The Linux Kernel
5.14.0-570.19.1.el9_6.x86_64
  • The Linux kernel user’s and administrator’s guide
  • Kernel Build System
  • The Linux kernel firmware guide
  • Open Firmware and Devicetree
  • The Linux kernel user-space API guide
  • Working with the kernel development community
  • Development tools for the kernel
  • How to write kernel documentation
  • Kernel Hacking Guides
  • Linux Tracing Technologies
  • Kernel Maintainer Handbook
  • fault-injection
  • Kernel Livepatching
  • Rust
  • The Linux driver implementer’s API guide
  • Core API Documentation
  • locking
  • Accounting
  • Block
  • cdrom
  • Linux CPUFreq - CPU frequency and voltage scaling code in the Linux(TM) kernel
  • Integrated Drive Electronics (IDE)
  • Frame Buffer
  • fpga
  • Human Interface Devices (HID)
  • I2C/SMBus Subsystem
  • Industrial I/O
  • ISDN
  • InfiniBand
  • LEDs
  • NetLabel
  • Linux Networking Documentation
    • netdev FAQ
    • AF_XDP
    • Bare UDP Tunnelling Module Documentation
    • batman-adv
    • SocketCAN - Controller Area Network
    • The UCAN Protocol
    • Hardware Device Drivers
    • Distributed Switch Architecture
    • Linux Devlink Documentation
    • CAIF
    • Netlink interface for ethtool
    • IEEE 802.15.4 Developer’s Guide
    • J1939 Documentation
    • Linux Networking and Network Devices APIs
    • MSG_ZEROCOPY
    • FAILOVER
    • Net DIM - Generic Network Dynamic Interrupt Moderation
    • NET_FAILOVER
    • Page Pool API
    • PHY Abstraction Layer
    • phylink
    • IP-Aliasing
    • Ethernet Bridging
    • SNMP counter
    • Checksum Offloads
    • Segmentation Offloads
    • Scaling in the Linux Networking Stack
    • Kernel TLS
    • Kernel TLS offload
    • In-Kernel TLS Handshake
    • Linux NFC subsystem
    • Netdev private dataroom for 6lowpan interfaces
    • 6pack Protocol
    • ARCnet Hardware
    • ARCnet
    • ATM
    • AX.25
    • Linux Ethernet Bonding Driver HOWTO
    • cdc_mbim - Driver for CDC MBIM Mobile Broadband modems
    • DCCP protocol
    • DCTCP (DataCenter TCP)
    • Linux DECnet Networking Layer Information
    • DNS Resolver Module
    • Softnet Driver Issues
    • EQL Driver: Serial IP Load Balancing HOWTO
    • LC-trie implementation notes
    • Linux Socket Filtering aka Berkeley Packet Filter (BPF)
    • Generic HDLC layer
    • Generic Netlink
    • Netlink Family Specifications
      • Family devlink netlink specification
      • Family dpll netlink specification
      • Family ethtool netlink specification
      • Family fou netlink specification
      • Family handshake netlink specification
      • Family mptcp_pm netlink specification
      • Family netdev netlink specification
      • Family nfsd netlink specification
      • Family nftables netlink specification
        • Summary
        • Operations
        • Multicast groups
        • Definitions
        • Attribute sets
        • Sub-messages
      • Family nlctrl netlink specification
      • Family ovs_datapath netlink specification
      • Family ovs_flow netlink specification
      • Family ovs_vport netlink specification
      • Family rt-addr netlink specification
      • Family rt-link netlink specification
      • Family rt-route netlink specification
      • Family tc netlink specification
      • Family tcp_metrics netlink specification
    • Generic networking statistics for netlink users
    • The Linux kernel GTP tunneling module
    • Identifier Locator Addressing (ILA)
    • AppleTalk-IP Decapsulation and AppleTalk-IP Encapsulation
