		__NFTA_FLOWTABLE_MAX
  1730	};
  1731	#define NFTA_FLOWTABLE_MAX	(__NFTA_FLOWTABLE_MAX - 1)
  1732	
  1733	/**
  1734	 * enum nft_flowtable_hook_attributes - nf_tables flow table hook netlink attributes
  1735	 *
  1736	 * @NFTA_FLOWTABLE_HOOK_NUM: netfilter hook number (NLA_U32)
  1737	 * @NFTA_FLOWTABLE_HOOK_PRIORITY: netfilter hook priority (NLA_U32)
  1738	 * @NFTA_FLOWTABLE_HOOK_DEVS: input devices this flow table is bound to (NLA_NESTED)
  1739	 */
  1740	enum nft_flowtable_hook_attributes {
  1741		NFTA_FLOWTABLE_HOOK_UNSPEC,
  1742		NFTA_FLOWTABLE_HOOK_NUM,
  1743		NFTA_FLOWTABLE_HOOK_PRIORITY,
  1744		NFTA_FLOWTABLE_HOOK_DEVS,
  1745		__NFTA_FLOWTABLE_HOOK_MAX
  1746	};
  1747	#define NFTA_FLOWTABLE_HOOK_MAX	(__NFTA_FLOWTABLE_HOOK_MAX - 1)
  1748	
  1749	/**
  1750	 * enum nft_osf_attributes - nftables osf expression netlink attributes
  1751	 *
  1752	 * @NFTA_OSF_DREG: destination register (NLA_U32: nft_registers)
  1753	 * @NFTA_OSF_TTL: Value of the TTL osf option (NLA_U8)
  1754	 * @NFTA_OSF_FLAGS: flags (NLA_U32)
  1755	 */
  1756	enum nft_osf_attributes {
  1757		NFTA_OSF_UNSPEC,
  1758		NFTA_OSF_DREG,
  1759		NFTA_OSF_TTL,
  1760		NFTA_OSF_FLAGS,
  1761		__NFTA_OSF_MAX,
  1762	};
  1763	#define NFTA_OSF_MAX (__NFTA_OSF_MAX - 1)
  1764	
  1765	enum nft_osf_flags {
  1766		NFT_OSF_F_VERSION = (1 << 0),
  1767	};
  1768	
  1769	/**
  1770	 * enum nft_synproxy_attributes - nf_tables synproxy expression netlink attributes
  1771	 *
  1772	 * @NFTA_SYNPROXY_MSS: mss value sent to the backend (NLA_U16)
  1773	 * @NFTA_SYNPROXY_WSCALE: wscale value sent to the backend (NLA_U8)
  1774	 * @NFTA_SYNPROXY_FLAGS: flags (NLA_U32)
  1775	 */
  1776	enum nft_synproxy_attributes {
  1777		NFTA_SYNPROXY_UNSPEC,
  1778		NFTA_SYNPROXY_MSS,
  1779		NFTA_SYNPROXY_WSCALE,
  1780		NFTA_SYNPROXY_FLAGS,
  1781		__NFTA_SYNPROXY_MAX,
  1782	};
  1783	#define NFTA_SYNPROXY_MAX (__NFTA_SYNPROXY_MAX - 1)
  1784	
  1785	/**
  1786	 * enum nft_devices_attributes - nf_tables device netlink attributes
  1787	 *
  1788	 * @NFTA_DEVICE_NAME: name of this device (NLA_STRING)
  1789	 * @NFTA_DEVICE_PREFIX: device name prefix, a simple wildcard (NLA_STRING)
  1790	 */
  1791	enum nft_devices_attributes {
  1792		NFTA_DEVICE_UNSPEC,
  1793		NFTA_DEVICE_NAME,
  1794		NFTA_DEVICE_PREFIX,
  1795		__NFTA_DEVICE_MAX
  1796	};
  1797	#define NFTA_DEVICE_MAX		(__NFTA_DEVICE_MAX - 1)
  1798	
  1799	/*
  1800	 * enum nft_xfrm_attributes - nf_tables xfrm expr netlink attributes
