Re: bug: nft include with includedir path with globs loads files twice

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Sep 25, 2025 at 09:00:05PM +0100, Jeremy Sowden wrote:
> On 2025-09-24, at 22:23:11 +0200, Christoph Anton Mitterer wrote:
> > Hey.
> > 
> > With:
> >    # nft -v
> >    nftables v1.1.5 (Commodore Bullmoose #6)
> > from Debian sid which uses a default include dir of:
> >    # nft -h | grep includepath
> >      -I, --includepath <directory>   Add <directory> to the paths searched for include files. Default is: /etc
> > 
> > 
> > And e.g.:
> > /etc/nftables.conf
> >    #!/usr/sbin/nft -f
> >    
> >    flush ruleset
> >    
> >    table inet filter {
> >    	chain input {
> >    		type filter hook input priority filter
> >    		ct state {established,related} accept
> >    	}
> >    }
> >    
> >    include "nftables/rules.d/*.nft"
> > 
> > and:
> > /etc/nftables/rules.d/x.nft:
> >    table inet filter {
> >            chain bla {
> >                    type filter hook input priority filter
> >                    ip daddr 1.1.1.1 drop
> >            }
> >    }
> > and no other files in rules.d... nft seem to somehow include x.nft
> > twice:
> > 
> > # nft -f /etc/nftables.conf; nft list ruleset
> > table inet filter {
> > 	chain input {
> > 		type filter hook input priority filter; policy accept;
> > 		ct state { established, related } accept
> > 	}
> > 
> > 	chain bla {
> > 		type filter hook input priority filter; policy accept;
> > 		ip daddr 1.1.1.1 drop
> > 		ip daddr 1.1.1.1 drop
> > 	}
> > }
> > 
> > If I change the include to "nftables/rules.d/x.nft" or to
> > "/etc/nftables/rules.d/*.nft"... it works (i.e. only one ip daddr
> > 1.1.1.1 drop).
> 
> There is a Debian bug report related to this:
> 
>   https://bugs.debian.org/1112512

For the record:

https://git.netfilter.org/nftables/commit/?id=3af59817b8d3994d52db0f1aa5dabeebc84dae45