Re: [nft PATCH] evaluate: Reject set stmt refs to sets without dynamic flag

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, May 03, 2023 at 12:50:22PM +0200, Phil Sutter wrote:
> This is a revert of commit 8d443adfcc8c1 ("evaluate: attempt to set_eval
> flag if dynamic updates requested"), implementing the alternative
> mentioned in the comment it added.
> 
> Reason is the inconsistent behaviour when applying the same ruleset
> twice: In the first call, the set lacking 'dynamic' flag does not exist
> and is therefore added to the cache. Consequently, both the 'add set'
> command and the set statement point at the same set object. In the
> second call, a set with same name exists already, so the object created
> for 'add set' command is not added to cache and consequently not updated
> with the missing flag. The kernel thus rejects the NEWSET request as the
> existing set differs from the new one.

# cat test.nft
flush ruleset

table ip test {
        set dlist {
                type ipv4_addr
                size 65535
        }

        chain output {
                type filter hook output priority filter; policy accept;
                udp dport 1234 update @dlist { ip daddr } counter packets 0 bytes 0
        }
}
# nft -f test.nft
# nft -f test.nft
# nft list ruleset
table ip test {
        set dlist {
                type ipv4_addr
                size 65535
                flags dynamic
        }

        chain output {
                type filter hook output priority filter; policy accept;
                udp dport 1234 update @dlist { ip daddr } counter packets 0 bytes 0
        }
}

What are the steps to reproduce this? Did I misunderstand?