  1801	 *
  1802	 * @NFTA_XFRM_DREG: destination register (NLA_U32)
  1803	 * @NFTA_XFRM_KEY: enum nft_xfrm_keys (NLA_U32)
  1804	 * @NFTA_XFRM_DIR: direction (NLA_U8)
  1805	 * @NFTA_XFRM_SPNUM: index in secpath array (NLA_U32)
  1806	 */
  1807	enum nft_xfrm_attributes {
  1808		NFTA_XFRM_UNSPEC,
  1809		NFTA_XFRM_DREG,
  1810		NFTA_XFRM_KEY,
  1811		NFTA_XFRM_DIR,
  1812		NFTA_XFRM_SPNUM,
  1813		__NFTA_XFRM_MAX
  1814	};
  1815	#define NFTA_XFRM_MAX (__NFTA_XFRM_MAX - 1)
  1816	
  1817	enum nft_xfrm_keys {
  1818		NFT_XFRM_KEY_UNSPEC,
  1819		NFT_XFRM_KEY_DADDR_IP4,
  1820		NFT_XFRM_KEY_DADDR_IP6,
  1821		NFT_XFRM_KEY_SADDR_IP4,
  1822		NFT_XFRM_KEY_SADDR_IP6,
  1823		NFT_XFRM_KEY_REQID,
  1824		NFT_XFRM_KEY_SPI,
  1825		__NFT_XFRM_KEY_MAX,
  1826	};
  1827	#define NFT_XFRM_KEY_MAX (__NFT_XFRM_KEY_MAX - 1)
  1828	
  1829	/**
  1830	 * enum nft_trace_attributes - nf_tables trace netlink attributes
  1831	 *
  1832	 * @NFTA_TRACE_TABLE: name of the table (NLA_STRING)
  1833	 * @NFTA_TRACE_CHAIN: name of the chain (NLA_STRING)
  1834	 * @NFTA_TRACE_RULE_HANDLE: numeric handle of the rule (NLA_U64)
  1835	 * @NFTA_TRACE_TYPE: type of the event (NLA_U32: nft_trace_types)
  1836	 * @NFTA_TRACE_VERDICT: verdict returned by hook (NLA_NESTED: nft_verdicts)
  1837	 * @NFTA_TRACE_ID: pseudo-id, same for each skb traced (NLA_U32)
  1838	 * @NFTA_TRACE_LL_HEADER: linklayer header (NLA_BINARY)
  1839	 * @NFTA_TRACE_NETWORK_HEADER: network header (NLA_BINARY)
  1840	 * @NFTA_TRACE_TRANSPORT_HEADER: transport header (NLA_BINARY)
  1841	 * @NFTA_TRACE_IIF: indev ifindex (NLA_U32)
  1842	 * @NFTA_TRACE_IIFTYPE: netdev->type of indev (NLA_U16)
  1843	 * @NFTA_TRACE_OIF: outdev ifindex (NLA_U32)
  1844	 * @NFTA_TRACE_OIFTYPE: netdev->type of outdev (NLA_U16)
  1845	 * @NFTA_TRACE_MARK: nfmark (NLA_U32)
  1846	 * @NFTA_TRACE_NFPROTO: nf protocol processed (NLA_U32)
  1847	 * @NFTA_TRACE_POLICY: policy that decided fate of packet (NLA_U32)
  1848	 * @NFTA_TRACE_CT_ID: conntrack id (NLA_U32)
  1849	 * @NFTA_TRACE_CT_DIRECTION: packets direction (NLA_U8)
  1850	 * @NFTA_TRACE_CT_STATUS: conntrack status (NLA_U32)
  1851	 * @NFTA_TRACE_CT_STATE: packet state (new, established, ...) (NLA_U32)
  1852	 */
  1853	enum nft_trace_attributes {
  1854		NFTA_TRACE_UNSPEC,
  1855		NFTA_TRACE_TABLE,
  1856		NFTA_TRACE_CHAIN,
  1857		NFTA_TRACE_RULE_HANDLE,
  1858		NFTA_TRACE_TYPE,
  1859		NFTA_TRACE_VERDICT,
  1860		NFTA_TRACE_ID,
  1861		NFTA_TRACE_LL_HEADER,
  1862		NFTA_TRACE_NETWORK_HEADER,
