Re: How are ct helper to be configured with NFT ?

[leroy christophe <christophe.leroy@c-s.fr>]

Le 05/12/2014 11:38, Pablo Neira Ayuso a écrit :
> On Fri, Dec 05, 2014 at 08:27:11AM +0100, leroy christophe wrote:
>> test.c               100% |************************************************************************|
>> 804   0:00:00 ETA
>>
>> # nft list ruleset
>> table ip filter {
>>          chain output {
>>                   type filter hook output priority 0;
>>                   udp dport tftp ct helper "tftp"
> The right syntax is:
>
>          udp dport tftp ct helper set "tftp"
>                                   ^^^
>
> your rule above does something different:
>
> 1) udp dport tftp
>
> and
>
> 2) the ct helper is "tftp"
>
> However, userspace supports this but unfortunately the kernel code is
> still missing.  So you'll have to wait for this feature or
> (temporarily) rely on the automagic helper assignment (from that
> message, I understand you already do).
Any idea of when the kernel support will be added ?

Christophe