On Tue, Jul 23, 2019 at 03:27:52PM +0200, Phil Sutter wrote: > nft_meta_get_eval()'s tendency to bail out setting NFT_BREAK verdict in > situations where required data is missing leads to unexpected behaviour > with inverted checks like so: > > | meta iifname != eth0 accept > > This rule will never match if there is no input interface (or it is not > known) which is not intuitive and, what's worse, breaks consistency of > iptables-nft with iptables-legacy. > > Fix this by falling back to placing a value in dreg which never matches > (avoiding accidental matches), i.e. zero for interface index and an > empty string for interface name. Applied, thanks.
