bugzilla-daemon at netfilter.org
2020-Jan-07 14:33 UTC
[Bug 1396] New: When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396
Bug ID: 1396
Summary: When rule with 3 concat elements are added, nft list
shows only 2
Product: nftables
Version: unspecified
Hardware: All
OS: All
Status: NEW
Severity: critical
Priority: P5
Component: nft
Assignee: pablo at netfilter.org
Reporter: sbezverk at cisco.com
table ip ipv4table {
map cluster-ip-services-set {
type inet_proto . ipv4_addr . inet_service : verdict
}
chain k8s-nat-mark-masq {
ip protocol . ip daddr vmap @cluster-ip-services-set
}
chain k8s-nat-do-mark-masq {
meta mark set 0x00004000 return
}
}
the command to add rule to k8s-nat-mark-masq chain is:
sudo nft add rule ipv4table k8s-nat-mark-masq ip protocol . ip daddr . th dport
vmap @cluster-ip-services-set
It does not fail but sudo nft list table ipv4table shows incorrect rule.
nft -version
nftables v0.9.3 (Topsy)
Debug output:
ip ipv4table k8s-nat-mark-masq
[ payload load 1b @ network header + 9 => reg 1 ]
[ payload load 4b @ network header + 16 => reg 9 ]
[ payload load 2b @ transport header + 2 => reg 10 ]
[ lookup reg 1 set cluster-ip-services-set dreg 0 ]
---------------- ------------------
| 0000000020 | | message length |
| 00016 | R--- | | type | flags |
| 0000000000 | | sequence number|
| 0000000000 | | port ID |
---------------- ------------------
| 00 00 0a 00 | | extra header |
---------------- ------------------
---------------- ------------------
| 0000000292 | | message length |
| 02566 | R--- | | type | flags |
| 0000000001 | | sequence number|
| 0000000000 | | port ID |
---------------- ------------------
| 02 00 00 00 | | extra header |
|00014|--|00001| |len |flags| type|
| 69 70 76 34 | | data | i p v 4
| 74 61 62 6c | | data | t a b l
| 65 00 00 00 | | data | e
|00022|--|00002| |len |flags| type|
| 6b 38 73 2d | | data | k 8 s -
| 6e 61 74 2d | | data | n a t -
| 6d 61 72 6b | | data | m a r k
| 2d 6d 61 73 | | data | - m a s
| 71 00 00 00 | | data | q
|00232|N-|00004| |len |flags| type|
|00052|N-|00001| |len |flags| type|
|00012|--|00001| |len |flags| type|
| 70 61 79 6c | | data | p a y l
| 6f 61 64 00 | | data | o a d
|00036|N-|00002| |len |flags| type|
|00008|--|00001| |len |flags| type|
| 00 00 00 01 | | data |
|00008|--|00002| |len |flags| type|
| 00 00 00 01 | | data |
|00008|--|00003| |len |flags| type|
| 00 00 00 09 | | data |
|00008|--|00004| |len |flags| type|
| 00 00 00 01 | | data |
|00052|N-|00001| |len |flags| type|
|00012|--|00001| |len |flags| type|
| 70 61 79 6c | | data | p a y l
| 6f 61 64 00 | | data | o a d
|00036|N-|00002| |len |flags| type|
|00008|--|00001| |len |flags| type|
| 00 00 00 09 | | data |
|00008|--|00002| |len |flags| type|
| 00 00 00 01 | | data |
|00008|--|00003| |len |flags| type|
| 00 00 00 10 | | data |
|00008|--|00004| |len |flags| type|
| 00 00 00 04 | | data |
|00052|N-|00001| |len |flags| type|
|00012|--|00001| |len |flags| type|
| 70 61 79 6c | | data | p a y l
| 6f 61 64 00 | | data | o a d
|00036|N-|00002| |len |flags| type|
|00008|--|00001| |len |flags| type|
| 00 00 00 0a | | data |
|00008|--|00002| |len |flags| type|
| 00 00 00 02 | | data |
|00008|--|00003| |len |flags| type|
| 00 00 00 02 | | data |
|00008|--|00004| |len |flags| type|
| 00 00 00 02 | | data |
|00072|N-|00001| |len |flags| type|
|00011|--|00001| |len |flags| type|
| 6c 6f 6f 6b | | data | l o o k
| 75 70 00 00 | | data | u p
|00056|N-|00002| |len |flags| type|
|00008|--|00002| |len |flags| type|
| 00 00 00 01 | | data |
|00008|--|00003| |len |flags| type|
| 00 00 00 00 | | data |
|00028|--|00001| |len |flags| type|
| 63 6c 75 73 | | data | c l u s
| 74 65 72 2d | | data | t e r -
| 69 70 2d 73 | | data | i p - s
| 65 72 76 69 | | data | e r v i
| 63 65 73 2d | | data | c e s -
| 73 65 74 00 | | data | s e t
