From f813cc6f7a1043922e282f1f9fec88e8bea2481a Mon Sep 17 00:00:00 2001 From: Jayden Nyamiaka Date: Tue, 13 Aug 2024 16:47:40 -0700 Subject: [PATCH] Add netfilter payload expression constants for nftables support. PiperOrigin-RevId: 662699475 --- pkg/abi/linux/nf_tables.go | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/pkg/abi/linux/nf_tables.go b/pkg/abi/linux/nf_tables.go index 07a78aa6b..e2e234f00 100644 --- a/pkg/abi/linux/nf_tables.go +++ b/pkg/abi/linux/nf_tables.go @@ -92,3 +92,30 @@ const ( NFT_CMP_GT // greater than NFT_CMP_GTE // greater than or equal to ) + +// Nf table payload expression offset bases. +// Used by the nft payload operations to access appropriate data in the packet. +// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h. +const ( + NFT_PAYLOAD_LL_HEADER = iota // link layer header + NFT_PAYLOAD_NETWORK_HEADER // network header + NFT_PAYLOAD_TRANSPORT_HEADER // transport header + NFT_PAYLOAD_INNER_HEADER // inner header / payload + NFT_PAYLOAD_TUN_HEADER // tunneling protocol header +) + +// Nf table payload expression checksum types. +// Used by the nft payload set operation to mark the type of checksum to use. +// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h. +const ( + NFT_PAYLOAD_CSUM_NONE = iota // no checksumming + NFT_PAYLOAD_CSUM_INET // internet checksum (RFC 791) + NFT_PAYLOAD_CSUM_SCTP // CRC-32c, for use in SCTP header (RFC 3309) +) + +// Nf table payload expression checksum flags. +// Used by the nft payload set operation to mark the flags for checksumming. +// These correspond to enum values in include/uapi/linux/netfilter/nf_tables.h. +const ( + NFT_PAYLOAD_L4CSUM_PSEUDOHDR = (1 << 0) // use pseudoheader for L4 checksum +)