path: root/Documentation/netlink/specs/nftables.yaml

# SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause)
---
name: nftables
protocol: netlink-raw
protonum: 12

doc: >-
  Netfilter nftables configuration over netlink.

definitions:
  -
    name: nfgenmsg
    type: struct
    members:
      -
        name: nfgen-family
        type: u8
      -
        name: version
        type: u8
      -
        name: res-id
        byte-order: big-endian
        type: u16
  -
    name: meta-keys
    type: enum
    entries:
      - len
      - protocol
      - priority
      - mark
      - iif
      - oif
      - iifname
      - oifname
      - iftype
      - oiftype
      - skuid
      - skgid
      - nftrace
      - rtclassid
      - secmark
      - nfproto
      - l4-proto
      - bri-iifname
      - bri-oifname
      - pkttype
      - cpu
      - iifgroup
      - oifgroup
      - cgroup
      - prandom
      - secpath
      - iifkind
      - oifkind
      - bri-iifpvid
      - bri-iifvproto
      - time-ns
      - time-day
      - time-hour
      - sdif
      - sdifname
      - bri-broute
  -
    name: bitwise-ops
    type: enum
    entries:
      -
        name: mask-xor  # aka bool (old name)
        doc: >-
          mask-and-xor operation used to implement NOT, AND, OR and XOR boolean
          operations
      -
        name: lshift
      -
        name: rshift
      -
        name: and
      -
        name: or
      -
        name: xor
  -
    name: cmp-ops
    type: enum
    entries:
      - eq
      - neq
      - lt
      - lte
      - gt
      - gte
  -
    name: object-type
    type: enum
    entries:
      - unspec
      - counter
      - quota
      - ct-helper
      - limit
      - connlimit
      - tunnel
      - ct-timeout
      - secmark
      - ct-expect
      - synproxy
  -
    name: nat-range-flags
    type: flags
    entries:
      - map-ips
      - proto-specified
      - proto-random
      - persistent
      - proto-random-fully
      - proto-offset
      - netmap
  -
    name: table-flags
    type: flags
    entries:
      - dormant
      - owner
      - persist
  -
    name: chain-flags
    type: flags
    entries:
      - base
      - hw-offload
      - binding
  -
    name: set-flags
    type: flags
    entries:
      - anonymous
      - constant
      - interval
      - map
      - timeout
      - eval
      - object
      - concat
      - expr
  -
    name: set-elem-flags
    type: flags
    entries:
      - interval-end
      - catchall
  -
    name: lookup-flags
    type: flags
    entries:
      - invert
  -
    name: ct-keys
    type: enum
    entries:
      - state
      - direction
      - status
      - mark
      - secmark
      - expiration
      - helper
      - l3protocol
      - src
      - dst
      - protocol
      - proto-src
      - proto-dst
      - labels
      - pkts
      - bytes
      - avgpkt
      - zone
      - eventmask
      - src-ip
      - dst-ip
      - src-ip6
      - dst-ip6
      - ct-id
  -
    name: ct-direction
    type: enum
    entries:
      - original
      - reply
  -
    name: quota-flags
    type: flags
    entries:
      - invert
      - depleted
  -
    name: verdict-code
    type: enum
    entries:
      - name: continue
        value: 0xffffffff
      - name: break
        value: 0xfffffffe
      - name: jump
        value: 0xfffffffd
      - name: goto
        value: 0xfffffffc
      - name: return
        value: 0xfffffffb
      - name: drop
        value: 0
      - name: accept
        value: 1
      - name: stolen
        value: 2
      - name: queue
        value: 3
      - name: repeat
        value: 4
  -
    name: fib-result
    type: enum
    entries:
      - oif
      - oifname
      - addrtype
  -
    name: fib-flags
    type: flags
    entries:
      - saddr
      - daddr
      - mark
      - iif
      - oif
      - present
  -
    name: reject-types
    type: enum
    entries:
      - icmp-unreach
      - tcp-rst
      - icmpx-unreach
  -
    name: reject-inet-code
    doc: These codes are mapped to real ICMP and ICMPv6 codes.
    type: enum
    entries:
      - icmpx-no-route
      - icmpx-port-unreach
      - icmpx-host-unreach
      - icmpx-admin-prohibited
  -
    name: payload-base
    type: enum
    entries:
      - link-layer-header
      - network-header
      - transport-header
      - inner-header
      - tun-header
  -
    name: range-ops
    doc: Range operator
    type: enum
    entries:
      - eq
      - neq
  -
    name: registers
    doc: |
      nf_tables registers.
