Hello, On Mon, Jul 10, 2023 at 8:05 PM Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> wrote: > > On Mon, Jul 10, 2023 at 08:03:04PM +0200, Pablo Neira Ayuso wrote: > > Hi, > > > > On Mon, Jul 10, 2023 at 04:41:27PM +0200, Igor Raits wrote: > > > Hello Florian, > > > > > > On Mon, Jul 10, 2023 at 2:49 PM Florian Westphal <fw@xxxxxxxxx> wrote: > > > > > > > > Florian Westphal <fw@xxxxxxxxx> wrote: > > > > > Igor Raits <igor@xxxxxxxxxxxx> wrote: > > > > > > Hello, > > > > > > > > > > > > We started to observe the issue regarding ebtables-nft and how it > > > > > > can't wipe rules when specifying full rule. Removing the rule by index > > > > > > works fine, though. Also with kernel 6.1.y it works completely fine. > > > > > > > > > > > > I've started with 1.8.8 provided in CentOS Stream 9, then tried the > > > > > > latest git version and all behave exactly the same. See the behavior > > > > > > below. As you can see, simple DROP works, but more complex one do not. > > > > > > > > > > > > As bugzilla requires some special sign-up procedure, apologize for > > > > > > reporting it directly here in the ML. > > > > > > > > > > Thanks for the report, I'll look into it later today. > > > > > > > > Its a bug in ebtables-nft, it fails to delete the rule since > > > > > > > > 938154b93be8cd611ddfd7bafc1849f3c4355201, > > > > netfilter: nf_tables: reject unbound anonymous set before commit phase > > > > > > > > But its possible do remove the rule via > > > > nft delete rule .. handle $x > > > > > > > > so the breakge is limited to ebtables-nft. > > > > > > Thanks for confirmation and additional information regarding where > > > exactly the issue was introduced. > > > The ebtables-nft (well, ebtables in general) is heavily used by the > > > OpenStack Neutron (in linuxbridge mode), so this breaks our setup > > > quite a bit. Would you recommend to revert kernel change or would you > > > have the actual fix soon (ebtables-nft or kernel)? > > > > Just to make sure this bug is not caused by something else. > > > > Could you cherry-pick this kernel patch? It is currently missing 6.1.38: > > > > commit 3e70489721b6c870252c9082c496703677240f53 > > Author: Pablo Neira Ayuso <pablo@xxxxxxxxxxxxx> > > Date: Mon Jun 26 00:42:18 2023 +0200 > > > > netfilter: nf_tables: unbind non-anonymous set if rule construction fails > > > > Otherwise a dangling reference to a rule object that is gone remains > > in the set binding list. > > > > I have requested included to -stable already. > > Oh wait, you mentioned this works fine for you with 6.1.x. I should have mentioned that we've tested 6.1.32 where it worked and my colleague has tested 6.1.38 today where it is broken.
