Bug 1838355

Description of problem:

The documentation as per:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/securing_networks/getting-started-with-nftables_securing-networks

Says:

"Add a set named blacklist to the filter table:

# nft add set ip filter blacklist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }"

But that fails prior to RHEL8.2:

# nft add set ip filter blacklist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }
Error: syntax error, unexpected string, expecting constant or interval or timeout
add set ip filter blacklist { type ipv4_addr ; flags dynamic, timeout ; timeout 5m ; }

Version-Release number of selected component (if applicable):

RHEL8.0/8.1

# uname -r
4.18.0-147.5.1.el8_1.x86_64

# rpm -qa|grep nfta
nftables-0.9.0-14.el8.x86_64

How reproducible:

Always.

Steps to Reproduce:

On RHEL8.1:

# nft add set ip filter blacklist { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }
Error: syntax error, unexpected string, expecting constant or interval or timeout
add set ip filter blacklist { type ipv4_addr ; flags dynamic, timeout ; timeout 5m ; }

Actual results:

Customers expect the above nft command to succeed on all RHEL8 releases based on the current documentation. But the "dynamic flag" is not supported by the nftables prior to version nftables-0.9.3-12.el8 which ships with RHEL8.2.

Expected results:

Add a note to section 6.15. in:

https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/securing_networks/getting-started-with-nftables_securing-networks

Saying that the "dynamic" flag is only supported from RHEL8.2 onwards. Or if nftables is updated to nftables-0.9.3-12.el8 and greater on prior RHEL8 releases.