|00008|--|00004| |len |flags| type|
| 00 00 00 01 | | data |
---------------- ------------------
---------------- ------------------
| 0000000020 | | message length |
| 00017 | R--- | | type | flags |
| 0000000002 | | sequence number|
| 0000000000 | | port ID |
---------------- ------------------
| 00 00 0a 00 | | extra header |
---------------- ------------------
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200107/69a66fbb/attachment.html>
bugzilla-daemon at netfilter.org
2020-Jan-10 10:29 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396 --- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> --- (In reply to Serguei Bezverkhi from comment #0)> table ip ipv4table { > map cluster-ip-services-set { > type inet_proto . ipv4_addr . inet_service : verdict > } > > > chain k8s-nat-mark-masq { > ip protocol . ip daddr vmap @cluster-ip-services-setNot correct. ip protocol . ip daddr . th dport vmap @cluster-ip-services-set or ip protocol . ip daddr . th dport vmap @cluster-ip-services-set> } > > chain k8s-nat-do-mark-masq { > meta mark set 0x00004000 return > } > }/home/sparky/x.nft:7:37-60: Error: datatype mismatch, map expects concatenation of (Internet protocol, IPv4 address, internet network service), mapping expression has type concatenation of (Internet protocol, IPv4 address) ip protocol . ip daddr vmap @cluster-ip-services-set ~~~~~~~~~~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^> the command to add rule to k8s-nat-mark-masq chain is: > > sudo nft add rule ipv4table k8s-nat-mark-masq ip protocol . ip daddr . th > dport vmap @cluster-ip-services-set > > It does not fail but sudo nft list table ipv4table shows incorrect rule. > > nft -version > nftables v0.9.3 (Topsy) > > > Debug output: > ip ipv4table k8s-nat-mark-masq > [ payload load 1b @ network header + 9 => reg 1 ] > [ payload load 4b @ network header + 16 => reg 9 ] > [ payload load 2b @ transport header + 2 => reg 10 ] > [ lookup reg 1 set cluster-ip-services-set dreg 0 ] > > ---------------- ------------------ > | 0000000020 | | message length | > | 00016 | R--- | | type | flags | > | 0000000000 | | sequence number| > | 0000000000 | | port ID | > ---------------- ------------------ > | 00 00 0a 00 | | extra header | > ---------------- ------------------ > ---------------- ------------------ > | 0000000292 | | message length | > | 02566 | R--- | | type | flags | > | 0000000001 | | sequence number| > | 0000000000 | | port ID | > ---------------- ------------------ > | 02 00 00 00 | | extra header | > |00014|--|00001| |len |flags| type| > | 69 70 76 34 | | data | i p v 4 > | 74 61 62 6c | | data | t a b l > | 65 00 00 00 | | data | e > |00022|--|00002| |len |flags| type| > | 6b 38 73 2d | | data | k 8 s - > | 6e 61 74 2d | | data | n a t - > | 6d 61 72 6b | | data | m a r k > | 2d 6d 61 73 | | data | - m a s > | 71 00 00 00 | | data | q > |00232|N-|00004| |len |flags| type| > |00052|N-|00001| |len |flags| type| > |00012|--|00001| |len |flags| type| > | 70 61 79 6c | | data | p a y l > | 6f 61 64 00 | | data | o a d > |00036|N-|00002| |len |flags| type| > |00008|--|00001| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00002| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 09 | | data | > |00008|--|00004| |len |flags| type| > | 00 00 00 01 | | data | > |00052|N-|00001| |len |flags| type| > |00012|--|00001| |len |flags| type| > | 70 61 79 6c | | data | p a y l > | 6f 61 64 00 | | data | o a d > |00036|N-|00002| |len |flags| type| > |00008|--|00001| |len |flags| type| > | 00 00 00 09 | | data | > |00008|--|00002| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 10 | | data | > |00008|--|00004| |len |flags| type| > | 00 00 00 04 | | data | > |00052|N-|00001| |len |flags| type| > |00012|--|00001| |len |flags| type| > | 70 61 79 6c | | data | p a y l > | 6f 61 64 00 | | data | o a d > |00036|N-|00002| |len |flags| type| > |00008|--|00001| |len |flags| type| > | 00 00 00 0a | | data | > |00008|--|00002| |len |flags| type| > | 00 00 00 02 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 02 | | data | > |00008|--|00004| |len |flags| type| > | 00 00 00 02 | | data | > |00072|N-|00001| |len |flags| type| > |00011|--|00001| |len |flags| type| > | 6c 6f 6f 6b | | data | l o o k > | 75 70 00 00 | | data | u p > |00056|N-|00002| |len |flags| type| > |00008|--|00002| |len |flags| type| > | 00 00 00 01 | | data | > |00008|--|00003| |len |flags| type| > | 00 00 00 00 | | data | > |00028|--|00001| |len |flags| type| > | 63 6c 75 73 | | data | c l u s > | 74 65 72 2d | | data | t e r - > | 69 70 2d 73 | | data | i p - s > | 65 72 76 69 | | data | e r v i > | 63 65 73 2d | | data | c e s - > | 73 65 74 00 | | data | s e t > |00008|--|00004| |len |flags| type| > | 00 00 00 01 | | data | > ---------------- ------------------ > ---------------- ------------------ > | 0000000020 | | message length | > | 00017 | R--- | | type | flags | > | 0000000002 | | sequence number| > | 0000000000 | | port ID | > ---------------- ------------------ > | 00 00 0a 00 | | extra header | > ---------------- -------------------- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/681afbd1/attachment.html>
bugzilla-daemon at netfilter.org
2020-Jan-10 10:31 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396
Pablo Neira Ayuso <pablo at netfilter.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
--- Comment #2 from Pablo Neira Ayuso <pablo at netfilter.org> ---
(In reply to Serguei Bezverkhi from comment #0)> table ip ipv4table {
> map cluster-ip-services-set {
> type inet_proto . ipv4_addr . inet_service : verdict
> }
>
>
> chain k8s-nat-mark-masq {
> ip protocol . ip daddr vmap @cluster-ip-services-set
> }
>
> chain k8s-nat-do-mark-masq {
> meta mark set 0x00004000 return
> }
> }
This definition above fails to load:
/tmp/m:7:37-60: Error: datatype mismatch, map expects concatenation of
(Internet protocol, IPv4 address, internet network service), mapping expression
has type concatenation of (Internet protocol, IPv4 address)
ip protocol . ip daddr vmap @cluster-ip-services-set
~~~~~~~~~~~~~~~~~~~~~~ ^^^^^^^^^^^^^^^^^^^^^^^^
Because one member of the concatenation is missing.
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/bc16c77e/attachment.html>
bugzilla-daemon at netfilter.org
2020-Jan-10 10:39 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396
--- Comment #3 from Pablo Neira Ayuso <pablo at netfilter.org> ---
# cat x
table ip ipv4table {
map cluster-ip-services-set {
type inet_proto . ipv4_addr . inet_service : verdict
}
chain k8s-nat-mark-masq {
ip protocol . ip daddr . th sport vmap @cluster-ip-services-set
}
chain k8s-nat-do-mark-masq {
meta mark set 0x00004000 return
}
}
# nft -f x
# nft list ruleset
table ip ipv4table {
map cluster-ip-services-set {
type inet_proto . ipv4_addr . inet_service : verdict
}
chain k8s-nat-mark-masq {
ip protocol . ip daddr . th sport vmap @cluster-ip-services-set
}
chain k8s-nat-do-mark-masq {
meta mark set 0x00004000 return
}
}
This works fine here.
I remember you are using the raw netlink interface.
What kind of netlink message is your software sending to the kernel?
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200110/69c0f1e9/attachment.html>
bugzilla-daemon at netfilter.org
2020-Apr-15 22:17 UTC
[Bug 1396] When rule with 3 concat elements are added, nft list shows only 2
https://bugzilla.netfilter.org/show_bug.cgi?id=1396
Pablo Neira Ayuso <pablo at netfilter.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |WORKSFORME
Status|ASSIGNED |RESOLVED
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200415/4c81dfc5/attachment.html>