[pkg-netfilter-team] nftables: Error: Could not process rule: Device or resource busy

[Eike Lohmann]

nftables 0.9.0-1~bpo9+1 amd64
libnftnl7 1.1.1-1~bpo9+1 amd64
linux-image-amd64 4.18+98~bpo9+1 amd64
libxtables12 1.6.2-1.1~bpo9+1 amd64

Debian Stretch 9.6 with kernel and nftables from stretch-backports

Dear Maintainer,

with adding and deleting rules, chains, maps and sets in nft, we can reproduce a
"device or resource busy" followed by flush ruleset with a "segmentation fault".

For the device or resource busy error, we can't find any process in the processlist.

How to reproduce:

/etc/nftables.conf:

#!/usr/sbin/nft -f
# Skeleton for nftables

flush ruleset

table ip filter {
    chain FORWARD {
        type filter hook forward priority 0;
    }
}

Add via file:

add chain filter vpn_master
add map filter J_TestMap { type ipv4_addr : verdict ; flags interval ; }
add rule filter vpn_master ip saddr vmap @J_TestMap
add chain filter C_TestChain
add set filter M_TestMasterSet {type ipv4_addr ; flags interval ; elements={
172.21.138.0/29 } ;}
add set filter S_TestSlaveSet {type ipv4_addr ; flags interval ; elements={
172.21.138.8/29, 172.21.138.16/28, 172.21.138.32/29 } ;}
add element filter J_TestMap { 172.21.138.0/29 : jump C_TestChain }
add element filter J_TestMap { 172.21.138.8/29 : jump C_TestChain }
add element filter J_TestMap { 172.21.138.16/28 : jump C_TestChain }
add element filter J_TestMap { 172.21.138.32/29 : jump C_TestChain }
add rule filter C_TestChain ip saddr @M_TestMasterSet ip daddr @M_TestMasterSet
accept
add rule filter C_TestChain ip saddr @M_TestMasterSet ip daddr @S_TestSlaveSet
accept
add rule filter C_TestChain ip saddr @S_TestSlaveSet ip daddr @M_TestMasterSet
accept

then flush and delete some rules with following commands:

# nft flush set filter M_TestMasterSet
# nft flush set filter S_TestSlaveSet
# nft flush map filter J_TestMap
# nft flush chain filter C_TestChain
# nft delete set filter M_TestMasterSet
# nft delete set filter S_TestSlaveSet

now we delete the vmap via handle (could not find out, how to delete this via
name):

# nft list table filter -na
table ip filter { # handle 2
    map J_TestMap { # handle 3
        type ipv4_addr : verdict
        flags interval
    }

    chain FORWARD { # handle 1
        type filter hook forward priority 0; policy accept;
    }

    chain vpn_master { # handle 2
        ip saddr vmap @J_TestMap # handle 4
    }

    chain C_TestChain { # handle 5
    }
}

# nft delete rule filter vpn_master handle 4
# nft delete map filter J_TestMap
# nft delete chain filter C_TestChain
Error: Could not process rule: Device or resource busy
delete chain filter C_TestChain

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

what is left and can we delete it via an complete flush?

# nft list table filter -na
table ip filter { # handle 2
    chain FORWARD { # handle 1
        type filter hook forward priority 0; policy accept;
    }

    chain vpn_master { # handle 2
    }

    chain C_TestChain { # handle 5
    }
}

# nft flush ruleset
Segmentation fault

Please contact me, if you need further details.

Regards, Eike