    • IP dynamic address hack-port v0.03
    • IPsec
    • IP Sysctl
    • IPv6
    • IPVLAN Driver HOWTO
    • IPvs-sysctl
    • Kernel Connection Multiplexor
    • L2TP
    • The Linux LAPB Module Interface
    • How to use packet injection with mac80211
    • MPLS Sysfs variables
    • MPTCP Sysfs variables
    • HOWTO for multiqueue network device support
    • Multi-PF Netdev
    • Common Networking Struct Cachelines
    • Netconsole
    • Netdev features mess and how to get out from it alive
    • Network Devices, the Kernel, and You!
    • Netfilter Sysfs variables
    • NETIF Msg Level
    • Resilient Next-hop Groups
    • Netfilter Conntrack Sysfs variables
    • Netfilter’s flowtable infrastructure
    • Open vSwitch datapath developer documentation
    • Operational States
    • Packet MMAP
    • Linux Phonet protocol family
    • PHY link topology
    • HOWTO for the linux packet generator
    • PLIP: The Parallel Line Internet Protocol Device
    • PPP Generic Driver and Channel Interface
    • The proc/net/tcp and proc/net/tcp6 variables
    • Power Sourcing Equipment (PSE) Documentation
    • How to use radiotap headers
    • Overview
    • RDS Architecture
    • Socket Interface
    • RDMA for RDS
    • Congestion Notifications
    • RDS Protocol
    • RDS Transport Layer
    • RDS Kernel Structures
    • Connection management
    • The send path
    • The recv path
    • Multipath RDS (mprds)
    • Linux wireless regulatory documentation
    • Network Function Representors
    • RxRPC Network Protocol
    • SOCKET OPTIONS
    • SECURITY
    • EXAMPLE CLIENT USAGE
    • Linux Kernel SCTP
    • LSM/SeLinux secid
    • Seg6 Sysfs variables
    • Interface statistics
    • Stream Parser (strparser)
    • Ethernet switch device driver model (switchdev)
    • Sysfs tagging
    • TC Actions - Environmental Rules
    • TC queue based filtering
    • Thin-streams and TCP
    • Team
    • Timestamping
    • Linux Kernel TIPC
    • Transparent proxy support
    • Universal TUN/TAP device driver
    • The UDP-Lite protocol (RFC 3828)
    • Virtual Routing and Forwarding (VRF)
    • Virtual eXtensible Local Area Networking documentation
    • Packet Layer to Device Driver
    • Device Driver to Packet Layer
    • Requirements for the device driver
    • Linux X.25 Project
    • XFRM device - offloading the IPsec computations
    • XFRM proc - /proc/net/xfrm_* files
    • XFRM
    • XFRM Syscall
    • XDP RX Metadata
    • AF_XDP TX Metadata
  • pcmcia
  • Power Management
  • TCM Virtual Device
  • timers
  • Serial Peripheral Interface (SPI)
  • 1-Wire Subsystem
  • Linux Watchdog Support
  • Linux Virtualization Support
  • The Linux Input Documentation
  • Linux Hardware Monitoring
  • Linux GPU Driver Developer’s Guide
  • Security Documentation
  • Sound Subsystem Documentation
  • Linux Kernel Crypto API
  • Filesystems in the Linux kernel
  • Linux Memory Management Documentation
  • BPF Documentation
  • USB support
  • Linux PCI Bus Subsystem
  • Linux SCSI Subsystem
  • Assorted Miscellaneous Devices Documentation
  • Linux Scheduler
  • MHI
  • TTY
  • Assembler Annotations
  • CPU Architectures
  • Kernel tools
  • Unsorted Documentation
  • Atomic Types
  • Atomic bitops
  • Memory Barriers
  • General notification mechanism
  • Translations
The Linux Kernel
  • »
  • Linux Networking Documentation »
  • Netlink Family Specifications »
  • Family nftables netlink specification
  • View page source

