Re: [BUG] "ether type ip" forgotten/implied when listing rules for 'netdev' family

On 2/23/26 8:24 PM, Florian Westphal wrote:
> Michal Soltys <[email protected]> wrote:
>> While testing the behavior of early filtering in netdev / ingress, I
>> noticed something that possibly looks like a bug.
> 
> Yes, this is a bug, both in nftables and in the tests/py/netdev
> directory, at least one of the existing files needs to be expanded
> to trigger this bug for regression testing.
> 
> Not sure if I can get to it this week but I will put it on my todo list
> in case noone else can pick this up.

For the record, this also happens with constructs such as:

nft add rule netdev efil edev ether type vlan meta protocol ip6 tcp 
dport 12345 counter

or

nft add rule netdev efil edev ether type vlan meta protocol ip tcp dport 
12345 counter

So if we e.g. wanted to catch a vlan packet with some specific payload. 
This will be simplified (during nft list ruleset) to just:

meta protocol ip6 tcp dport 12345 counter packets 0 bytes 0
meta protocol ip tcp dport 12345 counter packets 0 bytes 0

The rules will function correctly if added via add rule, but will 
analogously ignore the payload after reloading via -f

I'll add that variation to the bug report as well.