      nf_tables used to have five registers: a verdict register and four data
      registers of size 16. The data registers have been changed to 16 registers
      of size 4. For compatibility reasons, the NFT_REG_[1-4] registers still
      map to areas of size 16, the 4 byte registers are addressed using
      NFT_REG32_00 - NFT_REG32_15.
    type: enum
    entries:
      -
        name: reg-verdict
      -
        name: reg-1
      -
        name: reg-2
      -
        name: reg-3
      -
        name: reg-4
      -
        name: reg32-00
        value: 8
      -
        name: reg32-01
      -
        name: reg32-02
      -
        name: reg32-03
      -
        name: reg32-04
      -
        name: reg32-05
      -
        name: reg32-06
      -
        name: reg32-07
      -
        name: reg32-08
      -
        name: reg32-09
      -
        name: reg32-10
      -
        name: reg32-11
      -
        name: reg32-12
      -
        name: reg32-13
      -
        name: reg32-14
      -
        name: reg32-15
  -
    name: numgen-types
    type: enum
    entries:
      - incremental
      - random
  -
    name: log-level
    doc: nf_tables log levels
    type: enum
    entries:
      -
        name: emerg
        doc: system is unusable
      -
        name: alert
        doc: action must be taken immediately
      -
        name: crit
        doc: critical conditions
      -
        name: err
        doc: error conditions
      -
        name: warning
        doc: warning conditions
      -
        name: notice
        doc: normal but significant condition
      -
        name: info
        doc: informational
      -
        name: debug
        doc: debug-level messages
      -
        name: audit
        doc: enabling audit logging
  -
    name: log-flags
    doc: nf_tables log flags
    header: linux/netfilter/nf_log.h
    type: flags
    entries:
      -
        name: tcpseq
        doc: Log TCP sequence numbers
      -
        name: tcpopt
        doc: Log TCP options
      -
        name: ipopt
        doc: Log IP options
      -
        name: uid
        doc: Log UID owning local socket
      -
        name: nflog
        doc: Unsupported, don't reuse
      -
        name: macdecode
        doc: Decode MAC header

attribute-sets:
  -
    name: log-attrs
    doc: log expression netlink attributes
    attributes:
      # Mentioned in nft_log_init()
      -
        name: group
        doc: netlink group to send messages to
        type: u16
        byte-order: big-endian
      -
        name: prefix
        doc: prefix to prepend to log messages
        type: string
      -
        name: snaplen
        doc: length of payload to include in netlink message
        type: u32
        byte-order: big-endian
      -
        name: qthreshold
        doc: queue threshold
        type: u16
        byte-order: big-endian
      -
        name: level
        doc: log level
        type: u32
        enum: log-level
        byte-order: big-endian
      -
        name: flags
        doc: logging flags
        type: u32
        enum: log-flags
        byte-order: big-endian
  -
    name: numgen-attrs
    doc: nf_tables number generator expression netlink attributes
    attributes:
      -
        name: dreg
        doc: destination register
        type: u32
        enum: registers
      -
        name: modulus
        doc: maximum counter value
        type: u32
        byte-order: big-endian
      -
        name: type
        doc: operation type
        type: u32
        byte-order: big-endian
        enum: numgen-types
      -
        name: offset
        doc: offset to be added to the counter
        type: u32
        byte-order: big-endian
  -
    name: range-attrs
    attributes:
      # Mentioned in net/netfilter/nft_range.c
      -
        name: sreg
        doc: source register of data to compare
        type: u32
        byte-order: big-endian
        enum: registers
      -
        name: op
        doc: cmp operation
        type: u32
        byte-order: big-endian
        enum: range-ops
        checks:
          max: 255
      -
        name: from-data
        doc: data range from
        type: nest
        nested-attributes: data-attrs
      -
        name: to-data
        doc: data range to
        type: nest
        nested-attributes: data-attrs
  -
    name: batch-attrs
    attributes:
      -
        name: genid
        doc: generation ID for this changeset
        type: u32
        byte-order: big-endian
  -
    name: table-attrs
    attributes:
      -
        name: name
        type: string
        doc: name of the table
      -
        name: flags
        type: u32
        byte-order: big-endian
        doc: bitmask of flags
        enum: table-flags
        enum-as-flags: true
      -
        name: use
        type: u32
        byte-order: big-endian
        doc: number of chains in this table
      -
        name: handle
        type: u64
        byte-order: big-endian
        doc: numeric handle of the table
      -
        name: pad
        type: pad
      -
        name: userdata
        type: binary
        doc: user data
      -
        name: owner
        type: u32
        byte-order: big-endian
        doc: owner of this table through netlink portID
  -
    name: chain-attrs
    attributes:
      -
        name: table
        type: string
