This allows to store ct object references in maps. This is a userspace only change. The only kernel patch required to make the test case work on nf.git is netfilter: nft_ct: fix l3num expectations with inet pseudo family, else ct expectations in inet family get rejected. Note that the second patch is the opposite of what we agreed on at NFWS, this is also why its both separate and has a very large wall-of-text commit message. I did not find a way to solve this without kernel patches in a sane way. I could still make it work with the new postfix keywords mentioned in patch 2 commit message, but it would need a lot of guesswork and special casing to figure out when to add the "right" postfix keyword. Please see patch 2 for details and rationale wrt. chosen solution. Florian Westphal (3): parser: allow to define maps that contain timeouts and expectations parser: allow to define maps that contain ct helpers tests: add test case for named ct objects src/parser_bison.y | 25 ++++- .../testcases/maps/dumps/named_ct_objects.nft | 71 ++++++++++++++ tests/shell/testcases/maps/named_ct_objects | 94 +++++++++++++++++++ 3 files changed, 185 insertions(+), 5 deletions(-) create mode 100644 tests/shell/testcases/maps/dumps/named_ct_objects.nft create mode 100755 tests/shell/testcases/maps/named_ct_objects -- 2.43.0
