PF_RT_TIMESTAMP
{ .type = PF_RT_TIMESTAMP, .off = _OUT(r.last_active_timestamp), .cb = snl_attr_get_uint64 },
nlattr_add_u64(nw, PF_RT_TIMESTAMP, pf_get_timestamp(rule));