        doc: name of the table containing the chain
      -
        name: handle
        type: u64
        byte-order: big-endian
        doc: numeric handle of the chain
      -
        name: name
        type: string
        doc: name of the chain
      -
        name: hook
        type: nest
        nested-attributes: nft-hook-attrs
        doc: hook specification for basechains
      -
        name: policy
        type: u32
        byte-order: big-endian
        doc: numeric policy of the chain
      -
        name: use
        type: u32
        byte-order: big-endian
        doc: number of references to this chain
      -
        name: type
        type: string
        doc: type name of the chain
      -
        name: counters
        type: nest
        nested-attributes: nft-counter-attrs
        doc: counter specification of the chain
      -
        name: flags
        type: u32
        byte-order: big-endian
        doc: chain flags
        enum: chain-flags
        enum-as-flags: true
      -
        name: id
        type: u32
        byte-order: big-endian
        doc: uniquely identifies a chain in a transaction
      -
        name: userdata
        type: binary
        doc: user data
  -
    name: counter-attrs
    attributes:
      -
        name: bytes
        type: u64
        byte-order: big-endian
      -
        name: packets
        type: u64
        byte-order: big-endian
      -
        name: pad
        type: pad
  -
    name: nft-hook-attrs
    attributes:
      -
        name: num
        type: u32
        byte-order: big-endian
      -
        name: priority
        type: s32
        byte-order: big-endian
      -
        name: dev
        type: string
        doc: net device name
      -
        name: devs
        type: nest
        nested-attributes: hook-dev-attrs
        doc: list of net devices
  -
    name: hook-dev-attrs
    attributes:
      -
        name: name
        type: string
        multi-attr: true
  -
    name: nft-counter-attrs
    attributes:
      -
        name: bytes
        type: u64
        byte-order: big-endian
      -
        name: packets
        type: u64
        byte-order: big-endian
  -
    name: rule-attrs
    attributes:
      -
        name: table
        type: string
        doc: name of the table containing the rule
      -
        name: chain
        type: string
        doc: name of the chain containing the rule
      -
        name: handle
        type: u64
        byte-order: big-endian
        doc: numeric handle of the rule
      -
        name: expressions
        type: nest
        nested-attributes: expr-list-attrs
        doc: list of expressions
      -
        name: compat
        type: nest
        nested-attributes: rule-compat-attrs
        doc: compatibility specifications of the rule
      -
        name: position
        type: u64
        byte-order: big-endian
        doc: numeric handle of the previous rule
      -
        name: userdata
        type: binary
        doc: user data
      -
        name: id
        type: u32
        doc: uniquely identifies a rule in a transaction
      -
        name: position-id
        type: u32
        doc: transaction unique identifier of the previous rule
      -
        name: chain-id
        type: u32
        doc: add the rule to chain by ID, alternative to chain name
  -
    name: expr-list-attrs
    attributes:
      -
        name: elem
        type: nest
        nested-attributes: expr-attrs
        multi-attr: true
  -
    name: expr-attrs
    attributes:
      -
        name: name
        type: string
        doc: name of the expression type
      -
        name: data
        type: sub-message
        sub-message: expr-ops
        selector: name
        doc: type specific data
  -
    # Mentioned in nft_parse_compat() in net/netfilter/nft_compat.c
    name: rule-compat-attrs
    attributes:
      -
        name: proto
        type: u32
        byte-order: big-endian
        doc: numeric value of the handled protocol
      -
        name: flags
        type: u32
        byte-order: big-endian
        doc: bitmask of flags
  -
    name: set-attrs
    attributes:
      -
        name: table
        type: string
        doc: table name
      -
        name: name
        type: string
        doc: set name
      -
        name: flags
        type: u32
        enum: set-flags
        byte-order: big-endian
        doc: bitmask of enum nft_set_flags
      -
        name: key-type
        type: u32
        byte-order: big-endian
        doc: key data type, informational purpose only
      -
        name: key-len
        type: u32
        byte-order: big-endian
        doc: key data length
      -
        name: data-type
        type: u32
        byte-order: big-endian
        doc: mapping data type
      -
        name: data-len
        type: u32
        byte-order: big-endian
        doc: mapping data length
      -
        name: policy
        type: u32
        byte-order: big-endian
        doc: selection policy
      -
        name: desc
        type: nest
        nested-attributes: set-desc-attrs
        doc: set description
      -
        name: id
        type: u32
        doc: uniquely identifies a set in a transaction
      -
        name: timeout
        type: u64
        doc: default timeout value
      -
        name: gc-interval
        type: u32
        doc: garbage collection interval