Family nftables netlink specification¶

Contents

  • Family nftables netlink specification

    • Summary

    • Operations

      • batch-begin

      • batch-end

      • newtable

      • gettable

      • deltable

      • destroytable

      • newchain

      • getchain

      • delchain

      • destroychain

      • newrule

      • getrule

      • getrule-reset

      • delrule

      • destroyrule

      • newset

      • getset

      • delset

      • destroyset

      • newsetelem

      • getsetelem

      • getsetelem-reset

      • delsetelem

      • destroysetelem

      • getgen

      • newobj

      • getobj

      • delobj

      • destroyobj

      • newflowtable

      • getflowtable

      • delflowtable

      • destroyflowtable

    • Multicast groups

    • Definitions

      • nfgenmsg

      • meta-keys

      • bitwise-ops

      • cmp-ops

      • object-type

      • nat-range-flags

      • table-flags

      • chain-flags

      • set-flags

      • lookup-flags

      • ct-keys

      • ct-direction

      • quota-flags

      • verdict-code

      • fib-result

      • fib-flags

      • reject-types

    • Attribute sets

      • empty-attrs

      • batch-attrs

      • table-attrs

      • chain-attrs

      • counter-attrs

      • nft-hook-attrs

      • hook-dev-attrs

      • nft-counter-attrs

      • rule-attrs

      • expr-list-attrs

      • expr-attrs

      • rule-compat-attrs

      • set-attrs

      • set-desc-attrs

      • set-desc-concat-attrs

      • set-field-attrs

      • set-list-attrs

      • setelem-attrs

      • setelem-list-elem-attrs

      • setelem-list-attrs

      • gen-attrs

      • obj-attrs

      • quota-attrs

      • flowtable-attrs

      • flowtable-hook-attrs

      • expr-bitwise-attrs

      • expr-cmp-attrs

      • data-attrs

      • verdict-attrs

      • expr-counter-attrs

      • expr-fib-attrs

      • expr-ct-attrs

      • expr-flow-offload-attrs

      • expr-immediate-attrs

      • expr-lookup-attrs

      • expr-meta-attrs

      • expr-nat-attrs

      • expr-payload-attrs

      • expr-reject-attrs

      • expr-target-attrs

      • expr-tproxy-attrs

      • expr-objref-attrs

    • Sub-messages

      • expr-ops

      • obj-data

Summary¶

Netfilter nftables configuration over netlink.

Operations¶

batch-begin¶

Start a batch of operations

attribute-set

batch-attrs

fixed-header

nfgenmsg

do
request
attributes

[genid]

reply
attributes

[genid]

batch-end¶

Finish a batch of operations

attribute-set

batch-attrs

fixed-header

nfgenmsg

do
request
attributes

[genid]

newtable¶

Create a new table.

attribute-set

table-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

gettable¶

Get / dump tables.

attribute-set

table-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

deltable¶

Delete an existing table.

attribute-set

table-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroytable¶

Delete an existing table with destroy semantics (ignoring ENOENT errors).

attribute-set

table-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

newchain¶

Create a new chain.

attribute-set

chain-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getchain¶

Get / dump chains.

attribute-set

chain-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

delchain¶

Delete an existing chain.

attribute-set

chain-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroychain¶

Delete an existing chain with destroy semantics (ignoring ENOENT errors).

attribute-set

chain-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

newrule¶

Create a new rule.

attribute-set

rule-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getrule¶

Get / dump rules.

attribute-set

rule-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

getrule-reset¶

Get / dump rules and reset stateful expressions.

attribute-set

rule-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

delrule¶

Delete an existing rule.

attribute-set

rule-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroyrule¶

Delete an existing rule with destroy semantics (ignoring ENOENT errors).

attribute-set

rule-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

newset¶

Create a new set.

attribute-set

set-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getset¶

Get / dump sets.

attribute-set

set-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

delset¶

Delete an existing set.

attribute-set

set-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroyset¶

Delete an existing set with destroy semantics (ignoring ENOENT errors).

attribute-set

set-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

newsetelem¶

Create a new set element.

attribute-set

setelem-list-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getsetelem¶

Get / dump set elements.

attribute-set

setelem-list-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

getsetelem-reset¶

Get / dump set elements and reset stateful expressions.

