From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BD16C433F5 for ; Mon, 10 Jan 2022 15:28:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236170AbiAJP2X (ORCPT ); Mon, 10 Jan 2022 10:28:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236159AbiAJP2X (ORCPT ); Mon, 10 Jan 2022 10:28:23 -0500 Received: from Chamillionaire.breakpoint.cc (Chamillionaire.breakpoint.cc [IPv6:2a0a:51c0:0:12e:520::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CBAF1C06173F for ; Mon, 10 Jan 2022 07:28:22 -0800 (PST) Received: from fw by Chamillionaire.breakpoint.cc with local (Exim 4.92) (envelope-from ) id 1n6waq-0008Rx-2H for netfilter-devel@vger.kernel.org; Mon, 10 Jan 2022 16:28:20 +0100 Date: Mon, 10 Jan 2022 16:28:20 +0100 From: Florian Westphal To: netfilter-devel Subject: nft -f fails to restore ruleset listing with cetain dynamic set types Message-ID: <20220110152820.GE317@breakpoint.cc> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.10.1 (2018-07-13) Precedence: bulk List-ID: X-Mailing-List: netfilter-devel@vger.kernel.org I was given this reproducer: ---------------- #!/bin/bash -x nft flush ruleset nft add table ip filter nft add chain ip filter output { type filter hook output priority 0 \; } nft add set ip filter black-list '{type ipv4_addr; flags dynamic; }' nft add rule ip filter output oifname lo meta l4proto udp update @black-list { ip daddr } counter nft list ruleset |tee ruleset nft -f ruleset # success nft flush ruleset nft list ruleset sleep 1 nft -f ruleset # failed ----------- The ruleset generated by 'nft list ruleset' cannot be restored. Ruleset looks like this: table ip filter { set black-list { type ipv4_addr size 65535 } chain output { type filter hook output priority filter; policy accept; oifname "lo" meta l4proto udp update @black-list { ip daddr } counter packets 0 bytes 0 } } Reason for the failure on restore is that the set is created with 'size 65536' but no 'dynamic' flag. This causes a failure because the kernel picks the 'hash' set that lacks the update() function. The initial commands work because lack of 'size' picks the rhash backend, so the ->update works since the check for the timeout flag was removed in commit "netfilter: nft_dynset: relax superfluous check on set updates". First restore works because the set is not created anew, so this is still 'rhash' backend. Second restore fails because 'hash' is chosen. Workaround is to edit the ruleset file to add 'flags dynamic' or 'flags timeout', or both. Any suggestions on how to fix this? I am tempted to axe all hash backends except rbtree, rhash and pipapo, this internal autopick logic is super confusing to end users and even as developer I can't even see what the kernel did without perf probes or printk mangling :/