Re: [nft PATCH 0/3] Boolean comparison and exthdr existence match support

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Phil,

On Tue, Jan 17, 2017 at 11:10:04PM +0100, Phil Sutter wrote:
> The following series adds two distinct features to nftables, though
> since the second one depends on presence of the first one this is
> submitted as a series.
> 
> Patch 1 adds support for a boolean variant of relational expression.
> It's OP is strictly implicit and determined by RHS being a boolean
> expression. It depends on a related kernel patch adding support for
> NFT_CMP_BOOL to nft_cmp.c.

If the problem is that we lack of context from the delinearize path,
then I would prefer if you scratch one bit from the fib flags to
indicate that we want a true (1)/false (0) return value. Just like we
plan to do with exthdr. This should require a small kernel patch for
nft_fib I think.

Thus, we can skip this ad hoc update for nft_cmp which seems to me
that it's only there to help us get the context that we lack from the
delinearize step.

Then, from the delinearize path, if this fib/exthdr flag is set, we
attach the corresponding datatype to the expression based on this new
flag.

Thanks.