Re: nftables: syntax ambiguity with objref map and ct helper objects

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Fri, Jul 28, 2023 at 09:56:14PM +0200, Florian Westphal wrote:
> Hi,
> 
> I wanted to allow creating objref maps that
> return "ct timeout" or "ct helper" templates.
> 
> However:
>   map .. {
>     type ipv4_addr : ct timeout
> 
>   The above is fine, but this is not:
> 
>   map .. {
>     type ipv4_addr : ct helper

This is type, not typeof, is it intentional?

> It caues ambiguity in parser due to existing
> "ct helper" expression, as in
> "nft describe ct helper", not the freestanding
> objref name.
> 
> I could just allow:
>     type ipv4_addr : helper
> 
> ... without "ct", but then we'd require different
> keywords for the definition and the use as data
> element in the key definition, and its inconsistent
> with "ct timeout".
> 
> Should we add a new explicit keyword for
> *both* objref names and the data element usage?
> 
> Perhaps:
> 
> object type ct helper "sip-external" {
>     ....
> 
> And
>     type ipv4_addr : object type ct helper
> 
> ?
> 
> Any better ideas or suggesions on a sane syntax to avoid this?

This works fine with typeof:

table ip x {
        map x {
                typeof ip saddr : ct helper
        }
}

it seems typeof support for 'ct timeout' is missing?

Thanks for reporting.