Re: nft meter add behavior change post translate-to-sets change

[Pablo Neira Ayuso <pablo@netfilter.org>]

Hi Florian,

On Tue, Jan 21, 2025 at 03:00:11PM +0100, Florian Westphal wrote:
> TL;DR: since v1.1 meters work slightly different
> and re-add after flush won't work:
> 
> cat > repro.sh <<EOF
> NFT=src/nft
> 
> ip netns add N
> ip netns exec N $NFT add table filter
> ip netns exec N $NFT add chain filter input '{ type filter hook input priority 0 ; }'
> ip netns exec N $NFT add rule ip filter input tcp dport 80 meter http1 { tcp dport . ip saddr limit rate over 200/second } counter drop
> 
> ip netns exec N $NFT list meters
> 
> # This used to remove the anon set, but not anymore
> ip netns exec N $NFT flush chain filter input
>
> # This will now fail:
> ip netns exec N $NFT add rule ip filter input tcp dport 80 meter http1 { tcp dport . ip saddr limit rate over 200/second } counter drop

Ah, I can see what is going on here.

> ip netns del N
> EOF
> 
> This is caused by:
> b8f8ddff ("evaluate: translate meter into dynamic set")
> 
> Should the last rule in above example work or not?
> If it should I will turn the above into a formal test case and will
> work on a fix, from a quick glance it should be possible to
> handle the collision if the existing set has matching key length.

I think it should be possible to address this case by allowing the
meter statement to pick up an existing 'http1' set with the same key,
this requires to extend b8f8ddff to deal with this.