Re: bug: nft include with includedir path with globs loads files twice

[Jeremy Sowden <jeremy@azazel.net>]

[-- Attachment #1: Type: text/plain, Size: 1559 bytes --]

On 2025-09-24, at 22:23:11 +0200, Christoph Anton Mitterer wrote:
> Hey.
> 
> With:
>    # nft -v
>    nftables v1.1.5 (Commodore Bullmoose #6)
> from Debian sid which uses a default include dir of:
>    # nft -h | grep includepath
>      -I, --includepath <directory>   Add <directory> to the paths searched for include files. Default is: /etc
> 
> 
> And e.g.:
> /etc/nftables.conf
>    #!/usr/sbin/nft -f
>    
>    flush ruleset
>    
>    table inet filter {
>    	chain input {
>    		type filter hook input priority filter
>    		ct state {established,related} accept
>    	}
>    }
>    
>    include "nftables/rules.d/*.nft"
> 
> and:
> /etc/nftables/rules.d/x.nft:
>    table inet filter {
>            chain bla {
>                    type filter hook input priority filter
>                    ip daddr 1.1.1.1 drop
>            }
>    }
> and no other files in rules.d... nft seem to somehow include x.nft
> twice:
> 
> # nft -f /etc/nftables.conf; nft list ruleset
> table inet filter {
> 	chain input {
> 		type filter hook input priority filter; policy accept;
> 		ct state { established, related } accept
> 	}
> 
> 	chain bla {
> 		type filter hook input priority filter; policy accept;
> 		ip daddr 1.1.1.1 drop
> 		ip daddr 1.1.1.1 drop
> 	}
> }
> 
> If I change the include to "nftables/rules.d/x.nft" or to
> "/etc/nftables/rules.d/*.nft"... it works (i.e. only one ip daddr
> 1.1.1.1 drop).

There is a Debian bug report related to this:

  https://bugs.debian.org/1112512

J.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 931 bytes --]