Re: [PATCH nft] src: add misspell hint for ct timeout policy names

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Tue, Oct 20, 2026 at 02:49:20PM +0200, Florian Westphal wrote:
> before:
> Error: invalid state for this protocol
> add ct timeout t foo { protocol tcp; policy = { estblshed : 2 }; }
>                                                 ^^^^^^^^^
> after:
> Error: invalid state 'estblshed' for this protocol; did you mean 'established'?
> add ct timeout t foo { protocol tcp; policy = { estblshed : 2 }; }
> 
> Signed-off-by: Florian Westphal <fw@strlen.de>

Reviewed-by: Pablo Neira Ayuso <pablo@netfilter.org>

> ---
>  include/rule.h |  1 +
>  src/evaluate.c | 19 +++++++++++++++++--
>  src/rule.c     | 19 +++++++++++++++++++
>  3 files changed, 37 insertions(+), 2 deletions(-)
> 
> diff --git a/include/rule.h b/include/rule.h
> index 7b7b7eb1012d..09fd045c7385 100644
> --- a/include/rule.h
> +++ b/include/rule.h
> @@ -882,5 +882,6 @@ struct timeout_protocol {
>  
>  extern struct timeout_protocol timeout_protocol[UINT8_MAX + 1];
>  extern int timeout_str2num(uint16_t l4proto, struct timeout_state *ts);
> +extern const char *timeout_lookup_fuzzy(uint16_t l4proto, const char *name);
>  
>  #endif /* NFTABLES_RULE_H */
> diff --git a/src/evaluate.c b/src/evaluate.c
> index 01b4afbbb10d..f424b987f8f8 100644
> --- a/src/evaluate.c
> +++ b/src/evaluate.c
> @@ -5826,6 +5826,21 @@ static int ct_expect_evaluate(struct eval_ctx *ctx, struct obj *obj)
>  	return 0;
>  }
>  
> +static int timeout_not_found(struct eval_ctx *ctx, const struct location *loc,
> +			     uint16_t l4proto, const char *state_name)
> +{
> +	const char *suggestion;
> +
> +	suggestion = timeout_lookup_fuzzy(l4proto, state_name);
> +	if (suggestion == NULL)
> +		return cmd_error(ctx, loc, "invalid state '%s' for this protocol",
> +				 state_name);
> +
> +	return cmd_error(ctx, loc,
> +			 "invalid state '%s' for this protocol; did you mean '%s'?",
> +			 state_name, suggestion);
> +}
> +
>  static int ct_timeout_evaluate(struct eval_ctx *ctx, struct obj *obj)
>  {
>  	struct ct_timeout *ct = &obj->ct_timeout;
> @@ -5837,8 +5852,8 @@ static int ct_timeout_evaluate(struct eval_ctx *ctx, struct obj *obj)
>  
>  	list_for_each_entry_safe(ts, next, &ct->timeout_list, head) {
>  		if (timeout_str2num(ct->l4proto, ts) < 0)
> -			return __stmt_binary_error(ctx, &ts->location, NULL,
> -						   "invalid state for this protocol");
> +			return timeout_not_found(ctx, &ts->location,
> +						 ct->l4proto, ts->timeout_str);
>  
>  		ct->timeout[ts->timeout_index] = ts->timeout_value;
>  		list_del(&ts->head);
> diff --git a/src/rule.c b/src/rule.c
> index 552c17df05f8..d232582b6080 100644
> --- a/src/rule.c
> +++ b/src/rule.c
> @@ -89,6 +89,25 @@ struct timeout_protocol timeout_protocol[UINT8_MAX + 1] = {
>  	},
>  };
>  
> +const char *timeout_lookup_fuzzy(uint16_t l4proto, const char *name)
> +{
> +	struct string_misspell_state st;
> +	unsigned int i;
> +
> +	if (!name)
> +		return NULL;
> +
> +	string_misspell_init(&st);
> +
> +	for (i = 0; i < timeout_protocol[l4proto].array_size; i++)
> +		string_misspell_update(timeout_protocol[l4proto].state_to_name[i],
> +				       name,
> +				       (void *)timeout_protocol[l4proto].state_to_name[i],
> +				       &st);
> +
> +	return st.obj;
> +}
> +
>  int timeout_str2num(uint16_t l4proto, struct timeout_state *ts)
>  {
>  	unsigned int i;
> -- 
> 2.55.0
> 
>