      -
        name: userdata
        type: binary
        doc: user data
      -
        name: pad
        type: pad
      -
        name: obj-type
        type: u32
        byte-order: big-endian
        doc: stateful object type
      -
        name: handle
        type: u64
        byte-order: big-endian
        doc: set handle
      -
        name: expr
        type: nest
        nested-attributes: expr-attrs
        doc: set expression
        multi-attr: true
      -
        name: expressions
        type: nest
        nested-attributes: set-list-attrs
        doc: list of expressions
      -
        name: type
        type: string
        doc: set backend type
      -
        name: count
        type: u32
        byte-order: big-endian
        doc: number of set elements
  -
    name: set-desc-attrs
    attributes:
      -
        name: size
        type: u32
        byte-order: big-endian
        doc: number of elements in set
      -
        name: concat
        type: nest
        nested-attributes: set-desc-concat-attrs
        doc: description of field concatenation
        multi-attr: true
  -
    name: set-desc-concat-attrs
    attributes:
      -
        name: elem
        type: nest
        nested-attributes: set-field-attrs
  -
    name: set-field-attrs
    attributes:
      -
        name: len
        type: u32
        byte-order: big-endian
  -
    name: set-list-attrs
    attributes:
      -
        name: elem
        type: nest
        nested-attributes: expr-attrs
        multi-attr: true
  -
    name: setelem-attrs
    attributes:
      -
        name: key
        type: nest
        nested-attributes: data-attrs
        doc: key value
      -
        name: data
        type: nest
        nested-attributes: data-attrs
        doc: data value of mapping
      -
        name: flags
        type: binary
        doc: bitmask of nft_set_elem_flags
      -
        name: timeout
        type: u64
        doc: timeout value
      -
        name: expiration
        type: u64
        doc: expiration time
      -
        name: userdata
        type: binary
        doc: user data
      -
        name: expr
        type: nest
        nested-attributes: expr-attrs
        doc: expression
      -
        name: objref
        type: string
        doc: stateful object reference
      -
        name: key-end
        type: nest
        nested-attributes: data-attrs
        doc: closing key value
      -
        name: expressions
        type: nest
        nested-attributes: expr-list-attrs
        doc: list of expressions
  -
    name: setelem-list-elem-attrs
    attributes:
      -
        name: elem
        type: nest
        nested-attributes: setelem-attrs
        multi-attr: true
  -
    name: setelem-list-attrs
    attributes:
      -
        name: table
        type: string
      -
        name: set
        type: string
      -
        name: elements
        type: nest
        nested-attributes: setelem-list-elem-attrs
      -
        name: set-id
        type: u32
  -
    name: gen-attrs
    attributes:
      -
        name: id
        type: u32
        byte-order: big-endian
        doc: ruleset generation id
      -
        name: proc-pid
        type: u32
        byte-order: big-endian
      -
        name: proc-name
        type: string
  -
    name: obj-attrs
    attributes:
      -
        name: table
        type: string
        doc: name of the table containing the expression
      -
        name: name
        type: string
        doc: name of this expression type
      -
        name: type
        type: u32
        enum: object-type
        byte-order: big-endian
        doc: stateful object type
      -
        name: data
        type: sub-message
        sub-message: obj-data
        selector: type
        doc: stateful object data
      -
        name: use
        type: u32
        byte-order: big-endian
        doc: number of references to this expression
      -
        name: handle
        type: u64
        byte-order: big-endian
        doc: object handle
      -
        name: pad
        type: pad
      -
        name: userdata
        type: binary
        doc: user data
  -
    name: quota-attrs
    attributes:
      -
        name: bytes
        type: u64
        byte-order: big-endian
      -
        name: flags
        type: u32
        byte-order: big-endian
        enum: quota-flags
      -
        name: pad
        type: pad
      -
        name: consumed
        type: u64
        byte-order: big-endian
  -
    name: flowtable-attrs
    attributes:
      -
        name: table
        type: string
      -
        name: name
        type: string
      -
        name: hook
        type: nest
        nested-attributes: flowtable-hook-attrs
      -
        name: use
        type: u32
        byte-order: big-endian
      -
        name: handle
        type: u64
        byte-order: big-endian
      -
        name: pad
        type: pad
      -
        name: flags
        type: u32
        byte-order: big-endian
  -
    name: flowtable-hook-attrs
    attributes:
      -
        name: num
        type: u32
        byte-order: big-endian
      -
        name: priority
        type: u32
        byte-order: big-endian
      -
        name: devs
        type: nest
        nested-attributes: hook-dev-attrs
  -
    name: expr-bitwise-attrs
    doc: |
