Add netfilter hook priority constants for nftables support.

PiperOrigin-RevId: 652945259

pkg/abi/linux/BUILD

@@ -52,6 +52,8 @@ go_library(
         "msgqueue.go",
         "netdevice.go",
         "netfilter.go",
+        "netfilter_bridge.go",
+        "netfilter_ipv4.go",
         "netfilter_ipv6.go",
         "netlink.go",
         "netlink_route.go",

pkg/abi/linux/netfilter_bridge.go

@@ -0,0 +1,30 @@
+// Copyright 2024 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package linux
+
+import "math"
+
+// Netfilter Bridge Standard Hook Priorities, from
+// uapi/linux/netfilter_bridge.h.
+const (
+	NF_BR_PRI_FIRST           = math.MinInt
+	NF_BR_PRI_NAT_DST_BRIDGED = -300
+	NF_BR_PRI_FILTER_BRIDGED  = -200
+	NF_BR_PRI_BRNF            = 0
+	NF_BR_PRI_NAT_DST_OTHER   = 100
+	NF_BR_PRI_FILTER_OTHER    = 200
+	NF_BR_PRI_NAT_SRC         = 300
+	NF_BR_PRI_LAST            = math.MaxInt
+)

pkg/abi/linux/netfilter_ipv4.go

@@ -0,0 +1,36 @@
+// Copyright 2024 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package linux
+
+import "math"
+
+// Netfilter IPv4 Standard Hook Priorities, from uapi/linux/netfilter_ipv4.h.
+const (
+	NF_IP_PRI_FIRST             = math.MinInt
+	NF_IP_PRI_RAW_BEFORE_DEFRAG = -450
+	NF_IP_PRI_CONNTRACK_DEFRAG  = -400
+	NF_IP_PRI_RAW               = -300
+	NF_IP_PRI_SELINUX_FIRST     = -225
+	NF_IP_PRI_CONNTRACK         = -200
+	NF_IP_PRI_MANGLE            = -150
+	NF_IP_PRI_NAT_DST           = -100
+	NF_IP_PRI_FILTER            = 0
+	NF_IP_PRI_SECURITY          = 50
+	NF_IP_PRI_NAT_SRC           = 100
+	NF_IP_PRI_SELINUX_LAST      = 225
+	NF_IP_PRI_CONNTRACK_HELPER  = 300
+	NF_IP_PRI_CONNTRACK_CONFIRM = math.MaxInt
+	NF_IP_PRI_LAST              = math.MaxInt
+)

pkg/abi/linux/netfilter_ipv6.go

@@ -15,6 +15,8 @@
 package linux
 
 import (
+	"math"
+
 	"gvisor.dev/gvisor/pkg/marshal"
 	"gvisor.dev/gvisor/pkg/marshal/primitive"
 )
@@ -24,6 +26,24 @@ import (
 // are only distinguished by context (e.g. whether used on an IPv4 of IPv6
 // socket).
 
+// Netfilter IPv6 Standard Hook Priorities, from uapi/linux/netfilter_ipv6.h.
+const (
+	NF_IP4_PRI_FIRST             = math.MinInt
+	NF_IP4_PRI_RAW_BEFORE_DEFRAG = -450
+	NF_IP4_PRI_CONNTRACK_DEFRAG  = -400
+	NF_IP4_PRI_RAW               = -300
+	NF_IP4_PRI_SELINUX_FIRST     = -225
+	NF_IP4_PRI_CONNTRACK         = -200
+	NF_IP4_PRI_MANGLE            = -150
+	NF_IP4_PRI_NAT_DST           = -100
+	NF_IP4_PRI_FILTER            = 0
+	NF_IP4_PRI_SECURITY          = 50
+	NF_IP4_PRI_NAT_SRC           = 100
+	NF_IP4_PRI_SELINUX_LAST      = 225
+	NF_IP4_PRI_CONNTRACK_HELPER  = 300
+	NF_IP4_PRI_LAST              = math.MaxInt
+)
+
 // Socket options for SOL_SOCLET. These correspond to values in
 // include/uapi/linux/netfilter_ipv6/ip6_tables.h.
 const (