STRUCT NFT_RULE(9)

💖 struct nft_rule(9) — like, the nf_tables rule struct, bestie 💖

okay so you found the struct nft_rule(9) page in the Kernel API Manual and you're like "what even is this" — don't worry, I got you 🫶 this is the little guy that represents one single rule inside nf_tables, and honestly? iconic. let's get into it ✨

---

🌸 NAME 🌸

struct nft_rule — the nf_tables rule. that's it, that's the vibe 💅

---

✨ SYNOPSIS ✨

here's the shape of it, copy-paste exact because we do not freestyle struct definitions in this house 🎀

struct nft_rule {
    struct list_head                list;
    u64 handle:42, genmask:2, dlen:12, udata:1;
    unsigned char                   data[];
 };

---

🦋 Members 🦋

okay so each field, one by one, no skipping, we're thorough here 👑

• list — used internally. that's it, that's all the manpage says, it's giving mysterious main character energy 🙈
• handle — the rule handle. your lil ID for the rule itself 💫
• genmask — the generation mask 🌈
• dlen — length of expression data. yes, dlen, and yes it's a bitfield, we love a packed little guy 🍓
• udata — user data is appended to the rule. note this one's literally a 1-bit flag in that u64 up there, so it's just saying "yo, is there user data tacked on" 💜
• data — expression data. the flexible array member at the end doing its thing ✨

side note bestie: look at that u64 line — handle:42, genmask:2, dlen:12, udata:1. that's 42 + 2 + 12 + 1 = 57 bits crammed into a u64. bitfields ate, no cap 🔥

---

👑 SEE ALSO 👑

this list is long and I refuse to drop a single one of these, so buckle up, we're going through the whole family tree 🧚 it's all in the kernel file ./include/net/netfilter/nf_tables.h:

• struct nft_verdict(9)
• struct nft_regs(9)
• struct nft_ctx(9)
• struct nft_userdata(9)
• struct nft_set_elem(9)
• enum nft_iter_type(9)
• struct nft_set_desc(9)
• enum nft_set_class(9)
• struct nft_set_estimate(9)
• struct nft_expr(9)
• struct nft_set_ops(9)
• struct nft_set_type(9)
• struct nft_set(9)
• struct nft_set_binding(9)
• enum nft_set_extensions(9)
• struct nft_set_ext_type(9)
• struct nft_set_ext_tmpl(9)
• struct nft_set_ext(9)
• struct nft_expr_type(9)
• struct nft_expr_ops(9)
• struct nft_chain_validate_state(9)
• struct nft_chain(9)
• struct nft_chain_type(9)
• struct nft_base_chain(9)
• struct nft_table(9)
• struct nft_object_hash_key(9)
• struct nft_object(9)
• struct nft_object_type(9)
• struct nft_object_ops(9)
• struct nft_flowtable(9)
• struct nft_traceinfo(9)
• struct nft_trans(9)
• struct nft_trans_hook(9)
• struct nft_trans_binding(9)

that's the whole squad, all 34 of them, iykyk 💅

---

kay that's the whole page bestie, you ate that 🫶 this came out of the ./include/net/netfilter corner of the kernel, and it's dated October 2026 — so go forth, read your struct nft_rule(9), and slay ✨💖🎀