attribute-set

setelem-list-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

delsetelem¶

Delete an existing set element.

attribute-set

setelem-list-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroysetelem¶

Delete an existing set element with destroy semantics.

attribute-set

setelem-list-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getgen¶

Get / dump rule-set generation.

attribute-set

gen-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

newobj¶

Create a new stateful object.

attribute-set

obj-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getobj¶

Get / dump stateful objects.

attribute-set

obj-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

delobj¶

Delete an existing stateful object.

attribute-set

obj-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroyobj¶

Delete an existing stateful object with destroy semantics.

attribute-set

obj-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

newflowtable¶

Create a new flow table.

attribute-set

flowtable-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

getflowtable¶

Get / dump flow tables.

attribute-set

flowtable-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

reply
attributes

[name]

delflowtable¶

Delete an existing flow table.

attribute-set

flowtable-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

destroyflowtable¶

Delete an existing flow table with destroy semantics.

attribute-set

flowtable-attrs

fixed-header

nfgenmsg

do
request
attributes

[name]

Multicast groups¶

  • mgmt

Definitions¶

nfgenmsg¶

type

struct

members
nfgen-family (u8)

version (u8)

res-id (u16)

meta-keys¶

type

enum

entries
  • len

  • protocol

  • priority

  • mark

  • iif

  • oif

  • iifname

  • oifname

  • iftype

  • oiftype

  • skuid

  • skgid

  • nftrace

  • rtclassid

  • secmark

  • nfproto

  • l4-proto

  • bri-iifname

  • bri-oifname

  • pkttype

  • cpu

  • iifgroup

  • oifgroup

  • cgroup

  • prandom

  • secpath

  • iifkind

  • oifkind

  • bri-iifpvid

  • bri-iifvproto

  • time-ns

  • time-day

  • time-hour

  • sdif

  • sdifname

  • bri-broute

bitwise-ops¶

type

enum

entries
  • bool

  • lshift

  • rshift

cmp-ops¶

type

enum

entries
  • eq

  • neq

  • lt

  • lte

  • gt

  • gte

object-type¶

type

enum

entries
  • unspec

  • counter

  • quota

  • ct-helper

  • limit

  • connlimit

  • tunnel

  • ct-timeout

  • secmark

  • ct-expect

  • synproxy

nat-range-flags¶

type

flags

entries
  • map-ips

  • proto-specified

  • proto-random

  • persistent

  • proto-random-fully

  • proto-offset

  • netmap

table-flags¶

type

flags

entries
  • dormant

  • owner

  • persist

chain-flags¶

type

flags

entries
  • base

  • hw-offload

  • binding

set-flags¶

type

flags

entries
  • anonymous

  • constant

  • interval

  • map

  • timeout

  • eval

  • object

  • concat

  • expr

lookup-flags¶

type

flags

entries
  • invert

ct-keys¶

type

enum

entries
  • state

  • direction

  • status

  • mark

  • secmark

  • expiration

  • helper

  • l3protocol

  • src

  • dst

  • protocol

  • proto-src

  • proto-dst

  • labels

  • pkts

  • bytes

  • avgpkt

  • zone

  • eventmask

  • src-ip

  • dst-ip

  • src-ip6

  • dst-ip6

  • ct-id

ct-direction¶

type

enum

entries
  • original

  • reply

quota-flags¶

type

flags

entries
  • invert

  • depleted

verdict-code¶

type

enum

entries
continue

break

jump

goto

return

drop

