bugzilla-daemon at netfilter.org
2020-Jan-07 14:33 UTC
[Bug 1396] New: When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396 Bug ID: 1396 Summary: When rule with 3 concat elements are added, nft list shows only 2 Product: nftables Version: unspecified Hardware: All OS: All Status: NEW Severity: critical Priority: P5 Component: nft Assignee: pablo at netfilter.org Reporter: sbezverk at cisco.com table ip ipv4table { map cluster-ip-services-set { type inet_proto . ipv4_addr . inet_service : verdict } chain k8s-nat-mark-masq { ip protocol . ip daddr vmap @cluster-ip-services-set } chain k8s-nat-do-mark-masq { meta mark set 0x00004000 return } } the command to add rule to k8s-nat-mark-masq chain is: sudo nft add rule ipv4table k8s-nat-mark-masq ip protocol . ip daddr . th dport vmap @cluster-ip-services-set It does not fail but sudo nft list table ipv4table shows incorrect rule. nft -version nftables v0.9.3 (Topsy) Debug output: ip ipv4table k8s-nat-mark-masq [ payload load 1b @ network header + 9 => reg 1 ] [ payload load 4b @ network header + 16 => reg 9 ] [ payload load 2b @ transport header + 2 => reg 10 ] [ lookup reg 1 set cluster-ip-services-set dreg 0 ] ---------------- ------------------ | 0000000020 | | message length | | 00016 | R--- | | type | flags | | 0000000000 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 00 00 0a 00 | | extra header | ---------------- ------------------ ---------------- ------------------ | 0000000292 | | message length | | 02566 | R--- | | type | flags | | 0000000001 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 02 00 00 00 | | extra header | |00014|--|00001| |len |flags| type| | 69 70 76 34 | | data | i p v 4 | 74 61 62 6c | | data | t a b l | 65 00 00 00 | | data | e |00022|--|00002| |len |flags| type| | 6b 38 73 2d | | data | k 8 s - | 6e 61 74 2d | | data | n a t - | 6d 61 72 6b | | data | m a r k | 2d 6d 61 73 | | data | - m a s | 71 00 00 00 | | data | q |00232|N-|00004| |len |flags| type| |00052|N-|00001| |len |flags| type| |00012|--|00001| |len |flags| type| | 70 61 79 6c | | data | p a y l | 6f 61 64 00 | | data | o a d |00036|N-|00002| |len |flags| type| |00008|--|00001| |len |flags| type| | 00 00 00 01 | | data | |00008|--|00002| |len |flags| type| | 00 00 00 01 | | data | |00008|--|00003| |len |flags| type| | 00 00 00 09 | | data | |00008|--|00004| |len |flags| type| | 00 00 00 01 | | data | |00052|N-|00001| |len |flags| type| |00012|--|00001| |len |flags| type| | 70 61 79 6c | | data | p a y l | 6f 61 64 00 | | data | o a d |00036|N-|00002| |len |flags| type| |00008|--|00001| |len |flags| type| | 00 00 00 09 | | data | |00008|--|00002| |len |flags| type| | 00 00 00 01 | | data | |00008|--|00003| |len |flags| type| | 00 00 00 10 | | data | |00008|--|00004| |len |flags| type| | 00 00 00 04 | | data | |00052|N-|00001| |len |flags| type| |00012|--|00001| |len |flags| type| | 70 61 79 6c | | data | p a y l | 6f 61 64 00 | | data | o a d |00036|N-|00002| |len |flags| type| |00008|--|00001| |len |flags| type| | 00 00 00 0a | | data | |00008|--|00002| |len |flags| type| | 00 00 00 02 | | data | |00008|--|00003| |len |flags| type| | 00 00 00 02 | | data | |00008|--|00004| |len |flags| type| | 00 00 00 02 | | data | |00072|N-|00001| |len |flags| type| |00011|--|00001| |len |flags| type| | 6c 6f 6f 6b | | data | l o o k | 75 70 00 00 | | data | u p |00056|N-|00002| |len |flags| type| |00008|--|00002| |len |flags| type| | 00 00 00 01 | | data | |00008|--|00003| |len |flags| type| | 00 00 00 00 | | data | |00028|--|00001| |len |flags| type| | 63 6c 75 73 | | data | c l u s | 74 65 72 2d | | data | t e r - | 69 70 2d 73 | | data | i p - s | 65 72 76 69 | | data | e r v i | 63 65 73 2d | | data | c e s - | 73 65 74 00 | | data | s e t |00008|--|00004| |len |flags| type| | 00 00 00 01 | | data | ---------------- ------------------ ---------------- ------------------ | 0000000020 | | message length | | 00017 | R--- | | type | flags | | 0000000002 | | sequence number| | 0000000000 | | port ID | ---------------- ------------------ | 00 00 0a 00 | | extra header | ---------------- ------------------ -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200107/69a66fbb/attachment.html>
