nftables rules not matching after upgrading from 0.7 to 0.8

["Anders K. Pedersen | Cohaesio" <akp@cohaesio.com>]

Hello,

After upgrading to nftables 0.8 (from 0.7) on one of my systems, I've
experiences several cases where rules that used to work fine with 0.7
sometimes doesn't match anymore with 0.8 (it's not consistent -
sometimes the rules do match with 0.8).

The rule chains end with a log statement before rejecting or dropping
the packets, and I can see in the log that everything is as expected
and the rules should match. After downgrading to nftables 0.7
everything works again.

I tried loading my rule set with "--debug=netlink" and diff the output
from 0.7 vs. 0.8. Apart from syntax differences the only thing that
changed is

 ip filter input 
-  [ payload load 1b @ network header + 9 => reg 1 ]
+  [ meta load l4proto => reg 1 ]

and

 ip6 filter input 
-  [ payload load 1b @ network header + 6 => reg 1 ]
+  [ meta load l4proto => reg 1 ]

for many of the rules. I believe this is intentional and correct by
itself, so I guess the problem is in the kernel (the system is
currently running 4.13.8), where "meta l4proto" sometimes isn't what it
should be.

Does this sound right and does it ring any bells?

Regards,
Anders K. Pedersen