netfilter buglog - Feb 2017 - [Bug 1118] New: nft: nft -f and nft list ruleset use different sets of service -> port mappings

https://bugzilla.netfilter.org/show_bug.cgi?id=1118

            Bug ID: 1118
           Summary: nft: nft -f and nft list ruleset use different sets of
                    service -> port mappings
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: joakim.nohlgard at eistec.se

Commit ccc5da470e76032f8e175920553516835efb30f1
(http://git.netfilter.org/nftables/commit/?id=ccc5da470e76032f8e175920553516835efb30f1)
introduced the services.c file which maps port numbers to symbolic service
names as a hard-coded table instead of going through the system services list
in /etc/services.
The restore functionality, on the other hand, still uses the /etc/services list
to convert the service names back to port numbers when loading a configuration
through nft -f <config file>. This can therefore cause problems if the
service
list in /etc/services does not match what is hard-coded in the nft binary.

For example, the Dropbox LAN sync service (db-lsp) on 17500/tcp is found in
services.c, but not in the system default /etc/services on an up-to-date
(2017-02-06) Gentoo installation, resulting in a broken configuration when
using nft list ruleset to generate the file.
It will also cause inconsistent state if any of the default ports were modified
in a system configuration and the configuration generated by nft list ruleset
is restored.

There is a trivial work-around: Add all missing services to the /etc/services
file and never change any port numbers.
However, it is unintuitive and inconsistent to have the load and the
"save"
functionality use different sets of service names. I use "save" within
quotes
because I don't know whether nft list ruleset is meant to use as a backup
functionality, but at least that is how it is used in practice on at least
Gentoo with systemd, possibly more systems.

The error message when a service is missing in /etc/services is:

/var/lib/nftables/rules-save:19:29-34: Error: Could not resolve service:
                 tcp dport { db-lsp} counter packets 0 bytes 0 accept
                             ^^^^^^

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170206/04016901/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1118

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |elise.lennion at gmail.com

--- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> ---
The restore should use the internal service table.

Cc'ing Elise.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170206/6a44e545/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1118

--- Comment #2 from Elise Lennion <elise.lennion at gmail.com> ---
This patch makes the restore use the internal service table.

http://patchwork.ozlabs.org/patch/724576/

With it, list and load a ruleset should be compatible.

Thank you.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170206/c5a8efb3/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1118

Shyam Saini <mayhs11saini at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mayhs11saini at gmail.com

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170310/77b52688/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1118

Shyam Saini <mayhs11saini at gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170310/c28d393c/attachment.html>