netfilter: nf_tables: add set timeout API support

Add set timeout support to the netlink API. Sets with timeout support
enabled can have a default timeout value and garbage collection interval
specified.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 6 insertions, 0 deletions

diff --git a/include/uapi/linux/netfilter/nf_tables.h b/include/uapi/linux/netfilter/nf_tables.h
index b9783931503b..971d245e7378 100644
--- a/include/uapi/linux/netfilter/nf_tables.h
+++ b/include/uapi/linux/netfilter/nf_tables.h
@@ -208,12 +208,14 @@ enum nft_rule_compat_attributes {
  * @NFT_SET_CONSTANT: set contents may not change while bound
  * @NFT_SET_INTERVAL: set contains intervals
  * @NFT_SET_MAP: set is used as a dictionary
+ * @NFT_SET_TIMEOUT: set uses timeouts
  */
 enum nft_set_flags {
         NFT_SET_ANONYMOUS               = 0x1,
         NFT_SET_CONSTANT                = 0x2,
         NFT_SET_INTERVAL                = 0x4,
         NFT_SET_MAP                     = 0x8,
+        NFT_SET_TIMEOUT                 = 0x10,
 };
 
 /**
@@ -252,6 +254,8 @@ enum nft_set_desc_attributes {
  * @NFTA_SET_POLICY: selection policy (NLA_U32)
  * @NFTA_SET_DESC: set description (NLA_NESTED)
  * @NFTA_SET_ID: uniquely identifies a set in a transaction (NLA_U32)
+ * @NFTA_SET_TIMEOUT: default timeout value (NLA_U64)
+ * @NFTA_SET_GC_INTERVAL: garbage collection interval (NLA_U32)
  */
 enum nft_set_attributes {
         NFTA_SET_UNSPEC,
@@ -265,6 +269,8 @@ enum nft_set_attributes {
         NFTA_SET_POLICY,
         NFTA_SET_DESC,
         NFTA_SET_ID,
+        NFTA_SET_TIMEOUT,
+        NFTA_SET_GC_INTERVAL,
         __NFTA_SET_MAX
 };
 #define NFTA_SET_MAX            (__NFTA_SET_MAX - 1)