Re: nftables: Strange Error When Adding Element to Named Set

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Fri, May 08, 2020 at 07:06:56AM -0700, Mike Dillinger wrote:
> Hello,
> 
> This has been a problem since my kernel was upgraded to 5.6. Everything was fine prior to that where I was running the 5.5 kernel.
> 
> I'm running Debian testing and here is some information regarding my system:
> $ uname -a
> Linux rockenfield 5.6.0-1-amd64 #1 SMP Debian 5.6.7-1 (2020-04-29) x86_64 GNU/Linux
> $ nft -v
> nftables v0.9.4 (Jive at Five)
> 
> I have a script that blocks IP's by adding them to a named set, and the named set has a 12 hour expiration.  After about a day of uptime, I start getting the following error.  I'm obfuscating the IP address with "a.b.c.d".
> 
> $ nft add element ip filter blacklist4-ip-12h { a.b.c.d }
> Error: Could not process rule: File exists
> add element ip filter blacklist4-ip-12h { a.b.c.d }
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> 
> I can check the named set and no such IP address exists, and double checked using grep.  Here's the kicker: if I reboot, it works fine. The blacklist4-ip-12h set has 191 IP's so it shouldn't be a matter of too many IP's.  I've had up to 300 in the set before with no problems.  If I had too many IP's, I'd expect the same behavior after a reboot which is not the case.  It's not an issue with any particular IP address; rather it disallows anything being added to the named set entirely.  Here are the properties of the set in case something is wrong there:
> 
>     set blacklist4-ip-12h {
>         type ipv4_addr
>         flags interval,timeout
>         timeout 12h
>         gc-interval 1m
>     }
> 
> If the set properties look OK, then I'm fairly confident this is a bug.  I wanted to know if it's a kernel issue or an nftables issue, and also where to go to file a bug, and I can take it from there. I'm not sure when nftables was upgraded if we're suspecting nftables.  I'd need to do some digging.
> 
> Any help is greatly appreciated.  Having to reboot daily to work around this issue is not desirable.

Please, make sure your Linux kernel version is >= 5.6.7 or manually
cherry-pick this fix which was included starting that version.
Versions from 5.6.0 to 5.6.6 include this problem you describe.

See https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.6.7

Author: Stefano Brivio <sbrivio@redhat.com>
Date:   Wed Apr 1 17:14:38 2020 +0200

    netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion
    
    commit 72239f2795fab9a58633bd0399698ff7581534a3 upstream.