On Fri, 10 May 2024 18:41:47 +0200 Florian Westphal wrote:

quoted

What does that mean in lay terms?   

This nft version chokes on syntax, but I cannot reproduce this:
src/nft --check -f /dev/stdin <<EOF
add table t
add chain t c
reset rules t c
EOF
echo $?
table ip t {
	chain c { }
}
0
src/nft --version
nftables v1.0.9 (Old Doc Yak #3)

No idea :-(

I tried building both recent nftables.git and v1.0.9 tag and both
parse the test file for me :-(

Also. nft-flowtable.sh is still not working on nf infra even
with the updated version while that script works fine locally for me
as well, even with running via vng.

Maybe there is an old libnftables on the system that is used
instead for parsing?  Its bundled/installed with nftables, can
you check that ldd nft doesnt show some other distro-installed
version?  Other than that I have no idea what could be happening here.

Good call! The LD_LIBRARY_PATH was including things in wrong order.
I change that for the next run.

quoted

Question #2, for the ebtables test - do I need to build iptables?
I built nft with
	./configure --with-json --with-xtables   

You need to add --enable-nftables for ebtables-nft, or you need to
use the old ebtables tree, i.e.:
https://git.netfilter.org/ebtables/

both should work.

Picked the old tree. Let's see..