      The bitwise expression supports boolean and shift operations. It
      implements the boolean operations by performing the following
      operation::

          dreg = (sreg & mask) ^ xor

          with these mask and xor values:

          op      mask    xor
          ----    ----    ---
          NOT:     1       1
          OR:     ~x       x
          XOR:     1       x
          AND:     x       0

    attributes:
      -
        name: sreg
        type: u32
        byte-order: big-endian
      -
        name: dreg
        type: u32
        byte-order: big-endian
      -
        name: len
        type: u32
        byte-order: big-endian
      -
        name: mask
        type: nest
        nested-attributes: data-attrs
      -
        name: xor
        type: nest
        nested-attributes: data-attrs
      -
        name: op
        type: u32
        byte-order: big-endian
        enum: bitwise-ops
        checks:
          max: 255
      -
        name: data
        type: nest
        nested-attributes: data-attrs
  -
    name: expr-cmp-attrs
    attributes:
      -
        name: sreg
        type: u32
        byte-order: big-endian
      -
        name: op
        type: u32
        byte-order: big-endian
        enum: cmp-ops
      -
        name: data
        type: nest
        nested-attributes: data-attrs
  -
    name: data-attrs
    attributes:
      -
        name: value
        type: binary
        # sub-type: u8
      -
        name: verdict
        type: nest
        nested-attributes: verdict-attrs
  -
    name: verdict-attrs
    attributes:
      -
        name: code
        doc: nf_tables verdict
        type: u32
        byte-order: big-endian
        enum: verdict-code
      -
        name: chain
        doc: jump target chain name
        type: string
      -
        name: chain-id
        doc: jump target chain ID
        type: u32
        byte-order: big-endian
  -
    name: expr-counter-attrs
    attributes:
      -
        name: bytes
        type: u64
        byte-order: big-endian
        doc: Number of bytes
      -
        name: packets
        type: u64
        byte-order: big-endian
        doc: Number of packets
      -
        name: pad
        type: pad
  -
    name: expr-fib-attrs
    attributes:
      -
        name: dreg
        type: u32
        byte-order: big-endian
      -
        name: result
        type: u32
        byte-order: big-endian
        enum: fib-result
      -
        name: flags
        type: u32
        byte-order: big-endian
        enum: fib-flags
  -
    name: expr-ct-attrs
    attributes:
      -
        name: dreg
        type: u32
        byte-order: big-endian
      -
        name: key
        type: u32
        byte-order: big-endian
        enum: ct-keys
      -
        name: direction
        type: u8
        enum: ct-direction
      -
        name: sreg
        type: u32
        byte-order: big-endian
  -
    name: expr-flow-offload-attrs
    attributes:
      -
        name: name
        type: string
        doc: Flow offload table name
  -
    name: expr-immediate-attrs
    attributes:
      -
        name: dreg
        type: u32
        byte-order: big-endian
      -
        name: data
        type: nest
        nested-attributes: data-attrs
  -
    name: expr-lookup-attrs
    attributes:
      -
        name: set
        type: string
        doc: Name of set to use
      -
        name: set-id
        type: u32
        byte-order: big-endian
        doc: ID of set to use
      -
        name: sreg
        type: u32
        byte-order: big-endian
      -
        name: dreg
        type: u32
        byte-order: big-endian
      -
        name: flags
        type: u32
        byte-order: big-endian
        enum: lookup-flags
  -
    name: expr-masq-attrs
    attributes:
      -
        name: flags
        type: u32
        byte-order: big-endian
        enum: nat-range-flags
        enum-as-flags: true
      -
        name: reg-proto-min
        type: u32
        byte-order: big-endian
        enum: registers
      -
        name: reg-proto-max
        type: u32
        byte-order: big-endian
        enum: registers
  -
    name: expr-meta-attrs
    attributes:
      -
        name: dreg
        type: u32
        byte-order: big-endian
      -
        name: key
        type: u32
        byte-order: big-endian
        enum: meta-keys
      -
        name: sreg
        type: u32
        byte-order: big-endian
  -
    name: expr-nat-attrs
    attributes:
      -
        name: type
        type: u32
        byte-order: big-endian
      -
        name: family
        type: u32
        byte-order: big-endian
      -
        name: reg-addr-min
        type: u32
        byte-order: big-endian
      -
        name: reg-addr-max
        type: u32
        byte-order: big-endian
      -
        name: reg-proto-min
        type: u32
        byte-order: big-endian
      -
        name: reg-proto-max
        type: u32
        byte-order: big-endian
      -
        name: flags
        type: u32
        byte-order: big-endian
        enum: nat-range-flags
        enum-as-flags: true
  -
    name: expr-payload-attrs
    doc: nf_tables payload expression netlink attributes
    attributes:
      -
        name: dreg
        doc: destination register to load data into
        type: u32
        byte-order: big-endian
