Re: "AVX2-based lookup implementation" has broken ebtables --among-src

[Stefano Brivio <sbrivio@redhat.com>]

[Adding netfilter-devel]

Hi Nikita,

On Tue, 16 Nov 2021 11:51:01 +0300
Nikita Yushchenko <nikita.yushchenko@virtuozzo.com> wrote:

> Hello Stefano.
> 
> I've found that nftables rule added by
> 
> # ebtables -A INPUT --among-src 8:0:27:40:f7:9=192.168.56.10 -j log
> 
> does not match packets on kernel 5.14 and on current mainline.
> Although it matched correctly on kernel 4.18
> 
> I've bisected this issue. It was introduced by your commit 7400b063969b ("nft_set_pipapo: Introduce 
> AVX2-based lookup implementation") from 5.7 development cycle.
> 
> The nftables rule created by the above command uses concatenation:
> 
> # nft list chain bridge filter INPUT
> table bridge filter {
>          chain INPUT {
>                  type filter hook input priority filter; policy accept;
>                  ether saddr . ip saddr { 08:00:27:40:f7:09 . 192.168.56.10 } counter packets 0 bytes 0 
> log level notice flags ether
>          }
> }
> 
> Looks like the AVX2-based lookup does not process this correctly.

Thanks for bisecting and reporting this! I'm looking into it now, I
might be a bit slow as I'm currently traveling.

If you need a quick workaround, by the way, defining a "ether . ip"
set without the 'interval' flag and using a reference to it from the
nft rule will cause a switch to the nft_hash back-end (which presumably
doesn't have the same issue), see also:

	https://wiki.nftables.org/wiki-nftables/index.php/Portal:DeveloperDocs/set_internals

-- 
Stefano