On Fri, Jan 09, 2015 at 12:36:41PM +0000, Andreas Schultz wrote:
> Hi,
> 
> A few xt targets do check that the match condition is correct for them.
> xt_TCPMSS is one of them. Since nft_compat does not (and probably can
> not) pass the match condition into the target check, the target check
> will fail.
> 
> So all xt targets that perform checks on their match conditions are
> unusable with nft_compat.
> 
> Is this expected behavior or a bug?

It's known issue, see:

http://www.spinics.net/lists/netfilter-devel/msg23831.html

But we already resolved the problem for all of the extensions that
that email indicates.

The only two affected extensions so far I can track on the tree are
TCPMSS and CLUSTERIP.

CLUSTERIP is supersedes by xt_cluster, and it's known to have problems
with dynamic interfaces.

TCPMSS would be good to have access to it from nft_compat.

I'm attaching an untested patch to address this.