        enum: registers
      -
        name: base
        doc: payload base
        type: u32
        enum: payload-base
        byte-order: big-endian
      -
        name: offset
        doc: payload offset relative to base
        type: u32
        byte-order: big-endian
      -
        name: len
        doc: payload length
        type: u32
        byte-order: big-endian
      -
        name: sreg
        doc: source register to load data from
        type: u32
        byte-order: big-endian
        enum: registers
      -
        name: csum-type
        doc: checksum type
        type: u32
        byte-order: big-endian
      -
        name: csum-offset
        doc: checksum offset relative to base
        type: u32
        byte-order: big-endian
      -
        name: csum-flags
        doc: checksum flags
        type: u32
        byte-order: big-endian
  -
    name: expr-reject-attrs
    attributes:
      -
        name: type
        type: u32
        byte-order: big-endian
        enum: reject-types
      -
        name: icmp-code
        type: u8
  -
    name: expr-target-attrs
    attributes:
      -
        name: name
        type: string
      -
        name: rev
        type: u32
        byte-order: big-endian
      -
        name: info
        type: binary
  -
    name: expr-tproxy-attrs
    attributes:
      -
        name: family
        type: u32
        byte-order: big-endian
      -
        name: reg-addr
        type: u32
        byte-order: big-endian
      -
        name: reg-port
        type: u32
        byte-order: big-endian
  -
    name: expr-objref-attrs
    attributes:
      -
        name: imm-type
        type: u32
        byte-order: big-endian
      -
        name: imm-name
        type: string
        doc: object name
      -
        name: set-sreg
        type: u32
        byte-order: big-endian
      -
        name: set-name
        type: string
        doc: name of object map
      -
        name: set-id
        type: u32
        byte-order: big-endian
        doc: id of object map
  -
    name: compat-target-attrs
    header: linux/netfilter/nf_tables_compat.h
    attributes:
      -
        name: name
        type: string
        checks:
          max-len: 32
      -
        name: rev
        type: u32
        byte-order: big-endian
        checks:
          max: 255
      -
        name: info
        type: binary
  -
    name: compat-match-attrs
    header: linux/netfilter/nf_tables_compat.h
    attributes:
      -
        name: name
        type: string
        checks:
          max-len: 32
      -
        name: rev
        type: u32
        byte-order: big-endian
        checks:
          max: 255
      -
        name: info
        type: binary
  -
    name: compat-attrs
    header: linux/netfilter/nf_tables_compat.h
    attributes:
      -
        name: name
        type: string
        checks:
          max-len: 32
      -
        name: rev
        type: u32
        byte-order: big-endian
        checks:
          max: 255
      -
        name: type
        type: u32
        byte-order: big-endian

sub-messages:
  -
    name: expr-ops
    formats:
      -
        value: bitwise
        attribute-set: expr-bitwise-attrs
      -
        value: cmp
        attribute-set: expr-cmp-attrs
      -
        value: counter
        attribute-set: expr-counter-attrs
      -
        value: ct
        attribute-set: expr-ct-attrs
      -
        value: fib
        attribute-set: expr-fib-attrs
      -
        value: flow_offload
        attribute-set: expr-flow-offload-attrs
      -
        value: immediate
        attribute-set: expr-immediate-attrs
      -
        value: log
        attribute-set: log-attrs
      -
        value: lookup
        attribute-set: expr-lookup-attrs
      -
        value: match
        attribute-set: compat-match-attrs
      -
        value: meta
        attribute-set: expr-meta-attrs
      -
        value: nat
        attribute-set: expr-nat-attrs
      -
        value: numgen
        attribute-set: numgen-attrs
      -
        value: objref
        attribute-set: expr-objref-attrs
      -
        value: payload
        attribute-set: expr-payload-attrs
      -
        value: quota
        attribute-set: quota-attrs
      -
        value: range
        attribute-set: range-attrs
      -
        value: reject
        attribute-set: expr-reject-attrs
      -
        value: target
        attribute-set: expr-target-attrs
      -
        value: tproxy
        attribute-set: expr-tproxy-attrs
        # There're more sub-messages to go:
        #   grep -A10 nft_expr_type
        # and look for .name\s*=\s*"..."
  -
    name: obj-data
    formats:
      -
        value: counter
        attribute-set: counter-attrs
      -
        value: quota
        attribute-set: quota-attrs

operations:
  enum-model: directional
  list:
    -
      name: batch-begin
      doc: Start a batch of operations
      attribute-set: batch-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0x10
          attributes:
            - genid
        reply:
          value: 0x10
          attributes:
            - genid
    -
      name: batch-end
      doc: Finish a batch of operations
      attribute-set: batch-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0x11
          attributes:
            - genid
    -
      name: newtable
      doc: Create a new table.
