Bug / Error while adding Incus ACL to LXC instance using IncusOS with physical VLAN interface

IncusOS
,
1

I have the latest Incus OS version installed with the following network config:

incus admin os system network edit

config:
  interfaces:
  - addresses:
    - dhcp4
    - slaac
    hwaddr: <redacted>
    name: enp5s0
    roles:
    - management
    - storage
    - cluster
  - hwaddr: <redacted>
    name: eno1
    roles:
    - instances
    vlan_tags:
    - 1010
    - 111

Now I configure vlan 1010 for an instance (LXC) called “test” with:

 incus config device add test eth0 nic nictype=bridged parent=eno1 vlan=1010 name=eth0

This works perfectly, the instance gets an IP assigned from upstream router, network access works as expected :white_check_mark:

Now I try to assign an ACL (also named “test”) to the instance, which also works.

incus config device set test eth0 security.acls="test"

But when I start the instance, i get the following error :cross_mark:

incus start test

Error: Failed to start device "eth0": Failed adding bridge filter rules for instance device "test.eth0" (bridge): Failed apply nftables config: Failed to run: nft -f -: exit status 1 (/dev/stdin:31:37-45: Error: Could not resolve protocol name
	iifname "veth973461ff" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
	                                   ^^^^^^^^^
/dev/stdin:88:37-45: Error: Could not resolve protocol name
	iifname "veth973461ff" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
	                                   ^^^^^^^^^
/dev/stdin:90:37-45: Error: Could not resolve protocol name
	oifname "veth973461ff" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
	                                   ^^^^^^^^^
/dev/stdin:106:37-45: Error: Could not resolve protocol name
	oifname "veth973461ff" ip6 nexthdr ipv6-icmp icmpv6 type { nd-neighbor-solicit, nd-neighbor-advert } accept
	                                   ^^^^^^^^^)
Try `incus info --show-log test` for more info

Any idea what is going wrong?

2

Tracked it down to an IncusOS bug, will send a fix.

3