Re: ebtables-nft can't delete complex rules by specifying complete rule with kernel 6.3+

[Florian Westphal <fw@strlen.de>]

Florian Westphal <fw@strlen.de> wrote:
> Igor Raits <igor@gooddata.com> wrote:
> > Hello,
> > 
> > We started to observe the issue regarding ebtables-nft and how it
> > can't wipe rules when specifying full rule. Removing the rule by index
> > works fine, though. Also with kernel 6.1.y it works completely fine.
> > 
> > I've started with 1.8.8 provided in CentOS Stream 9, then tried the
> > latest git version and all behave exactly the same. See the behavior
> > below. As you can see, simple DROP works, but more complex one do not.
> > 
> > As bugzilla requires some special sign-up procedure, apologize for
> > reporting it directly here in the ML.
> 
> Thanks for the report, I'll look into it later today.

Its a bug in ebtables-nft, it fails to delete the rule since

938154b93be8cd611ddfd7bafc1849f3c4355201,
netfilter: nf_tables: reject unbound anonymous set before commit phase

But its possible do remove the rule via
nft delete rule .. handle $x

so the breakge is limited to ebtables-nft.