[POSSIBLE BUG] nft: src/rule.c:579: scope_release: Assertion `sym->refcnt == 1' failed.

[POSSIBLE BUG] nft: src/rule.c:579: scope_release: Assertion `sym->refcnt == 1' failed.

[Kamil Kwiek (irritum)]

Hi,

I was working on some firewall rules and needed to reuse couple of definitions (more precisely group them into other definitions).
I tried using an include statement pointing to a common file containing definitions such as 'B' in the example attached to this email.
When I included this file in different table, I started getting errors like the following:

...
nft: src/rule.c:559: scope_release: Assertion `sym->refcnt == 1' failed.
...


01. Anyway, the minimalistic example which is failing for me (content of test.nft file):

flush ruleset

define A = 111

table inet test {
    define B = { $A }
    #define B = { 111 }

    #chain c {
    #    meta iifgroup $B counter
    #}
}

As you can see - there is only unused definition.
I would expect it will work/compile.


A) However:

$ nft -c -f test.nft
Doesn't throw any error.

$ nft -f test.nft
nft: src/rule.c:579: scope_release: Assertion `sym->refcnt == 1' failed.
Aborted                    (core dumped) nft -f test.nft


B) When first 'define B' is commented out and the second one is uncommented, then:

$ nft -c -f test.nft
Doesn't throw any error.

$ nft -f test.nft
Doesn't throw any error. Rules are in place.


C) Finally, when the first 'define B' is yet again uncommented, second commented out too and the chain related code is uncommented:

$ nft -c -f test.nft
Doesn't throw any error.

$ nft -f test.nft
Doesn't throw any error. Rules are in place.


02. And here is a minimalistic example of maybe my misuse of 'include' or/and 'definitions', like:

A)

define admin_iface_group = 111

table inet mangle {
    #include "/etc/nftables.d/common/defines.nft"

    # Normally below code is part of above file.
    define iface_group = { $admin_iface_group }

    chain PREROUTING {
        iifgroup $iface_group ip6 dscp set cs0
    }
}

And this seems to work.
But when I get rid of 'iface_group' definition and uncomment include then it starts to fail.

B) Another approach:

define admin_iface_group = 111

table inet mangle {
    #include "/etc/nftables.d/common/defines.nft"

    # Normally below code is part of above file.
    define iface_group = $admin_iface_group

    chain PREROUTING {
        iifgroup { $iface_group } ip6 dscp set cs0
    }
}

As you can see 'iface_group' definition is no more wrapped with {}, on the other hand rule containing 'iface_group'
was now wrapped with {}. And it is failing.

C) Next:

define admin_iface_group = 111

table inet mangle {
    #include "/etc/nftables.d/common/defines.nft"

    # Normally below code is part of above file.
    define iface_group = { $admin_iface_group }

    chain PREROUTING {
        iifgroup { $iface_group } ip6 dscp set cs0
    }
}

Just get back {} in 'iface_group' definition but at the same time leave {} in rule of PREROUTING chain (so {} are used in both cases).
Now it works.

D) Finally last remaining possibility:

define admin_iface_group = 111

table inet mangle {
    include "/etc/nftables.d/common/defines.nft"

    # Normally below code is part of above file (other defines are there too).
    #define iface_group = { $admin_iface_group }

    chain PREROUTING {
        iifgroup { $iface_group } ip6 dscp set cs0
    }
}

The include was uncommented (at the same time comment out 'iface_group' definition), and {} were left in rule of PREROUTING chain.
Now it's failing.


Additional details of environment where it was tested:
a) gentoo: nftables 1.1.6 and libnftnl-1.3.1, gcc compiler was 15.2.1.
b) gentoo: nftables 1.1.7 and libnftnl-1.3.2, gcc compiler is 16.1.0.
c) archlinux: nftables 1.1.6, libnftnl-1.3.1-1, that's original binary upstream package.


Maybe there is still some problem with [1] or I'm doing something really wrong (all fails are this 'scope_release' kind).
Any insight?

[1] https://lore.kernel.org/netfilter-devel/20240115132718.24150-1-fw@strlen.de/

-- 
Pozdrawiam/Regards,
Kamil Kwiek