Re: How to troubleshoot (suspected) flowtable lockups/packet drops?

[Pablo Neira Ayuso <pablo@netfilter.org>]

On Wed, Mar 17, 2021 at 03:07:55PM -0400, Martin Gignac wrote:
> > Set on the counter flags at flowtable creation time, ie. flowtable 'f'
> > should not exist.
> 
> I tried creating a file like this:
> 
>     delete flowtable inet filter f
> 
>     table inet filter {
> 
>         flowtable f {
>             hook ingress priority filter - 1
>             devices = { tun0, bond0, dummy0, bond1.999, bond1,
> vrf-conntrackd, vrf-mgmt, enp66s0f1, enp66s0f0, enp5s0f1, enp5s0f0,
> eno4, eno3, eno2, eno1 }
>             counter
>         }
>     }
> 
> And then running nft -f <filename> on it, but I got these errors:
> 
>     <filename>:1:30-30: Error: Could not process rule: Device or resource busy
>     delete flowtable inet filter f
> 
> I assume this is because the flowtable is in use, so it can not be deleted.
> 
> Short of rebooting the Linux server (which I cannot do right now since
> I have many people relying on it), is there any kind of way for me to
> re-create the flowtable with the added 'counter' parameter without
> impacting traffic?

It should be possible to:

 delete rule inet filter y handle 3
 delete flowtable inet filter

but transaction code for the flowtable is buggy :-\

Two more fixes: It looks like EEXIST is also bogusly reported in case of
add-after-delete flowtable in the same batch.

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210317201957.13165-1-pablo@netfilter.org/
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210317201957.13165-2-pablo@netfilter.org/

I made a regression test for nft to make sure this works fine in the
future:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20210317203636.14869-1-pablo@netfilter.org/