meta templates are only there for ease of use (input/parsing). When listing, they should be ignored: set s4 { typeof ip version elements = { 1, } } chain c4 { ip version @s4 accept } gets listed as 'ip l4proto ...' which is nonsensical. after this patch we get: in: ip version @s4 out: (@nh,0,8 & 0xf0) >> 4 == @s4 .. which is (marginally) better. Next patch adds support for payload decoding. Signed-off-by: Florian Westphal <fw@xxxxxxxxx> --- src/payload.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/payload.c b/src/payload.c index d9e0d4254f19..79008762825f 100644 --- a/src/payload.c +++ b/src/payload.c @@ -811,6 +811,9 @@ void payload_expr_complete(struct expr *expr, const struct proto_ctx *ctx) tmpl->len != expr->len) continue; + if (tmpl->meta_key && i == 0) + continue; + if (tmpl->icmp_dep && ctx->th_dep.icmp.type && ctx->th_dep.icmp.type != icmp_dep_to_type(tmpl->icmp_dep)) continue; -- 2.32.0