  1863		NFTA_TRACE_TRANSPORT_HEADER,
  1864		NFTA_TRACE_IIF,
  1865		NFTA_TRACE_IIFTYPE,
  1866		NFTA_TRACE_OIF,
  1867		NFTA_TRACE_OIFTYPE,
  1868		NFTA_TRACE_MARK,
  1869		NFTA_TRACE_NFPROTO,
  1870		NFTA_TRACE_POLICY,
  1871		NFTA_TRACE_PAD,
  1872		NFTA_TRACE_CT_ID,
  1873		NFTA_TRACE_CT_DIRECTION,
  1874		NFTA_TRACE_CT_STATUS,
  1875		NFTA_TRACE_CT_STATE,
  1876		__NFTA_TRACE_MAX
  1877	};
  1878	#define NFTA_TRACE_MAX (__NFTA_TRACE_MAX - 1)
  1879	
  1880	enum nft_trace_types {
  1881		NFT_TRACETYPE_UNSPEC,
  1882		NFT_TRACETYPE_POLICY,
  1883		NFT_TRACETYPE_RETURN,
  1884		NFT_TRACETYPE_RULE,
  1885		__NFT_TRACETYPE_MAX
  1886	};
  1887	#define NFT_TRACETYPE_MAX (__NFT_TRACETYPE_MAX - 1)
  1888	
  1889	/**
  1890	 * enum nft_ng_attributes - nf_tables number generator expression netlink attributes
  1891	 *
  1892	 * @NFTA_NG_DREG: destination register (NLA_U32)
  1893	 * @NFTA_NG_MODULUS: maximum counter value (NLA_U32)
  1894	 * @NFTA_NG_TYPE: operation type (NLA_U32)
  1895	 * @NFTA_NG_OFFSET: offset to be added to the counter (NLA_U32)
  1896	 * @NFTA_NG_SET_NAME: name of the map to lookup (NLA_STRING)
  1897	 * @NFTA_NG_SET_ID: id of the map (NLA_U32)
  1898	 */
  1899	enum nft_ng_attributes {
  1900		NFTA_NG_UNSPEC,
  1901		NFTA_NG_DREG,
  1902		NFTA_NG_MODULUS,
  1903		NFTA_NG_TYPE,
  1904		NFTA_NG_OFFSET,
  1905		NFTA_NG_SET_NAME,	/* deprecated */
  1906		NFTA_NG_SET_ID,		/* deprecated */
  1907		__NFTA_NG_MAX
  1908	};
  1909	#define NFTA_NG_MAX	(__NFTA_NG_MAX - 1)
  1910	
  1911	enum nft_ng_types {
  1912		NFT_NG_INCREMENTAL,
  1913		NFT_NG_RANDOM,
  1914		__NFT_NG_MAX
  1915	};
  1916	#define NFT_NG_MAX	(__NFT_NG_MAX - 1)
  1917	
  1918	enum nft_tunnel_key_ip_attributes {
  1919		NFTA_TUNNEL_KEY_IP_UNSPEC,
  1920		NFTA_TUNNEL_KEY_IP_SRC,
  1921		NFTA_TUNNEL_KEY_IP_DST,
  1922		__NFTA_TUNNEL_KEY_IP_MAX
  1923	};
  1924	#define NFTA_TUNNEL_KEY_IP_MAX	(__NFTA_TUNNEL_KEY_IP_MAX - 1)
  1925	
  1926	enum nft_tunnel_ip6_attributes {
  1927		NFTA_TUNNEL_KEY_IP6_UNSPEC,
  1928		NFTA_TUNNEL_KEY_IP6_SRC,
  1929		NFTA_TUNNEL_KEY_IP6_DST,
  1930		NFTA_TUNNEL_KEY_IP6_FLOWLABEL,
  1931		__NFTA_TUNNEL_KEY_IP6_MAX
  1932	};
  1933	#define NFTA_TUNNEL_KEY_IP6_MAX	(__NFTA_TUNNEL_KEY_IP6_MAX - 1)
  1934	
  1935	enum nft_tunnel_opts_attributes {
  1936		NFTA_TUNNEL_KEY_OPTS_UNSPEC,
  1937		NFTA_TUNNEL_KEY_OPTS_VXLAN,
  1938		NFTA_TUNNEL_KEY_OPTS_ERSPAN,
  1939		NFTA_TUNNEL_KEY_OPTS_GENEVE,
  1940		__NFTA_TUNNEL_KEY_OPTS_MAX
  1941	};
