<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Package: nftables<br>
Version: 0.9.0-1~bpo9+1<br>
Severity: <font size="+1"><code>important</code></font><br>
<br>
Dear Maintainer,<br>
<br>
</p>
<pre class="moz-quote-pre" wrap="">with adding and deleting rules, chains, maps and sets in nft, we can reproduce a
"device or resource busy" followed by flush ruleset with a "segmentation fault".
For the device or resource busy error, we can't find any process in the processlist.</pre>
<pre class="moz-quote-pre" wrap=""># nft delete chain filter C_TestChain
Error: Could not process rule: Device or resource busy
delete chain filter C_TestChain
# nft flush ruleset
Segmentation fault</pre>
<pre class="moz-quote-pre" wrap=""><font size="+1">
How to reproduce:</font>
/etc/nftables.conf:
#!/usr/sbin/nft -f
# Skeleton for nftables
flush ruleset
table ip filter {
chain FORWARD {
type filter hook forward priority 0;
}
}
Add via file:
add chain filter vpn_master
add map filter J_TestMap { type ipv4_addr : verdict ; flags interval ; }
add rule filter vpn_master ip saddr vmap @J_TestMap
add chain filter C_TestChain
add set filter M_TestMasterSet {type ipv4_addr ; flags interval ; elements={
172.21.138.0/29 } ;}
add set filter S_TestSlaveSet {type ipv4_addr ; flags interval ; elements={
172.21.138.8/29, 172.21.138.16/28, 172.21.138.32/29 } ;}
add element filter J_TestMap { 172.21.138.0/29 : jump C_TestChain }
add element filter J_TestMap { 172.21.138.8/29 : jump C_TestChain }
add element filter J_TestMap { 172.21.138.16/28 : jump C_TestChain }
add element filter J_TestMap { 172.21.138.32/29 : jump C_TestChain }
add rule filter C_TestChain ip saddr @M_TestMasterSet ip daddr @M_TestMasterSet
accept
add rule filter C_TestChain ip saddr @M_TestMasterSet ip daddr @S_TestSlaveSet
accept
add rule filter C_TestChain ip saddr @S_TestSlaveSet ip daddr @M_TestMasterSet
accept
then flush and delete some rules with following commands:
# nft flush set filter M_TestMasterSet
# nft flush set filter S_TestSlaveSet
# nft flush map filter J_TestMap
# nft flush chain filter C_TestChain
# nft delete set filter M_TestMasterSet
# nft delete set filter S_TestSlaveSet
now we delete the vmap via handle (could not find out, how to delete this via
name):
# nft list table filter -na
table ip filter { # handle 2
map J_TestMap { # handle 3
type ipv4_addr : verdict
flags interval
}
chain FORWARD { # handle 1
type filter hook forward priority 0; policy accept;
}
chain vpn_master { # handle 2
ip saddr vmap @J_TestMap # handle 4
}
chain C_TestChain { # handle 5
}
}
# nft delete rule filter vpn_master handle 4
# nft delete map filter J_TestMap
# nft delete chain filter C_TestChain
Error: Could not process rule: Device or resource busy
delete chain filter C_TestChain
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
what is left and can we delete it via an complete flush?
# nft list table filter -na
table ip filter { # handle 2
chain FORWARD { # handle 1
type filter hook forward priority 0; policy accept;
}
chain vpn_master { # handle 2
}
chain C_TestChain { # handle 5
}
}
# nft flush ruleset
Segmentation fault
Please contact me, if you need further details.
Regards, Eike</pre>
<br>
<p>-- System Information:<br>
Debian Release: 9.6<br>
APT prefers stable<br>
APT policy: (990, 'stable'), (500, 'stable-updates'), (50,
'testing')<br>
Architecture: amd64 (x86_64)<br>
<br>
Kernel: Linux 4.18.0-0.bpo.1-amd64 (SMP w/1 CPU core)<br>
Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8),
LANGUAGE=de_DE.UTF-8 (charmap=UTF-8)<br>
Shell: /bin/sh linked to /bin/dash<br>
Init: systemd (via /run/systemd/system)<br>
<br>
Versions of packages nftables depends on:<br>
ii dpkg 1.18.25<br>
ii libc6 2.24-11+deb9u3<br>
ii libgmp10 2:6.1.2+dfsg-1<br>
ii libnftables0 0.9.0-1~bpo9+1<br>
ii libreadline7 7.0-3</p>
<p>ii libnftnl7:amd64 1.1.1-1~bpo9+1</p>
<p>nftables recommends no packages.<br>
<br>
nftables suggests no packages.<br>
<br>
-- Configuration Files:<br>
/etc/nftables.conf changed:<br>
flush ruleset<br>
table ip filter {<br>
chain FORWARD {<br>
type filter hook forward priority 0;<br>
}<br>
}<br>
<br>
</p>
</body>
</html>