Re: nftables rules not matching after upgrading from 0.7 to 0.8

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Thu, Oct 26, 2017 at 12:45:36AM +0200, Florian Westphal wrote:
> Anders K. Pedersen | Cohaesio <akp@cohaesio.com> wrote:
> > On ons, 2017-10-25 at 20:20 +0200, Anders K. Pedersen | Cohaesio wrote:
> > > On ons, 2017-10-25 at 19:57 +0200, Florian Westphal wrote:
> > > > Anders K. Pedersen | Cohaesio <akp@cohaesio.com> wrote:
[...]
> > > As mentioned, it's not consistent. A rule that has worked fine could
> > > suddenly stop working without any rule set changes for days. Some
> > > times
> > > it has helped to just reload the exact same rule set. Other times
> > > changing
> > > 
> > > tcp dport { imap2, imaps } flow table imap \
> > >                 { ip saddr & 255.255.255.240 \
> > >                   timeout 5m limit rate 10/minute } \
> > >         counter accept
> > > 
> > > to
> > > 
> > > tcp dport { imap2, imaps } flow table imap \
> > >         counter accept
> > > 
> > > or
> > > 
> > > tcp dport { domain, http, https, 8080, 8443, 9091 } \
> > >         meta iif eth1 accept
> > > 
> > > to
> > > 
> > > tcp dport { domain, http, https, 8080, 8443, 9091 } \
> > >         meta iif eth1 counter accept
> > > 
> > > has resolved it, but it feels like it wasn't really due to the
> > > changes,
> > > but more random luck.
> 
> note that sets are broken with 16bit elements at the moment in 4.13, see
> 
> https://patchwork.ozlabs.org/patch/821080/
> or
> https://patchwork.ozlabs.org/patch/830236/

JFYI, the fix for sets is now in nf.git.

https://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf.git/commit/

I swear this was included in the previous batch, but it was not. Sorry
about this. Will send this upstream asap.