nft ends with error

nft ends with error

[Kamil Jońca]

sudo nft --version
nftables v1.0.9 (Old Doc Yak #3)

Recently my nftables debian service started to ends with error:

--8<---------------cut here---------------start------------->8---
Nov 22 19:18:56 alfa systemd[1]: Starting nftables.service - nftables...
Nov 22 19:18:57 alfa nft[2242551]: nft: datatype.c:1264: datatype_free: Assertion `dtype->refcnt != 0' failed.
Nov 22 19:18:57 alfa systemd[1]: nftables.service: Failed with result 'signal'.
Nov 22 19:18:57 alfa systemd[1]: Failed to start nftables.service - nftables.

--8<---------------cut here---------------end--------------->8---

After some investigating I found that nft does not like definition;

--8<---------------cut here---------------start------------->8---
table ip filter {
...
        map ipsec_in {
                typeof ipsec in reqid . iif : verdict
                flags interval
        }
...

  chain INPUT {
        type filter hook input priority 0; policy drop
        ...
        ipsec in reqid . iif vmap @ipsec_in
        ...
    }
...
}
--8<---------------cut here---------------end--------------->8---

rules seems to be loaded entirely and works.


When I downgraded nftables from 1.0.9-1+b1  to 1.0.8-1 service starts
without problems.




KJ

Re: nft ends with error

[Pablo Neira Ayuso]

On Wed, Nov 22, 2023 at 07:35:59PM +0100, Kamil Jońca wrote:
> sudo nft --version
> nftables v1.0.9 (Old Doc Yak #3)
> 
> Recently my nftables debian service started to ends with error:
> 
> --8<---------------cut here---------------start------------->8---
> Nov 22 19:18:56 alfa systemd[1]: Starting nftables.service - nftables...
> Nov 22 19:18:57 alfa nft[2242551]: nft: datatype.c:1264: datatype_free: Assertion `dtype->refcnt != 0' failed.
> Nov 22 19:18:57 alfa systemd[1]: nftables.service: Failed with result 'signal'.
> Nov 22 19:18:57 alfa systemd[1]: Failed to start nftables.service - nftables.
> 
> --8<---------------cut here---------------end--------------->8---
> 
> After some investigating I found that nft does not like definition;
> 
> --8<---------------cut here---------------start------------->8---
> table ip filter {
> ...
>         map ipsec_in {
>                 typeof ipsec in reqid . iif : verdict
>                 flags interval
>         }
> ...
> 
>   chain INPUT {
>         type filter hook input priority 0; policy drop
>         ...
>         ipsec in reqid . iif vmap @ipsec_in
>         ...
>     }
> ...
> }
> --8<---------------cut here---------------end--------------->8---
> 
> rules seems to be loaded entirely and works.

Thanks for this reproducer. Proposed fix:

https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231122210106.183932-1-pablo@netfilter.org/

Re: nft ends with error

[Pablo Neira Ayuso]

On Wed, Nov 22, 2023 at 10:04:04PM +0100, Pablo Neira Ayuso wrote:
> On Wed, Nov 22, 2023 at 07:35:59PM +0100, Kamil Jońca wrote:
[...]
> > --8<---------------cut here---------------start------------->8---
> > table ip filter {
> > ...
> >         map ipsec_in {
> >                 typeof ipsec in reqid . iif : verdict
> >                 flags interval
> >         }
> > ...
> > 
> >   chain INPUT {
> >         type filter hook input priority 0; policy drop
> >         ...
> >         ipsec in reqid . iif vmap @ipsec_in
> >         ...
> >     }
> > ...
> > }
> > --8<---------------cut here---------------end--------------->8---
> > 
> > rules seems to be loaded entirely and works.
> 
> Thanks for this reproducer. Proposed fix:
> 
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231122210106.183932-1-pablo@netfilter.org/

For the record:

https://git.netfilter.org/nftables/commit/?id=faa6908fad6053ae9549c45b88d0402cc69cf1ed

Re: nft ends with error

[Kamil Jońca]

Pablo Neira Ayuso <pablo@netfilter.org> writes:

[...]
>
> Thanks for this reproducer. Proposed fix:
>
> https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231122210106.183932-1-pablo@netfilter.org/
>

I know that it was several months ago, but it seems your fix works - no
error message.

KJ

-- 
http://wolnelektury.pl/wesprzyj/teraz/

Re: nft ends with error

[Pablo Neira Ayuso]

On Sat, Mar 16, 2024 at 07:40:23PM +0100, Kamil Jońca wrote:
> Pablo Neira Ayuso <pablo@netfilter.org> writes:
> 
> [...]
> >
> > Thanks for this reproducer. Proposed fix:
> >
> > https://patchwork.ozlabs.org/project/netfilter-devel/patch/20231122210106.183932-1-pablo@netfilter.org/
> >
> 
> I know that it was several months ago, but it seems your fix works - no
> error message.

Thanks for confirming.

Already upstream:

commit faa6908fad6053ae9549c45b88d0402cc69cf1ed
Author: Pablo Neira Ayuso <pablo@netfilter.org>
Date:   Wed Nov 22 20:35:07 2023 +0100

    evaluate: clone unary expression datatype to deal with dynamic datatype

This will be available in the next release.