      attribute-set: table-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa00
          attributes:
            # Mentioned in nf_tables_newtable()
            - name
            - flags
            - userdata
    -
      name: gettable
      doc: Get / dump tables.
      attribute-set: table-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa01
          attributes:
            # Mentioned in nf_tables_gettable()
            - name
        reply:
          value: 0xa00
          attributes: &get-table
            # Mentioned in nf_tables_fill_table_info()
            - name
            - use
            - handle
            - flags
            - owner
            - userdata
      dump:
        reply:
          attributes: *get-table
    -
      name: deltable
      doc: Delete an existing table.
      attribute-set: table-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa02
          attributes: &del-table
            # Mentioned in nf_tables_deltable()
            - name
            - handle
    -
      name: destroytable
      doc: |
        Delete an existing table with destroy semantics (ignoring ENOENT
        errors).
      attribute-set: table-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa1a
          attributes: *del-table
    -
      name: newchain
      doc: Create a new chain.
      attribute-set: chain-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa03
          attributes:
            # Mentioned in nf_tables_newchain()
            - table
            - handle
            - policy
            - flags
            # Mentioned in nf_tables_updchain()
            - hook
            - name
            - counters
            # Mentioned in nf_tables_addchain()
            - userdata
            # Mentioned in nft_chain_parse_hook()
            - type
    -
      name: getchain
      doc: Get / dump chains.
      attribute-set: chain-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa04
          attributes:
            # Mentioned in nf_tables_getchain()
            - table
            - name
        reply:
          value: 0xa03
          attributes: &get-chain
            # Mentioned in nf_tables_fill_chain_info()
            - table
            - name
            - handle
            - hook
            - policy
            - type
            - flags
            - counters
            - id
            - use
            - userdata
      dump:
        reply:
          attributes: *get-chain
    -
      name: delchain
      doc: Delete an existing chain.
      attribute-set: chain-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa05
          attributes: &del-chain
            # Mentioned in nf_tables_delchain()
            - table
            - handle
            - name
            - hook
    -
      name: destroychain
      doc: |
        Delete an existing chain with destroy semantics (ignoring ENOENT
        errors).
      attribute-set: chain-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa1b
          attributes: *del-chain
    -
      name: newrule
      doc: Create a new rule.
      attribute-set: rule-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa06
          attributes:
            # Mentioned in nf_tables_newrule()
            - table
            - chain
            - chain-id
            - handle
            - position
            - position-id
            - expressions
            - userdata
            - compat
    -
      name: getrule
      doc: Get / dump rules.
      attribute-set: rule-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa07
          attributes: &get-rule-request
            # Mentioned in nf_tables_getrule_single()
            - table
            - chain
            - handle
        reply:
          value: 0xa06
          attributes: &get-rule
            # Mentioned in nf_tables_fill_rule_info()
            - table
            - chain
            - handle
            - position
            - expressions
            - userdata
      dump:
        request:
          attributes:
            # Mentioned in nf_tables_dump_rules_start()
            - table
            - chain
        reply:
          attributes: *get-rule

    -
      name: getrule-reset
      doc: Get / dump rules and reset stateful expressions.
      attribute-set: rule-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa19
          attributes: *get-rule-request
        reply:
          value: 0xa06
          attributes: *get-rule
      dump:
        request:
          attributes: *get-rule-request
        reply:
          attributes: *get-rule
    -
      name: delrule
      doc: Delete an existing rule.
      attribute-set: rule-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa08
          attributes: &del-rule
            - table
            - chain
            - handle
            - id
    -
      name: destroyrule
      doc: |
        Delete an existing rule with destroy semantics (ignoring ENOENT errors).
      attribute-set: rule-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa1c
          attributes: *del-rule
    -
      name: newset
      doc: Create a new set.
      attribute-set: set-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa09
          attributes:
            # Mentioned in nf_tables_newset()
            - table
            - name
            - key-len
            - id
            - key-type
            - flags
            - data-type
            - data-len
            - obj-type
            - timeout
            - gc-interval
            - policy
            - desc
            - userdata
    -
      name: getset
      doc: Get / dump sets.
      attribute-set: set-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa0a
          attributes:
            # Mentioned in nf_tables_getset()
            - table
            - name
        reply:
          value: 0xa09
          attributes: &get-set
            # Mentioned in nf_tables_fill_set()
            - table
            - name
            - handle
            - flags
            - key-len
            - key-type
            - data-type
            - data-len
            - obj-type
            - gc-interval
            - policy
            - userdata
            - desc
            - expr
            - expressions
      dump:
        request:
          attributes:
            # Mentioned in nf_tables_getset()
            - table
        reply:
          attributes: *get-set
    -
      name: delset
      doc: Delete an existing set.
