On Tue, Jul 23, 2019 at 03:27:52PM +0200, Phil Sutter wrote: > nft_meta_get_eval()'s tendency to bail out setting NFT_BREAK verdict in > situations where required data is missing leads to unexpected behaviour > with inverted checks like so: > > | meta iifname != eth0 accept > > This rule will never match if there is no input interface (or it is not > known) which is not intuitive and, what's worse, breaks consistency of > iptables-nft with iptables-legacy. > > Fix this by falling back to placing a value in dreg which never matches > (avoiding accidental matches), i.e. zero for interface index and an > empty string for interface name. > --- > Changes since v1: > - Apply same fix to net/bridge/netfilter/nft_meta_bridge.c as well. > > Changes since v2: > - Limit this fix to address only expressions returning an interface > index or name. As Florian correctly criticized, these changes may be > problematic as they tend to change nftables' behaviour. Hence fix only > the cases needed to establish iptables-nft compatibility. This leaves things in an inconsistent situation. What's the concern here? Matching iifgroup/oifgroup from the wrong packet path?
