On Mon, Jun 01, 2026 at 12:06:01AM +0200, Dion Bosschieter wrote:
Changes in v8: - Fix incompatibility issue with ebiptables driver for inet rules Inet rules in nftables are now placed on the root chains following iptables logic inside the ebiptables driver. Introducing subchains for inet caused sorting problems, subchains can accept or drop a packet which on the ebiptables driver inet rules would have been filtered out by rules that were sorted differently.
Something about this change appears to have resulted in duplicate rules for arp being added when I run the TCK test suite for MR 79. In this case: https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/79/diffs#70796ffc376... #nft list chain bridge libvirt_nwfilter_ethernet vnet0-out table bridge libvirt_nwfilter_ethernet { chain vnet0-out { jump vnet0-mac-out ether type ip jump vnet0-ipv4-ip-out ether type ip accept ether type arp jump vnet0-arp-mac-out ether type arp jump vnet0-arp-ip-out ether type arp accept ether type 0x8035 jump vnet0-rarp-out ether type arp accept ether type 0x0835 accept drop } } 'ether type arp accept' is twice. In the v7 patches the second instance was not there. separately, a pre-existing thing from previous versions: https://gitlab.com/libvirt/libvirt-tck/-/merge_requests/79/diffs?file=a03f2a... table bridge libvirt_nwfilter_ethernet { chain vnet0-out { ether saddr 01:02:03:04:05:06 ether type arp accept ether saddr 01:02:03:04:05:06 ether type arp drop ether saddr 01:02:03:04:05:06 ether type arp drop } } the 'ether type arp drop' rule is present twice. Obviously both of those things are harmless as the second instance of the rule will never be reached. So this is more of an oddity - I raise it in case it is a symptom of a more problematic bug we might have missed ? With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|