[Bug 1700] Flowtable - Bug on devices deinition

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1700

--- Comment #3 from nicolasfort1988 at gmail.com ---
So there's no correlation between 'devices' definition in flowtable, and
'iifname' in ruleset?

For example:
vyos at picopc# sudo nft list table ip vyos_filter
table ip vyos_filter {
    flowtable ft_test {
        hook ingress priority filter
        devices = { eth1, eth2 }
    }

    chain VYOS_FORWARD_filter {
        type filter hook forward priority filter; policy accept;
        iifname { "eth3", "eth4" } ip protocol udp counter packets 34409310
bytes 51613965000 flow add @ft_test
        meta l4proto { tcp, udp } counter packets 2111088123 bytes
3166632184500 accept comment "FWD-filter-10"
    }

    chain VYOS_INPUT_filter {
        type filter hook input priority filter; policy accept;
    }

    chain VYOS_OUTPUT_filter {
        type filter hook output priority filter; policy accept;
    }

    chain VYOS_FRAG_MARK {
        type filter hook prerouting priority -450; policy accept;
        ip frag-off & 16383 != 0 meta mark set 0x000ffff1 return
    }
}
[edit]
vyos at picopc# sudo conntrack -L | grep -c OFFLOAD
conntrack v1.4.6 (conntrack-tools): 1016 flow entries have been shown.


Seems like 'device' deifnition in flowtables is unnecessary, and what really
matters is interace mather in the rule.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20230822/6f222c8c/attachment.html>