v2, with updated syntax to force type and protocol keywords into same statement, i.e. ct helper ftp-standard { type "ftp" protocol tcp } I also cleaned up the changes to bison (reuse family_spec_explicit) and added a test for an invalid helper (l3proto ip6 in ip table). doc/nft.xml | 76 +++++++++++++++++ include/ct.h | 1 include/linux/netfilter/nf_tables.h | 12 ++ include/rule.h | 12 ++ src/ct.c | 10 ++ src/evaluate.c | 37 +++++--- src/netlink.c | 16 +++ src/parser_bison.y | 156 +++++++++++++++++++++++++++++++++++- src/rule.c | 45 ++++++++++ src/statement.c | 10 ++ tests/py/ip/objects.t | 5 + tests/py/ip/objects.t.payload | 14 +++ tests/py/nft-test.py | 28 +++++- 13 files changed, 399 insertions(+), 23 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html