bugzilla-daemon at netfilter.org
2020-Jan-10 10:29 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396 --- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> --- (In reply to Serguei Bezverkhi from comment #0)> table ip ipv4table { > map cluster-ip-services-set { > type inet_proto . ipv4_addr . inet_service : verdict > } > > > chain k8s-nat-mark-masq { > ip protocol . ip daddr vmap @cluster-ip-services-setNot correct. ip protocol . ip daddr . th dport vmap @cluster-ip-services-set or ip protocol . ip daddr . th dport vmap @cluster-ip-services-set> } > > chain k8s-nat-do-mark-masq { > meta mark set 0x00004000 return > } > }/home/sparky/x.nft:7:37-60: Error: datatype mismatch, map expects concatenation of (Internet protocol, IPv4 address, internet network service), mapping expression has type concatenation of (Internet protocol, IPv4 address) ip protocol . ip daddr vmap @cluster-ip-services-set ~~~~~~~~~~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^> the command to add rule to k8s-nat-mark-masq chain is: > > sudo nft add rule ipv4table k8s-nat-mark-masq ip protocol . ip daddr . th > dport vmap @cluster-ip-services-set > > It does not fail but sudo nft list table ipv4table shows incorrect rule. > > nft -version > nftables v0.9.3 (Topsy) > > > Debug output: > ip ipv4table k8s-nat-mark-masq > [ payload load 1b @ network header + 9 => reg 1 ] > [ payload load 4b @ network header + 16 => reg 9 ] > [ payload load 2b @ transport header + 2 => reg 10 ] > [ lookup reg 1 set cluster-ip-services-set dreg 0 ] > > ---------------- ------------------ > | 0000000020 | | message length | > | 00016 | R--- | | type | flags | > | 0000000000 | | sequence number| > | 0000000000 | | port ID | > ---------------- ------------------ > | 00 00 0a 00 | | extra header | > ---------------- ------------------ > ---------------- ------------------ > | 0000000292 | | message length | > | 02566 | R--- | | type | flags | > | 0000000001 | | sequence number| > | 0000000000 | | port ID | > ---------------- ------------------ > | 02 00 00 00 | | extra header | > |00014|--|00001| |len |flags| type| > | 69 70 76 34 | | data | i p v 4 > | 74 61 62 6c | | data | t a b l > | 65 00 00 00 | | data | e > |00022|--|00002| |len |flags| type| > | 6b 38 73 2d | | data | k 8 s - > | 6e 61 74 2d | | data | n a t - > | 6d 61 72 6b | | data | m a r k > | 2d 6d 61 73 | | data | - m a s > | 71 00 00 00 | | data | q > |00232|N-|00004| |len |flags| type| > |00052|N-|00001| |len |flags| type| > |00012|--|00001| |len |flags| type| > | 70 61 79 6c | | data | p a y l > | 6f 61 64 00 | | data | o a d > |00036|N-|00002| |len |flags| type| > |00008|--|00001| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00002| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 09 | | data | > |00008|--|00004| |len |flags| type| > | 00 00 00 01 | | data | > |00052|N-|00001| |len |flags| type| > |00012|--|00001| |len |flags| type| > | 70 61 79 6c | | data | p a y l > | 6f 61 64 00 | | data | o a d > |00036|N-|00002| |len |flags| type| > |00008|--|00001| |len |flags| type| > | 00 00 00 09 | | data | > |00008|--|00002| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 10 | | data | > |00008|--|00004| |len |flags| type| > | 00 00 00 04 | | data | > |00052|N-|00001| |len |flags| type| > |00012|--|00001| |len |flags| type| > | 70 61 79 6c | | data | p a y l > | 6f 61 64 00 | | data | o a d > |00036|N-|00002| |len |flags| type| > |00008|--|00001| |len |flags| type| > | 00 00 00 0a | | data | > |00008|--|00002| |len |flags| type| > | 00 00 00 02 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 02 | | data | > |00008|--|00004| |len |flags| type| > | 00 00 00 02 | | data | > |00072|N-|00001| |len |flags| type| > |00011|--|00001| |len |flags| type| > | 6c 6f 6f 6b | | data | l o o k > | 75 70 00 00 | | data | u p > |00056|N-|00002| |len |flags| type| > |00008|--|00002| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 00 | | data | > |00028|--|00001| |len |flags| type| > | 63 6c 75 73 | | data | c l u s > | 74 65 72 2d | | data | t e r - > | 69 70 2d 73 | | data | i p - s > | 65 72 76 69 | | data | e r v i > | 63 65 73 2d | | data | c e s - > | 73 65 74 00 | | data | s e t > |00008|--|00004| |len |flags| type| > | 00 00 00 01 | | data | > ---------------- ------------------ > ---------------- ------------------ > | 0000000020 | | message length | > | 00017 | R--- | | type | flags | > | 0000000002 | | sequence number| > | 0000000000 | | port ID | > ---------------- ------------------ > | 00 00 0a 00 | | extra header | > ---------------- -------------------- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/681afbd1/attachment.html>
bugzilla-daemon at netfilter.org
2020-Jan-10 10:31 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396 Pablo Neira Ayuso <pablo at netfilter.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |ASSIGNED --- Comment #2 from Pablo Neira Ayuso <pablo at netfilter.org> --- (In reply to Serguei Bezverkhi from comment #0)> table ip ipv4table { > map cluster-ip-services-set { > type inet_proto . ipv4_addr . inet_service : verdict > } > > > chain k8s-nat-mark-masq { > ip protocol . ip daddr vmap @cluster-ip-services-set > } > > chain k8s-nat-do-mark-masq { > meta mark set 0x00004000 return > } > }This definition above fails to load: /tmp/m:7:37-60: Error: datatype mismatch, map expects concatenation of (Internet protocol, IPv4 address, internet network service), mapping expression has type concatenation of (Internet protocol, IPv4 address) ip protocol . ip daddr vmap @cluster-ip-services-set ~~~~~~~~~~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^ Because one member of the concatenation is missing. -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/bc16c77e/attachment.html>
bugzilla-daemon at netfilter.org
2020-Jan-10 10:39 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396 --- Comment #3 from Pablo Neira Ayuso <pablo at netfilter.org> --- # cat x table ip ipv4table { map cluster-ip-services-set { type inet_proto . ipv4_addr . inet_service : verdict } chain k8s-nat-mark-masq { ip protocol . ip daddr . th sport vmap @cluster-ip-services-set } chain k8s-nat-do-mark-masq { meta mark set 0x00004000 return } } # nft -f x # nft list ruleset table ip ipv4table { map cluster-ip-services-set { type inet_proto . ipv4_addr . inet_service : verdict } chain k8s-nat-mark-masq { ip protocol . ip daddr . th sport vmap @cluster-ip-services-set } chain k8s-nat-do-mark-masq { meta mark set 0x00004000 return } } This works fine here. I remember you are using the raw netlink interface. What kind of netlink message is your software sending to the kernel? -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/69c0f1e9/attachment.html>
bugzilla-daemon at netfilter.org
2020-Apr-15 22:17 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396 Pablo Neira Ayuso <pablo at netfilter.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |WORKSFORME Status|ASSIGNED |RESOLVED -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200415/4c81dfc5/attachment.html>