From 410cb04f2dc4a426da2e3a96c3a33cd29298c1aa Mon Sep 17 00:00:00 2001
From: Jayden Nyamiaka <jaydennyam@google.com>
Date: Tue, 16 Jul 2024 12:51:39 -0700
Subject: [PATCH] Add netfilter hook priority constants for nftables support.

PiperOrigin-RevId: 652945259
---
 pkg/abi/linux/BUILD               |  2 ++
 pkg/abi/linux/netfilter_bridge.go | 30 ++++++++++++++++++++++++++
 pkg/abi/linux/netfilter_ipv4.go   | 36 +++++++++++++++++++++++++++++++
 pkg/abi/linux/netfilter_ipv6.go   | 20 +++++++++++++++++
 4 files changed, 88 insertions(+)
 create mode 100644 pkg/abi/linux/netfilter_bridge.go
 create mode 100644 pkg/abi/linux/netfilter_ipv4.go

diff --git a/pkg/abi/linux/BUILD b/pkg/abi/linux/BUILD
index 496db6236..141896951 100644
--- a/pkg/abi/linux/BUILD
+++ b/pkg/abi/linux/BUILD
@@ -52,6 +52,8 @@ go_library(
         "msgqueue.go",
         "netdevice.go",
         "netfilter.go",
+        "netfilter_bridge.go",
+        "netfilter_ipv4.go",
         "netfilter_ipv6.go",
         "netlink.go",
         "netlink_route.go",
diff --git a/pkg/abi/linux/netfilter_bridge.go b/pkg/abi/linux/netfilter_bridge.go
new file mode 100644
index 000000000..ed09e4bea
--- /dev/null
+++ b/pkg/abi/linux/netfilter_bridge.go
@@ -0,0 +1,30 @@
+// Copyright 2024 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package linux
+
+import "math"
+
+// Netfilter Bridge Standard Hook Priorities, from
+// uapi/linux/netfilter_bridge.h.
+const (
+	NF_BR_PRI_FIRST           = math.MinInt
+	NF_BR_PRI_NAT_DST_BRIDGED = -300
+	NF_BR_PRI_FILTER_BRIDGED  = -200
+	NF_BR_PRI_BRNF            = 0
+	NF_BR_PRI_NAT_DST_OTHER   = 100
+	NF_BR_PRI_FILTER_OTHER    = 200
+	NF_BR_PRI_NAT_SRC         = 300
+	NF_BR_PRI_LAST            = math.MaxInt
+)
diff --git a/pkg/abi/linux/netfilter_ipv4.go b/pkg/abi/linux/netfilter_ipv4.go
new file mode 100644
index 000000000..0943bcbe8
--- /dev/null
+++ b/pkg/abi/linux/netfilter_ipv4.go
@@ -0,0 +1,36 @@
+// Copyright 2024 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package linux
+
+import "math"
+
+// Netfilter IPv4 Standard Hook Priorities, from uapi/linux/netfilter_ipv4.h.
+const (
+	NF_IP_PRI_FIRST             = math.MinInt
+	NF_IP_PRI_RAW_BEFORE_DEFRAG = -450
+	NF_IP_PRI_CONNTRACK_DEFRAG  = -400
+	NF_IP_PRI_RAW               = -300
+	NF_IP_PRI_SELINUX_FIRST     = -225
+	NF_IP_PRI_CONNTRACK         = -200
+	NF_IP_PRI_MANGLE            = -150
+	NF_IP_PRI_NAT_DST           = -100
+	NF_IP_PRI_FILTER            = 0
+	NF_IP_PRI_SECURITY          = 50
+	NF_IP_PRI_NAT_SRC           = 100
+	NF_IP_PRI_SELINUX_LAST      = 225
+	NF_IP_PRI_CONNTRACK_HELPER  = 300
+	NF_IP_PRI_CONNTRACK_CONFIRM = math.MaxInt
+	NF_IP_PRI_LAST              = math.MaxInt
+)
diff --git a/pkg/abi/linux/netfilter_ipv6.go b/pkg/abi/linux/netfilter_ipv6.go
index 4d9c09402..6ed1c77ba 100644
--- a/pkg/abi/linux/netfilter_ipv6.go
+++ b/pkg/abi/linux/netfilter_ipv6.go
@@ -15,6 +15,8 @@
 package linux
 
 import (
+	"math"
+
 	"gvisor.dev/gvisor/pkg/marshal"
 	"gvisor.dev/gvisor/pkg/marshal/primitive"
 )
@@ -24,6 +26,24 @@ import (
 // are only distinguished by context (e.g. whether used on an IPv4 of IPv6
 // socket).
 
+// Netfilter IPv6 Standard Hook Priorities, from uapi/linux/netfilter_ipv6.h.
+const (
+	NF_IP4_PRI_FIRST             = math.MinInt
+	NF_IP4_PRI_RAW_BEFORE_DEFRAG = -450
+	NF_IP4_PRI_CONNTRACK_DEFRAG  = -400
+	NF_IP4_PRI_RAW               = -300
+	NF_IP4_PRI_SELINUX_FIRST     = -225
+	NF_IP4_PRI_CONNTRACK         = -200
+	NF_IP4_PRI_MANGLE            = -150
+	NF_IP4_PRI_NAT_DST           = -100
+	NF_IP4_PRI_FILTER            = 0
+	NF_IP4_PRI_SECURITY          = 50
+	NF_IP4_PRI_NAT_SRC           = 100
+	NF_IP4_PRI_SELINUX_LAST      = 225
+	NF_IP4_PRI_CONNTRACK_HELPER  = 300
+	NF_IP4_PRI_LAST              = math.MaxInt
+)
+
 // Socket options for SOL_SOCLET. These correspond to values in
 // include/uapi/linux/netfilter_ipv6/ip6_tables.h.
 const (