netfilter buglog - Jan 2020 - [Bug 1395] New: Add element fails with Error: Could not process rule: Invalid argument

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

            Bug ID: 1395
           Summary: Add element fails with Error: Could not process rule:
                    Invalid argument
           Product: nftables
           Version: unspecified
          Hardware: All
                OS: All
            Status: NEW
          Severity: critical
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: sbezverk at cisco.com

Here is defined vmap:
        table ip ipv4table {
            map no-endpoints-services {
                type inet_proto . ipv4_addr . inet_service : verdict
            }

When I try to add an element to the vmap I get an error:
```
  sudo nft --debug all add element ipv4table no-endpoints-services  { tcp .
192.168.80.104 . 8989 : goto do_reject }

    Error: Could not process rule: Invalid argument
    add element ipv4table no-endpoints-services { tcp . 192.168.80.104 . 8989 :
goto do_reject }
   
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
```

nft -version
nftables v0.9.3 (Topsy)

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200106/e72e11a0/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

Serguei Bezverkhi <sbezverk at cisco.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sbezverk at cisco.com

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200107/60b80937/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

Serguei Bezverkhi <sbezverk at cisco.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |phil at nwl.cc

--- Comment #1 from Serguei Bezverkhi <sbezverk at cisco.com> ---
Tried with the latest kernel, see the same issue

Linux dev-ubuntu-1 5.4.10-050410-generic #202001091038 SMP Thu Jan 9 10:41:11
UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200109/7acbb8f9/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #2 from Pablo Neira Ayuso <pablo at netfilter.org> ---
I cannot reproduce this.

table ip ipv4table {
        chain do_reject {
        }
        map no-endpoints-services {
                type inet_proto . ipv4_addr . inet_service : verdict
        }
}

Then I follow up with:

nft add element ipv4table no-endpoints-services { tcp . 192.168.80.104 . 8989 :
goto do_reject }

and it works fine.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/bd404868/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

--- Comment #3 from Phil Sutter <phil at nwl.cc> ---
Same here, works fine with (more or less) recent nf kernel.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/2039b2ab/attachment-0001.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

--- Comment #4 from Serguei Bezverkhi <sbezverk at cisco.com> ---
I do not know what to say, the same set of commands does not work on my side. I
tried on both 5.3.0 and 5.4.10 kernels. 
I get the same error from the netlink when I use API to talk directly to
netlink.

Any debug I could enable to see why it fails in my case?

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/93965596/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

Phil Sutter <phil at nwl.cc> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |NEW

--- Comment #5 from Phil Sutter <phil at nwl.cc> ---
(In reply to Serguei Bezverkhi from comment #4)
> I do not know what to say, the same set of commands does not work on my
> side. I tried on both 5.3.0 and 5.4.10 kernels. 
> I get the same error from the netlink when I use API to talk directly to
> netlink.
> 
> Any debug I could enable to see why it fails in my case?
It also works for me on Gentoo's 5.4.3 kernel. Maybe compare netlink debug
output:

# nft --debug=netlink add element ipv4table no-endpoints-services '{ tcp .
192.168.80.104 . 8989 : goto do_reject }' 
no-endpoints-services ipv4table 0
    element 00000006 6850a8c0 00001d23  : 0 [end]

Did you try using a number instead of 'tcp'? Does it work with a more
simple
key instead of the three concatenated types?

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/dc732570/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

--- Comment #6 from Serguei Bezverkhi <sbezverk at cisco.com> ---
Please close it, the api library was not aligning the size of each element to 4
bytes border, but only the total size. I changed the behavior and now I can add
element to the set.
Thank you very much for your help.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/e9009ab5/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

Phil Sutter <phil at nwl.cc> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

--- Comment #7 from Phil Sutter <phil at nwl.cc> ---
(In reply to Serguei Bezverkhi from comment #6)
> Please close it, the api library was not aligning the size of each element
> to 4 bytes border, but only the total size. I changed the behavior and now
I
> can add element to the set.
> Thank you very much for your help.
I'm glad the problem is gone, but I wonder how you managed to reproduce it
using nft alone?

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/d07060b9/attachment-0001.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1395

--- Comment #8 from Serguei Bezverkhi <sbezverk at cisco.com> ---
That is what got me really confused. It turned out that when set gets created,
there is no check for alignment of concat elements and what is more surprising,
nft list was showing set properly with 3 concat elements. The issue of elements
alignment became visible only when I tried to add elements to the set.
The set was created with in my go code, but tests with adding elements were
done with nft cli tool.

Visually set created by nft and my go code were identical which added lots of
confusion.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/8fff7a52/attachment.html>