[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1396

--- Comment #3 from Pablo Neira Ayuso <pablo at netfilter.org> ---
# cat x
table ip ipv4table {
        map cluster-ip-services-set {
                type inet_proto . ipv4_addr . inet_service : verdict
        }

        chain k8s-nat-mark-masq {
                ip protocol . ip daddr . th sport vmap @cluster-ip-services-set
        }

        chain k8s-nat-do-mark-masq {
                meta mark set 0x00004000 return
        }
}

# nft -f x
# nft list ruleset
table ip ipv4table {
        map cluster-ip-services-set {
                type inet_proto . ipv4_addr . inet_service : verdict
        }

        chain k8s-nat-mark-masq {
                ip protocol . ip daddr . th sport vmap @cluster-ip-services-set
        }

        chain k8s-nat-do-mark-masq {
                meta mark set 0x00004000 return
        }
}

This works fine here.

I remember you are using the raw netlink interface.

What kind of netlink message is your software sending to the kernel?

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/69c0f1e9/attachment.html>