Bug 2069998

Description of problem:

Not able to add synproxy rule in nftables. Gives below error.

NOTE:- nftables service without the synproxy rule is restarting properly. 

# nft -f /etc/sysconfig/nftables.conf 
/etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory
        tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
                                                  ^^^^^^^^

# systemctl status nftables.service -l
× nftables.service - Netfilter Tables
     Loaded: loaded (/usr/lib/systemd/system/nftables.service; disabled; vendor preset: disabled)
     Active: failed (Result: exit-code) since Wed 2022-03-30 14:13:31 IST; 11s ago
       Docs: man:nft(8)
    Process: 2632 ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf (code=exited, status=1/FAILURE)
   Main PID: 2632 (code=exited, status=1/FAILURE)
        CPU: 15ms

Mar 30 14:13:31 localhost.localdomain systemd[1]: Starting Netfilter Tables...
Mar 30 14:13:31 localhost.localdomain nft[2632]: /etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory
Mar 30 14:13:31 localhost.localdomain nft[2632]:         tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
Mar 30 14:13:31 localhost.localdomain nft[2632]:                                                   ^^^^^^^^
Mar 30 14:13:31 localhost.localdomain systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Mar 30 14:13:31 localhost.localdomain systemd[1]: nftables.service: Failed with result 'exit-code'.
Mar 30 14:13:31 localhost.localdomain systemd[1]: Failed to start Netfilter Tables.


nftables service does not start.

Version-Release number of selected component (if applicable):

# cat /etc/redhat-release 
Red Hat Enterprise Linux release 9.0 Beta (Plow)

# uname -a
Linux localhost.localdomain 5.14.0-63.el9.x86_64 #1 SMP PREEMPT Thu Feb 17 17:02:42 EST 2022 x86_64 x86_64 x86_64 GNU/Linux

# rpm -qa | egrep -i nftables
nftables-0.9.8-10.el9.x86_64
python3-nftables-0.9.8-10.el9.x86_64

How reproducible:

Add the below rule in the nftables.conf file and restart the nftables service.

tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm

Steps to Reproduce:

1. I have created a table and 2 chains for it and added the rule in the chain.

Below is my nftables.conf file.

# cat /etc/sysconfig/nftables.conf 
# Uncomment the include statement here to load the default config sample
# in /etc/nftables for nftables service.

#include "/etc/nftables/main.nft"

# To customize, either edit the samples in /etc/nftables, append further
# commands to the end of this file or overwrite it after first service
# start by calling: 'nft list ruleset >/etc/sysconfig/nftables.conf'.
#
table ip anon_synproxy_demo {

    chain PRE {
        type filter hook prerouting priority raw; policy accept;

        tcp dport 8888 tcp flags syn notrack
    }

    chain IN {
        type filter hook input priority filter; policy accept;

        tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
        ct state invalid drop
    }
}


2.  Restart the nftables service.
# systemctl start nftables

Or if you have mentioned the rule in some other file, other than nftabes.conf then try to read the file using below command..

# nft -f <file_path>


Actual results:

Gives error.

# nft -f /etc/sysconfig/nftables.conf 
/etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory
        tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm

Expected results:

The nftables service should start with the synproxy rule.