accept

stolen

queue

repeat

fib-result¶

type

enum

entries
  • oif

  • oifname

  • addrtype

fib-flags¶

type

flags

entries
  • saddr

  • daddr

  • mark

  • iif

  • oif

  • present

reject-types¶

type

enum

entries
  • icmp-unreach

  • tcp-rst

  • icmpx-unreach

Attribute sets¶

empty-attrs¶

name (string)¶

batch-attrs¶

genid (u32)¶

byte-order

big-endian

table-attrs¶

name (string)¶

doc

name of the table

flags (u32)¶

byte-order

big-endian

doc

bitmask of flags

enum

table-flags

enum-as-flags

True

use (u32)¶

byte-order

big-endian

doc

number of chains in this table

handle (u64)¶

byte-order

big-endian

doc

numeric handle of the table

userdata (binary)¶

doc

user data

chain-attrs¶

table (string)¶

doc

name of the table containing the chain

handle (u64)¶

byte-order

big-endian

doc

numeric handle of the chain

name (string)¶

doc

name of the chain

hook (nest)¶

nested-attributes

nft-hook-attrs

doc

hook specification for basechains

policy (u32)¶

byte-order

big-endian

doc

numeric policy of the chain

use (u32)¶

byte-order

big-endian

doc

number of references to this chain

type (string)¶

doc

type name of the chain

counters (nest)¶

nested-attributes

nft-counter-attrs

doc

counter specification of the chain

flags (u32)¶

byte-order

big-endian

doc

chain flags

enum

chain-flags

enum-as-flags

True

id (u32)¶

byte-order

big-endian

doc

uniquely identifies a chain in a transaction

userdata (binary)¶

doc

user data

counter-attrs¶

bytes (u64)¶

byte-order

big-endian

packets (u64)¶

byte-order

big-endian

pad (pad)¶

nft-hook-attrs¶

num (u32)¶

byte-order

big-endian

priority (s32)¶

byte-order

big-endian

dev (string)¶

doc

net device name

devs (nest)¶

nested-attributes

hook-dev-attrs

doc

list of net devices

hook-dev-attrs¶

name (string)¶

multi-attr

True

nft-counter-attrs¶

bytes (u64)¶

packets (u64)¶

rule-attrs¶

table (string)¶

doc

name of the table containing the rule

chain (string)¶

doc

name of the chain containing the rule

handle (u64)¶

byte-order

big-endian

doc

numeric handle of the rule

expressions (nest)¶

nested-attributes

expr-list-attrs

doc

list of expressions

compat (nest)¶

nested-attributes

rule-compat-attrs

doc

compatibility specifications of the rule

position (u64)¶

byte-order

big-endian

doc

numeric handle of the previous rule

userdata (binary)¶

doc

user data

id (u32)¶

doc

uniquely identifies a rule in a transaction

position-id (u32)¶

doc

transaction unique identifier of the previous rule

chain-id (u32)¶

doc

add the rule to chain by ID, alternative to chain name

expr-list-attrs¶

elem (nest)¶

nested-attributes

expr-attrs

multi-attr

True

expr-attrs¶

name (string)¶

doc

name of the expression type

data (sub-message)¶

sub-message

expr-ops

selector

name

doc

type specific data

rule-compat-attrs¶

proto (binary)¶

doc

numeric value of the handled protocol

flags (binary)¶

doc

bitmask of flags

set-attrs¶

table (string)¶

doc

table name

name (string)¶

doc

set name

flags (u32)¶

enum

set-flags

byte-order

big-endian

doc

bitmask of enum nft_set_flags

key-type (u32)¶

byte-order

big-endian

doc

key data type, informational purpose only

key-len (u32)¶

byte-order

big-endian

doc

key data length

data-type (u32)¶

byte-order

big-endian

doc

mapping data type

data-len (u32)¶

byte-order

big-endian

doc

mapping data length

policy (u32)¶

byte-order

big-endian

doc

