Re: [nft crap] ct original ip saddr ... handling

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Jun 28, 2017 at 12:06:42PM +0200, Florian Westphal wrote:
> I am running out of time so I have to send this unfinished/non-working
> state.
> 
> It breaks because ct is riddled with conflicts,
> in nft we've handled original/reply as STRING to avoid conflicts
> with 'arp reply', so we cannot add
> 
> ct original ip saddr
> 
> because it is
> ct STRING	IP	SADDR
> 
> and that conflicts with basic use where 'ip saddr' could be payload
> expression, and STRING is one of the normal ct tokens and not a direction.
> 
> I am trying to fix this here by moving all ct keywords back to tokens.

Yes. We have a very compact syntax here, tokens helps bison decide
where to go. If we would have a well-structure syntax, looking less
human-readable, it would be more simple. But given what we have, we
have to use many tokens.

> There are no shift/reduce errors, things compile fine, and all
> test cases work.  Its just that we break 'ct event set label':
> 
> Works:
> ct event set new or reply
> ct event set new,reply
> ct event set new,label
> fails:
> ct event set label ('expects COMMA')

This can be fixed, it's just a matter we need more time, right?

No problem, we can take the time.

Thanks for working on this!