ipset hash:ip,port not matching

[Michael Ludvig <mludvig@logix.net.nz>]

Hi

I'm struggling with ipset 6.11 on CentOS 6.4 (default package) where I
can't make it match on hash:ip,port sets.

My simple testcase is (on 172.31.170.102):

~ # ipset restore << _EOF_
create test-ipport hash:ip,port family inet hashsize 1024 maxelem 65536
add test-ipport 172.31.170.102,tcp:12345
add test-ipport 172.31.170.1,tcp:12345
_EOF_

~ # iptables -F
~ # iptables -I INPUT -m set --match-set test-ipport dst -j LOG
--log-prefix "IPSET(test-ipport,dst): "
~ # iptables -I INPUT -m set --match-set test-ipport src -j LOG
--log-prefix "IPSET(test-ipport,src): "

Then from my client 172.31.170.1 I run netcat:
~ # nc -p 12345 172.31.170.102 12345

On the target I can see the packets:

16:55:40.945624 IP 172.31.170.1.12345 > 172.31.170.102.12345: Flags [S],
seq 471135462, win 14600, options [mss 1460,sackOK,TS val 631328194 ecr
0,nop,wscale 7], length 0
16:55:40.945684 IP 172.31.170.102.12345 > 172.31.170.1.12345: Flags
[R.], seq 0, ack 471135463, win 0, length 0

But nothing is logged. Even if I change it to DROP any other target the
match still seems to be ignored.

With hash:ip it works but as soon as I use one of the port-hashes it fails.

What am I doing wrong?

Thanks

Michael