[PATCH nft 0/3] parser: allow to define maps that contain ct objects

[Florian Westphal <fw@strlen.de>]

This allows to store ct object references in maps.
This is a userspace only change.

The only kernel patch required to make the test case work on nf.git
is netfilter: nft_ct: fix l3num expectations with inet pseudo family,
else ct expectations in inet family get rejected.

Note that the second patch is the opposite of what we agreed on at
NFWS, this is also why its both separate and has a very large
wall-of-text commit message.

I did not find a way to solve this without kernel patches in a sane
way.

I could still make it work with the new postfix keywords mentioned
in patch 2 commit message, but it would need a lot of guesswork and
special casing to figure out when to add the "right" postfix keyword.

Please see patch 2 for details and rationale wrt. chosen solution.

Florian Westphal (3):
  parser: allow to define maps that contain timeouts and expectations
  parser: allow to define maps that contain ct helpers
  tests: add test case for named ct objects

 src/parser_bison.y                            | 25 ++++-
 .../testcases/maps/dumps/named_ct_objects.nft | 71 ++++++++++++++
 tests/shell/testcases/maps/named_ct_objects   | 94 +++++++++++++++++++
 3 files changed, 185 insertions(+), 5 deletions(-)
 create mode 100644 tests/shell/testcases/maps/dumps/named_ct_objects.nft
 create mode 100755 tests/shell/testcases/maps/named_ct_objects

-- 
2.43.0