Re: RFD - Exposing netfilter types?

[Florian Westphal <fw@strlen.de>]

Ian Pilcher <arequipeno@gmail.com> wrote:
> Recently, I asked what I thought would be a simple question.  How should
> an application go about determining the type of objects stored in an
> nftables set.
> 
>   https://marc.info/?l=netfilter&m=176546062431223&w=2
> 
> As seen in the response (thanks Florian!), doing this for all possible
> types, including concatenations, is actually pretty complicated.
> 
> Presumably, this is why the NFTA_SET_KEY_TYPE values that correspond to
> simple types aren't in any public header.  Instead, those values, along
> with all of the logic associated with complex types seem to exist solely
> within the nftables user-space utility (nft).

Yes.  Note that the type info is only used for formatting the data.
Its not used by the kernel and its not relevant for matching.

Theoretically nft could store that data on disk and not even
send it to the kernel.

> Of course, this presents a problem for any other application that wants
> to work with these types/values.  Today, any such program needs to copy
> the values and/or logic that it needs from the nft sources.

Yes.

> Is there any reason that the type-related stuff that's currently in nft
> shouldn't be broken out into a separate library that other applications
> could also use?

Whats the use case?