[pkg-netfilter-team] Bug#914439: nftables: Unexpected behavior with 'Sets'

[Aiko Barz]

Package: nftables
Version: 0.7-1
Severity: normal

Dear Maintainer,

I have written a nftables script, which extensively uses Sets¹.

Unexpected: It does block an IPv6-network, which is part of the set. The network has been loaded into the "named set". I checked it with:
$ sudo nft list ruleset

So, I cannot connect to the host by doing "ssh -6" for example. The DENY is visible in dmesg.

The same script works as expected on a different host with Debian/Buster. As you can see below, I installed a backports kernel on this Debian/Stretch host. With the backports kernel the nftables script also works as expected. I can also make it work by removing some networks from the "named set". The named set currently contains ~2050 networks.

I can attach the script later. It is long but not very complex.

I personally can stick with the backports kernel or I can move to buster/sid as well.

But maybe, this information is useful to somebody else?

Kind regards,
Aiko

¹: https://wiki.nftables.org/wiki-nftables/index.php/Sets

-- System Information:
Debian Release: 9.6
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.18.0-0.bpo.1-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US, LC_CTYPE=en_US.utf8 (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8), LANGUAGE=en_US:en (charmap=UTF-8) (ignored: LC_ALL set to en_US.utf8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages nftables depends on:
ii  dpkg                 1.18.25
ii  init-system-helpers  1.48
ii  libc6                2.24-11+deb9u3
ii  libgmp10             2:6.1.2+dfsg-1
ii  libmnl0              1.0.4-2
ii  libnftnl4            1.0.7-1
ii  libreadline7         7.0-3
ii  libxtables12         1.6.0+snapshot20161117-6

nftables recommends no packages.

nftables suggests no packages.

-- no debconf information