  1942	#define NFTA_TUNNEL_KEY_OPTS_MAX	(__NFTA_TUNNEL_KEY_OPTS_MAX - 1)
  1943	
  1944	enum nft_tunnel_opts_vxlan_attributes {
  1945		NFTA_TUNNEL_KEY_VXLAN_UNSPEC,
  1946		NFTA_TUNNEL_KEY_VXLAN_GBP,
  1947		__NFTA_TUNNEL_KEY_VXLAN_MAX
  1948	};
  1949	#define NFTA_TUNNEL_KEY_VXLAN_MAX	(__NFTA_TUNNEL_KEY_VXLAN_MAX - 1)
  1950	
  1951	enum nft_tunnel_opts_erspan_attributes {
  1952		NFTA_TUNNEL_KEY_ERSPAN_UNSPEC,
  1953		NFTA_TUNNEL_KEY_ERSPAN_VERSION,
  1954		NFTA_TUNNEL_KEY_ERSPAN_V1_INDEX,
  1955		NFTA_TUNNEL_KEY_ERSPAN_V2_HWID,
  1956		NFTA_TUNNEL_KEY_ERSPAN_V2_DIR,
  1957		__NFTA_TUNNEL_KEY_ERSPAN_MAX
  1958	};
  1959	#define NFTA_TUNNEL_KEY_ERSPAN_MAX	(__NFTA_TUNNEL_KEY_ERSPAN_MAX - 1)
  1960	
  1961	enum nft_tunnel_opts_geneve_attributes {
  1962		NFTA_TUNNEL_KEY_GENEVE_UNSPEC,
  1963		NFTA_TUNNEL_KEY_GENEVE_CLASS,
  1964		NFTA_TUNNEL_KEY_GENEVE_TYPE,
  1965		NFTA_TUNNEL_KEY_GENEVE_DATA,
  1966		__NFTA_TUNNEL_KEY_GENEVE_MAX
  1967	};
  1968	#define NFTA_TUNNEL_KEY_GENEVE_MAX	(__NFTA_TUNNEL_KEY_GENEVE_MAX - 1)
  1969	
  1970	enum nft_tunnel_flags {
  1971		NFT_TUNNEL_F_ZERO_CSUM_TX	= (1 << 0),
  1972		NFT_TUNNEL_F_DONT_FRAGMENT	= (1 << 1),
  1973		NFT_TUNNEL_F_SEQ_NUMBER		= (1 << 2),
  1974	};
  1975	#define NFT_TUNNEL_F_MASK	(NFT_TUNNEL_F_ZERO_CSUM_TX | \
  1976					 NFT_TUNNEL_F_DONT_FRAGMENT | \
  1977					 NFT_TUNNEL_F_SEQ_NUMBER)
  1978	
  1979	enum nft_tunnel_key_attributes {
  1980		NFTA_TUNNEL_KEY_UNSPEC,
  1981		NFTA_TUNNEL_KEY_ID,
  1982		NFTA_TUNNEL_KEY_IP,
  1983		NFTA_TUNNEL_KEY_IP6,
  1984		NFTA_TUNNEL_KEY_FLAGS,
  1985		NFTA_TUNNEL_KEY_TOS,
  1986		NFTA_TUNNEL_KEY_TTL,
  1987		NFTA_TUNNEL_KEY_SPORT,
  1988		NFTA_TUNNEL_KEY_DPORT,
  1989		NFTA_TUNNEL_KEY_OPTS,
  1990		__NFTA_TUNNEL_KEY_MAX
  1991	};
  1992	#define NFTA_TUNNEL_KEY_MAX	(__NFTA_TUNNEL_KEY_MAX - 1)
  1993	
  1994	enum nft_tunnel_keys {
  1995		NFT_TUNNEL_PATH,
  1996		NFT_TUNNEL_ID,
  1997		__NFT_TUNNEL_MAX
  1998	};
  1999	#define NFT_TUNNEL_MAX	(__NFT_TUNNEL_MAX - 1)
  2000	
  2001	enum nft_tunnel_mode {
  2002		NFT_TUNNEL_MODE_NONE,
  2003		NFT_TUNNEL_MODE_RX,
  2004		NFT_TUNNEL_MODE_TX,
  2005		__NFT_TUNNEL_MODE_MAX
  2006	};
  2007	#define NFT_TUNNEL_MODE_MAX	(__NFT_TUNNEL_MODE_MAX - 1)
  2008	
  2009	enum nft_tunnel_attributes {
  2010		NFTA_TUNNEL_UNSPEC,
  2011		NFTA_TUNNEL_KEY,
  2012		NFTA_TUNNEL_DREG,
  2013		NFTA_TUNNEL_MODE,
  2014		__NFTA_TUNNEL_MAX
  2015	};
  2016	#define NFTA_TUNNEL_MAX	(__NFTA_TUNNEL_MAX - 1)
  2017	
  2018	#endif /* _LINUX_NF_TABLES_H */