[pkg-netfilter-team] Bug#970267: iptables: iptables-nft complains table is incompatible when ctstate rule is added via nft

[Alan Tu]

Package: iptables
Version: 1.8.5-3
Severity: normal

Steps: 
# nft flush ruleset
# iptables-nft -L
# iptables-nft -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
# iptables-nft -L
Result: as expected

# nft flush ruleset
# iptables-nft -L
# nft add rule ip filter INPUT ct state related,established counter accept
# iptables-nft -L
Output: iptables v1.8.5 (nf_tables): table 'filter' is incompatible, use 'nft' tool.

-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 5.8.0-1-amd64 (SMP w/4 CPU threads)
Kernel taint flags: TAINT_WARN, TAINT_CRAP, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages iptables depends on:
ii  libc6                    2.31-3
ii  libip4tc2                1.8.5-3
ii  libip6tc2                1.8.5-3
ii  libmnl0                  1.0.4-3
ii  libnetfilter-conntrack3  1.0.8-1
ii  libnfnetlink0            1.0.1-3+b1
ii  libnftnl11               1.1.7-1
ii  libxtables12             1.8.5-3
ii  netbase                  6.1

Versions of packages iptables recommends:
ii  nftables  0.9.6-1

Versions of packages iptables suggests:
pn  firewalld  <none>
ii  kmod       27+20200310-2

-- no debconf information