      attribute-set: set-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa0b
          attributes: &del-set
            # Mentioned in nf_tables_delset()
            - table
            - handle
            - name
    -
      name: destroyset
      doc: |
        Delete an existing set with destroy semantics (ignoring ENOENT errors).
      attribute-set: set-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa1d
          attributes: *del-set
    -
      name: newsetelem
      doc: Create a new set element.
      attribute-set: setelem-list-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa0c
          attributes:
            # Mentioned in nf_tables_newsetelem()
            - table
            - set
            - set-id
            - elements
    -
      name: getsetelem
      doc: Get / dump set elements.
      attribute-set: setelem-list-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa0d
          attributes:
            # Mentioned in nf_tables_getsetelem()
            - table
            - set
            - elements
        reply:
          value: 0xa0c
          attributes:
            # Mentioned in nf_tables_fill_setelem_info()
            - elements
      dump:
        request:
          attributes: &dump-set-request
            # Mentioned in nft_set_dump_ctx_init()
            - table
            - set
        reply:
          attributes: &dump-set
            # Mentioned in nf_tables_dump_set()
            - table
            - set
            - elements
    -
      name: getsetelem-reset
      doc: Get / dump set elements and reset stateful expressions.
      attribute-set: setelem-list-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa21
          attributes:
            # Mentioned in nf_tables_getsetelem_reset()
            - elements
        reply:
          value: 0xa0c
          attributes:
            # Mentioned in nf_tables_dumpreset_set()
            - table
            - set
            - elements
      dump:
        request:
          attributes: *dump-set-request
        reply:
          attributes: *dump-set
    -
      name: delsetelem
      doc: Delete an existing set element.
      attribute-set: setelem-list-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa0e
          attributes: &del-setelem
            # Mentioned in nf_tables_delsetelem()
            - table
            - set
            - elements
    -
      name: destroysetelem
      doc: Delete an existing set element with destroy semantics.
      attribute-set: setelem-list-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa1e
          attributes: *del-setelem
    -
      name: getgen
      doc: Get / dump rule-set generation.
      attribute-set: gen-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa10
        reply:
          value: 0xa0f
          attributes: &get-gen
            # Mentioned in nf_tables_fill_gen_info()
            - id
            - proc-pid
            - proc-name
      dump:
        reply:
          attributes: *get-gen
    -
      name: newobj
      doc: Create a new stateful object.
      attribute-set: obj-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa12
          attributes:
            # Mentioned in nf_tables_newobj()
            - type
            - name
            - data
            - table
            - userdata
    -
      name: getobj
      doc: Get / dump stateful objects.
      attribute-set: obj-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa13
          attributes:
            # Mentioned in nf_tables_getobj_single()
            - name
            - type
            - table
        reply:
          value: 0xa12
          attributes: &obj-info
            # Mentioned in nf_tables_fill_obj_info()
            - table
            - name
            - type
            - handle
            - use
            - data
            - userdata
      dump:
        request:
          attributes:
            # Mentioned in nf_tables_dump_obj_start()
            - table
            - type
        reply:
          attributes: *obj-info
    -
      name: delobj
      doc: Delete an existing stateful object.
      attribute-set: obj-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa14
          attributes:
            # Mentioned in nf_tables_delobj()
            - table
            - name
            - type
            - handle
    -
      name: destroyobj
      doc: Delete an existing stateful object with destroy semantics.
      attribute-set: obj-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa1f
          attributes:
            # Mentioned in nf_tables_delobj()
            - table
            - name
            - type
            - handle
    -
      name: newflowtable
      doc: Create a new flow table.
      attribute-set: flowtable-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa16
          attributes:
            # Mentioned in nf_tables_newflowtable()
            - table
            - name
            - hook
            - flags
    -
      name: getflowtable
      doc: Get / dump flow tables.
      attribute-set: flowtable-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa17
          attributes:
            # Mentioned in nf_tables_getflowtable()
            - name
            - table
        reply:
          value: 0xa16
          attributes: &flowtable-info
            # Mentioned in nf_tables_fill_flowtable_info()
            - table
            - name
            - handle
            - use
            - flags
            - hook
      dump:
        reply:
          attributes: *flowtable-info
    -
      name: delflowtable
      doc: Delete an existing flow table.
      attribute-set: flowtable-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa18
          attributes: &del-flowtable
            # Mentioned in nf_tables_delflowtable()
            - table
            - name
            - handle
            - hook
    -
      name: destroyflowtable
      doc: Delete an existing flow table with destroy semantics.
      attribute-set: flowtable-attrs
      fixed-header: nfgenmsg
      do:
        request:
          value: 0xa20
          attributes: *del-flowtable

mcast-groups:
  list:
    -
      name: mgmt