selection policy

desc (nest)¶

nested-attributes

set-desc-attrs

doc

set description

id (u32)¶

doc

uniquely identifies a set in a transaction

timeout (u64)¶

doc

default timeout value

gc-interval (u32)¶

doc

garbage collection interval

userdata (binary)¶

doc

user data

pad (pad)¶

obj-type (u32)¶

byte-order

big-endian

doc

stateful object type

handle (u64)¶

byte-order

big-endian

doc

set handle

expr (nest)¶

nested-attributes

expr-attrs

doc

set expression

multi-attr

True

expressions (nest)¶

nested-attributes

set-list-attrs

doc

list of expressions

set-desc-attrs¶

size (u32)¶

byte-order

big-endian

doc

number of elements in set

concat (nest)¶

nested-attributes

set-desc-concat-attrs

doc

description of field concatenation

multi-attr

True

set-desc-concat-attrs¶

elem (nest)¶

nested-attributes

set-field-attrs

set-field-attrs¶

len (u32)¶

byte-order

big-endian

set-list-attrs¶

elem (nest)¶

nested-attributes

expr-attrs

multi-attr

True

setelem-attrs¶

key (nest)¶

nested-attributes

data-attrs

doc

key value

data (nest)¶

nested-attributes

data-attrs

doc

data value of mapping

flags (binary)¶

doc

bitmask of nft_set_elem_flags

timeout (u64)¶

doc

timeout value

expiration (u64)¶

doc

expiration time

userdata (binary)¶

doc

user data

expr (nest)¶

nested-attributes

expr-attrs

doc

expression

objref (string)¶

doc

stateful object reference

key-end (nest)¶

nested-attributes

data-attrs

doc

closing key value

expressions (nest)¶

nested-attributes

expr-list-attrs

doc

list of expressions

setelem-list-elem-attrs¶

elem (nest)¶

nested-attributes

setelem-attrs

multi-attr

True

setelem-list-attrs¶

table (string)¶

set (string)¶

elements (nest)¶

nested-attributes

setelem-list-elem-attrs

set-id (u32)¶

gen-attrs¶

id (u32)¶

byte-order

big-endian

doc

ruleset generation id

proc-pid (u32)¶

byte-order

big-endian

proc-name (string)¶

obj-attrs¶

table (string)¶

doc

name of the table containing the expression

name (string)¶

doc

name of this expression type

type (u32)¶

enum

object-type

byte-order

big-endian

doc

stateful object type

data (sub-message)¶

sub-message

obj-data

selector

type

doc

stateful object data

use (u32)¶

byte-order

big-endian

doc

number of references to this expression

handle (u64)¶

byte-order

big-endian

doc

object handle

pad (pad)¶

userdata (binary)¶

doc

user data

quota-attrs¶

bytes (u64)¶

byte-order

big-endian

flags (u32)¶

byte-order

big-endian

enum

quota-flags

pad (pad)¶

consumed (u64)¶

byte-order

big-endian

flowtable-attrs¶

table (string)¶

name (string)¶

hook (nest)¶

nested-attributes

flowtable-hook-attrs

use (u32)¶

byte-order

big-endian

handle (u64)¶

byte-order

big-endian

pad (pad)¶

flags (u32)¶

byte-order

big-endian

flowtable-hook-attrs¶

num (u32)¶

byte-order

big-endian

priority (u32)¶

byte-order

big-endian

devs (nest)¶

nested-attributes

hook-dev-attrs

expr-bitwise-attrs¶

sreg (u32)¶

byte-order

big-endian

dreg (u32)¶

byte-order

big-endian

len (u32)¶

byte-order

big-endian

mask (nest)¶

nested-attributes

data-attrs

xor (nest)¶

nested-attributes

data-attrs

op (u32)¶

byte-order

big-endian

enum

bitwise-ops

data (nest)¶

nested-attributes

data-attrs

expr-cmp-attrs¶

sreg (u32)¶

byte-order

big-endian

op (u32)¶

byte-order

big-endian

enum

cmp-ops

data (nest)¶

nested-attributes

data-attrs

data-attrs¶

value (binary)¶

verdict (nest)¶

nested-attributes

