Why did we not have these declared before? Where are they canonically defined in the upstream sources? Can you add a link please?

Why did we not have these declared before? Where are they canonically defined in the upstream sources? Can you add a link please?

There is no definition. They are defined with the following:

const (
    VerdictReturn VerdictKind = iota - 5
    VerdictGoto
    VerdictJump
    VerdictBreak
    VerdictContinue
    VerdictDrop
    VerdictAccept
    VerdictStolen
    VerdictQueue
    VerdictRepeat
    VerdictStop
)

I am looking in https://github.com/torvalds/linux/blob/47ec5303d73ea344e84f46660fff693c57641386/include/uapi/linux/netfilter/nf_tables.h#L64-L70 ... yet to discover.

another reference: https://github.com/torvalds/linux/blob/b71acb0e372160167bf6d5500b88b30b52ccef6e/include/uapi/linux/netfilter.h#L10-L17

@stapelberg , in retrospect, after finding https://git.netfilter.org/libnftnl/tree/src/utils.c#n182, I say was mimicking this function 😄

const char *nftnl_verdict2str(uint32_t verdict)
{
	switch (verdict) {
	case NF_ACCEPT:
		return "accept";
	case NF_DROP:
		return "drop";
	case NF_STOLEN:
		return "stolen";
	case NF_QUEUE:
		return "queue";
	case NF_REPEAT:
		return "repeat";
	case NF_STOP:
		return "stop";
	case NFT_RETURN:
		return "return";
	case NFT_JUMP:
		return "jump";
	case NFT_GOTO:
		return "goto";
	case NFT_CONTINUE:
		return "continue";
	case NFT_BREAK:
		return "break";
	default:
		return "unknown";
	}
}

@stapelberg , also the NF_STOLEN comes from https://git.netfilter.org/libnftnl/tree/include/linux/netfilter.h#n9

/* Responses from hook functions. */
#define NF_DROP 0
#define NF_ACCEPT 1
#define NF_STOLEN 2
#define NF_QUEUE 3
#define NF_REPEAT 4
#define NF_STOP 5
#define NF_MAX_VERDICT NF_STOP

What did you want to express with these comments?

What did you want to express with these comments?

@stapelberg , just a note as to what the id is for the return.

remove debugging left-over?

remove debugging left-over?

@stapelberg , 👍 will do prior to removing WIP.

Can you remove this file from the commit?

Making testing a little easier is a good idea in general, but I’d like to avoid establishing precedent of shell scripts :)

Maybe a “make test” target in a Makefile in a separate PR would be the best way forward?

Can you remove this file from the commit?

@stapelberg , 👍 will do prior to removing WIP.

Maybe a “make test” target in a Makefile in a separate PR would be the best way forward?

@stapelberg , that would be nice! I agree.