From: Pablo Neira Ayuso <pablo@netfilter.org>
To: Florian Westphal <fw@strlen.de>
Cc: netfilter-devel <netfilter-devel@vger.kernel.org>
Subject: Re: nftables: syntax ambiguity with objref map and ct helper objects
Date: Mon, 31 Jul 2023 17:32:07 +0200 [thread overview]
Message-ID: <ZMfT97SbKBov4UzD@calendula> (raw)
In-Reply-To: <20230731124637.GA7056@breakpoint.cc>
On Mon, Jul 31, 2023 at 02:46:37PM +0200, Florian Westphal wrote:
[...]
> My point is how nft should differentiate between
>
> ct helper "bla" {
>
> rule add ct helper "foo"
>
> In above map declaration. What does
>
> "typeof ip saddr : ct helper" declare?
> As far as I can see its arbitrary 16-byte strings, so the
> above doesn't delcare an objref map that maps ip addresses
> to conntrack helper templates.
Oh, indeed. Selector semantics are overloaded, I proposed kernel
patches that have remained behind:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210309210134.13620-2-pablo@netfilter.org/
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210309210134.13620-3-pablo@netfilter.org/
I also proposed change to have two selectors, one for the helper type
and another for the user-defined helper name. I still have to update
libnftnl and nftables.
I don't think this is specifically related to the map definition
itself, but the fact that the selector semantics is ambiguous.
next prev parent reply other threads:[~2023-07-31 15:32 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-28 19:56 nftables: syntax ambiguity with objref map and ct helper objects Florian Westphal
2023-07-31 12:23 ` Pablo Neira Ayuso
2023-07-31 12:46 ` Florian Westphal
2023-07-31 15:32 ` Pablo Neira Ayuso [this message]
2023-08-04 9:12 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZMfT97SbKBov4UzD@calendula \
--to=pablo@netfilter.org \
--cc=fw@strlen.de \
--cc=netfilter-devel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.