verdict-attrs

verdict-attrs¶

code (u32)¶

byte-order

big-endian

enum

verdict-code

chain (string)¶

chain-id (u32)¶

expr-counter-attrs¶

bytes (u64)¶

doc

Number of bytes

packets (u64)¶

doc

Number of packets

pad (pad)¶

expr-fib-attrs¶

dreg (u32)¶

byte-order

big-endian

result (u32)¶

byte-order

big-endian

enum

fib-result

flags (u32)¶

byte-order

big-endian

enum

fib-flags

expr-ct-attrs¶

dreg (u32)¶

byte-order

big-endian

key (u32)¶

byte-order

big-endian

enum

ct-keys

direction (u8)¶

enum

ct-direction

sreg (u32)¶

byte-order

big-endian

expr-flow-offload-attrs¶

name (string)¶

doc

Flow offload table name

expr-immediate-attrs¶

dreg (u32)¶

byte-order

big-endian

data (nest)¶

nested-attributes

data-attrs

expr-lookup-attrs¶

set (string)¶

doc

Name of set to use

set id (u32)¶

byte-order

big-endian

doc

ID of set to use

sreg (u32)¶

byte-order

big-endian

dreg (u32)¶

byte-order

big-endian

flags (u32)¶

byte-order

big-endian

enum

lookup-flags

expr-meta-attrs¶

dreg (u32)¶

byte-order

big-endian

key (u32)¶

byte-order

big-endian

enum

meta-keys

sreg (u32)¶

byte-order

big-endian

expr-nat-attrs¶

type (u32)¶

byte-order

big-endian

family (u32)¶

byte-order

big-endian

reg-addr-min (u32)¶

byte-order

big-endian

reg-addr-max (u32)¶

byte-order

big-endian

reg-proto-min (u32)¶

byte-order

big-endian

reg-proto-max (u32)¶

byte-order

big-endian

flags (u32)¶

byte-order

big-endian

enum

nat-range-flags

enum-as-flags

True

expr-payload-attrs¶

dreg (u32)¶

byte-order

big-endian

base (u32)¶

byte-order

big-endian

offset (u32)¶

byte-order

big-endian

len (u32)¶

byte-order

big-endian

sreg (u32)¶

byte-order

big-endian

csum-type (u32)¶

byte-order

big-endian

csum-offset (u32)¶

byte-order

big-endian

csum-flags (u32)¶

byte-order

big-endian

expr-reject-attrs¶

type (u32)¶

byte-order

big-endian

enum

reject-types

icmp-code (u8)¶

expr-target-attrs¶

name (string)¶

rev (u32)¶

byte-order

big-endian

info (binary)¶

expr-tproxy-attrs¶

family (u32)¶

byte-order

big-endian

reg-addr (u32)¶

byte-order

big-endian

reg-port (u32)¶

byte-order

big-endian

expr-objref-attrs¶

imm-type (u32)¶

byte-order

big-endian

imm-name (string)¶

doc

object name

set-sreg (u32)¶

byte-order

big-endian

set-name (string)¶

doc

name of object map

set-id (u32)¶

byte-order

big-endian

doc

id of object map

Sub-messages¶

expr-ops¶

  • bitwise
    attribute-set

    expr-bitwise-attrs

  • cmp
    attribute-set

    expr-cmp-attrs

  • counter
    attribute-set

    expr-counter-attrs

  • ct
    attribute-set

    expr-ct-attrs

  • fib
    attribute-set

    expr-fib-attrs

  • flow_offload
    attribute-set

    expr-flow-offload-attrs

  • immediate
    attribute-set

    expr-immediate-attrs

  • lookup
    attribute-set

    expr-lookup-attrs

  • meta
    attribute-set

    expr-meta-attrs

  • nat
    attribute-set

    expr-nat-attrs

  • objref
    attribute-set

    expr-objref-attrs

  • payload
    attribute-set

    expr-payload-attrs

  • quota
    attribute-set

    quota-attrs

  • reject
    attribute-set

    expr-reject-attrs

  • target
    attribute-set

    expr-target-attrs

  • tproxy
    attribute-set

    expr-tproxy-attrs

obj-data¶

  • counter
    attribute-set

    counter-attrs

  • quota
    attribute-set

    quota-attrs

Next Previous

© Copyright The kernel development community.

Built with Sphinx using a theme provided by Read the Docs.