Re: bug: nft -n still shows "resolved" values for iif and oif

[Florian Westphal <fw@strlen.de>]

Christoph Anton Mitterer <calestyo@scientia.org> wrote:
> On Thu, 2025-09-25 at 16:42 +0200, Florian Westphal wrote:
> > Christoph Anton Mitterer <calestyo@scientia.org> wrote:
> > > IMO especially for iif/oif, which hardcode the iface ID rather than
> > > name, it would IMO be rather important to show the real value (that
> > > is
> > > the ID) and not the resolved one.
> > 
> > Seems like a bad idea.  Existing method will make
> > sure that if the device is renamed the output will change.
> 
> But AFAIU only when it's renamed, not when it's e.g. removed and then
> brought back?

Sure, only when renamed.  When you remove it raw value is shown
and it won't match anymore.

> I mean sometimes (admittedly rarely) I unload for example my wifi
> driver modules and reload them (when the driver or firmware got in a
> weird state and doesn't seem to recover).
> Then my wifi iface would get a new ID, wouldn't id?

Sure but why do you use iif with a interface that gets removed in
between?

> Maybe one could make iif/oif a special case... where the numeric value
> is written and in a comment "(current: <name>)"?

I find that even worse compared to new command line option and i don't
see what added value it would provide or what confusion it would avoid.

iif and iifname are not the same and people should not expect them to
be.

If you use iif, then you specifically ask to continue matching on rename
of the interface, whereas iifname would stop matching.

If you use iifname, then you ask to match when interfaces get brought up
and down dynamically, e.g. ppp/dialup or virtual vpn interfaces.

Really, just use iifname if in doubt.