[PATCH nft] tests: shell: use an unassigned protocol number in exclusive_start_cond

[PATCH nft] tests: shell: use an unassigned protocol number in exclusive_start_cond

[Avinash Duduskar]

nft renders nexthdr through getprotobynumber(), so the dump records whichever
name the host's /etc/protocols gives for the value. 0 is "ip" on Debian, which
carries the legacy alias ahead of hopopt, and "hopopt" where /etc/protocols is
generated from the IANA registry, which assigns only HOPOPT. The test fails
there, and the dump cannot be reloaded either, because getprotobyname("ip")
finds nothing.

200 is unassigned in both, so it prints numerically everywhere. 255 would not
do: Arch's iana-etc names it "reserved".

Signed-off-by: Avinash Duduskar <avinash.duduskar@gmail.com>
---
 .../parsing/dumps/exclusive_start_cond.json-nft        | 10 +++++-----
 .../testcases/parsing/dumps/exclusive_start_cond.nft   | 10 +++++-----
 tests/shell/testcases/parsing/exclusive_start_cond     |  6 +++---
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/tests/shell/testcases/parsing/dumps/exclusive_start_cond.json-nft b/tests/shell/testcases/parsing/dumps/exclusive_start_cond.json-nft
index a1fbaafd..35d6889a 100644
--- a/tests/shell/testcases/parsing/dumps/exclusive_start_cond.json-nft
+++ b/tests/shell/testcases/parsing/dumps/exclusive_start_cond.json-nft
@@ -2207,7 +2207,7 @@
                   "field": "nexthdr"
                 }
               },
-              "right": "ip"
+              "right": 200
             }
           }
         ]
@@ -2247,7 +2247,7 @@
                   "field": "nexthdr"
                 }
               },
-              "right": "ip"
+              "right": 200
             }
           }
         ]
@@ -2407,7 +2407,7 @@
                   "field": "nexthdr"
                 }
               },
-              "right": "ip"
+              "right": 200
             }
           }
         ]
@@ -2447,7 +2447,7 @@
                   "field": "nexthdr"
                 }
               },
-              "right": "ip"
+              "right": 200
             }
           }
         ]
@@ -2487,7 +2487,7 @@
                   "field": "nexthdr"
                 }
               },
-              "right": "ip"
+              "right": 200
             }
           }
         ]
diff --git a/tests/shell/testcases/parsing/dumps/exclusive_start_cond.nft b/tests/shell/testcases/parsing/dumps/exclusive_start_cond.nft
index 2b94feaa..5eb28085 100644
--- a/tests/shell/testcases/parsing/dumps/exclusive_start_cond.nft
+++ b/tests/shell/testcases/parsing/dumps/exclusive_start_cond.nft
@@ -94,14 +94,14 @@ table ip t {
 table ip6 t {
 	chain c {
 		meta l4proto tcp limit rate 1/second burst 5 packets ip6 saddr ::
-		meta l4proto tcp limit rate 1/second burst 5 packets hbh nexthdr ip
-		meta l4proto tcp limit rate 1/second burst 5 packets rt nexthdr ip
+		meta l4proto tcp limit rate 1/second burst 5 packets hbh nexthdr 200
+		meta l4proto tcp limit rate 1/second burst 5 packets rt nexthdr 200
 		meta l4proto tcp limit rate 1/second burst 5 packets srh last-entry 0
 		meta l4proto tcp limit rate 1/second burst 5 packets srh sid[1] ::
 		meta l4proto tcp limit rate 1/second burst 5 packets srh tag 0
-		meta l4proto tcp limit rate 1/second burst 5 packets frag nexthdr ip
-		meta l4proto tcp limit rate 1/second burst 5 packets dst nexthdr ip
-		meta l4proto tcp limit rate 1/second burst 5 packets mh nexthdr ip
+		meta l4proto tcp limit rate 1/second burst 5 packets frag nexthdr 200
+		meta l4proto tcp limit rate 1/second burst 5 packets dst nexthdr 200
+		meta l4proto tcp limit rate 1/second burst 5 packets mh nexthdr 200
 		meta l4proto tcp limit rate 1/second burst 5 packets exthdr hbh missing
 	}
 }
diff --git a/tests/shell/testcases/parsing/exclusive_start_cond b/tests/shell/testcases/parsing/exclusive_start_cond
index f769e7dd..8c359d93 100755
--- a/tests/shell/testcases/parsing/exclusive_start_cond
+++ b/tests/shell/testcases/parsing/exclusive_start_cond
@@ -70,9 +70,9 @@ stmts+=("sctp sport 0" "th sport 0")
 udp_stmts+=("vxlan vni 0" "geneve vni 0")
 stmts+=("gre flags 0" "gretap ip saddr 0")
 # exthdr_expr
-ip6_stmts+=("hbh nexthdr 0" "rt nexthdr 0" "rt0 addr[0] 0")
-ip6_stmts+=("rt2 addr ::" "srh tag 0" "frag nexthdr 0")
-ip6_stmts+=("dst nexthdr 0" "mh nexthdr 0" "exthdr hbh 0")
+ip6_stmts+=("hbh nexthdr 200" "rt nexthdr 200" "rt0 addr[0] 0")
+ip6_stmts+=("rt2 addr ::" "srh tag 0" "frag nexthdr 200")
+ip6_stmts+=("dst nexthdr 200" "mh nexthdr 200" "exthdr hbh 0")
 # meta_expr
 stmts+=("meta length 0" "mark 0" "iif 0" "iifname foo" "iiftype 0")
 stmts+=("oif 0" "oifname foo" "oiftype 0" "skuid 0" "skgid 0" "rtclassid 0")

base-commit: 49e418238ece947e92f87a35ef6cf50755485370
-- 
2.55.0

Re: [PATCH nft] tests: shell: use an unassigned protocol number in exclusive_start_cond

[Phil Sutter]

Hi Avinash,

On Sat, Aug 08, 2026 at 07:03:27AM +0530, Avinash Duduskar wrote:
> nft renders nexthdr through getprotobynumber(), so the dump records whichever
> name the host's /etc/protocols gives for the value. 0 is "ip" on Debian, which
> carries the legacy alias ahead of hopopt, and "hopopt" where /etc/protocols is
> generated from the IANA registry, which assigns only HOPOPT. The test fails
> there, and the dump cannot be reloaded either, because getprotobyname("ip")
> finds nothing.
> 
> 200 is unassigned in both, so it prints numerically everywhere. 255 would not
> do: Arch's iana-etc names it "reserved".

Instead of playing whack-a-mole, we should pass '--numeric-proto
--stateless' to nft calls just like py test suite does. Let me submit
patches for shell test suite so we have evidence for a discussion.

Cheers, Phil

Re: [PATCH nft] tests: shell: use an unassigned protocol number in exclusive_start_cond

[Avinash Duduskar]

On Thu, Aug 13, 2026 at 11:43:42AM +0200, Phil Sutter wrote:
> Instead of playing whack-a-mole, we should pass '--numeric-proto
> --stateless' to nft calls just like py test suite does. Let me submit
> patches for shell test suite so we have evidence for a discussion.

Your two patches fix it here: exclusive_start_cond passes on a stock
Arch /etc/protocols now, no legacy "ip" alias needed. Better than my
whack-a-mole, please drop my patch.

Thanks,
Avinash