Bug 1818117

Adding Regression keyword. from nftables-0.9.3-12.el8 to nftables-0.9.3-16.el8 the output for following ruleset changed in a way that '\' before '*' in iifname is omitted thus cannot be saved and loaded again.

cropped output 1 (valid):
iifname "\*" meta l4proto tcp tcp dport 80 counter
cropped output 1 (invalid):
iifname "*" tcp dport 80 counter

cat > nft-a.rules <<EOF
flush ruleset
table ip filter {
	chain INPUT {
		type filter hook input priority filter; policy accept;
		iifname "\*" tcp dport 80 counter accept
	}
}
EOF
nft 'flush ruleset; include "./nft-a.rules"'
nft -s list ruleset > nft-b.rules
nft 'flush ruleset; include "./nft-b.rules"'
nft: expression.c:394: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed.
Aborted (core dumped)

cat nft-b.rules
table ip filter {
	chain INPUT {
		type filter hook input priority filter; policy accept;
		iifname "*" tcp dport 80 counter accept
	}
}

(In reply to Tomas Dolezal from comment #1)
> Adding Regression keyword. from nftables-0.9.3-12.el8 to
> nftables-0.9.3-16.el8 the output for following ruleset changed in a way that
> '\' before '*' in iifname is omitted thus cannot be saved and loaded again.
> 
> cropped output 1 (valid):
> iifname "\*" meta l4proto tcp tcp dport 80 counter
> cropped output 1 (invalid):
> iifname "*" tcp dport 80 counter
> 
> cat > nft-a.rules <<EOF
> flush ruleset
> table ip filter {
> 	chain INPUT {
> 		type filter hook input priority filter; policy accept;
> 		iifname "\*" tcp dport 80 counter accept
> 	}
> }
> EOF
> nft 'flush ruleset; include "./nft-a.rules"'
> nft -s list ruleset > nft-b.rules
> nft 'flush ruleset; include "./nft-b.rules"'
> nft: expression.c:394: constant_expr_alloc: Assertion `(((len) + (8) - 1) /
> (8)) > 0' failed.
> Aborted (core dumped)
> 
> cat nft-b.rules
> table ip filter {
> 	chain INPUT {
> 		type filter hook input priority filter; policy accept;
> 		iifname "*" tcp dport 80 counter accept
> 	}
> }

For unknown reasons, I can't reproduce this on a machine with
nftables-0.9.3-16.el8.x86_64 installed. If nft-a.rules contains 'iifname "\*"',
so does 'nft list ruleset'.

A fix for the first issue was submitted upstream: https://lore.kernel.org/netfilter-devel/20200924170639.15842-1-phil@nwl.cc/

Upstream commit to backport:

commit 032c9f745c6daab8c27176a95963b1c32b0a5d12
Author: Phil Sutter <phil>
Date:   Thu Sep 24 17:38:45 2020 +0200

    evaluate: Reject quoted strings containing only wildcard
    
    Fix for an assertion fail when trying to match against an all-wildcard
    interface name:
    
    | % nft add rule t c iifname '"*"'
    | nft: expression.c:402: constant_expr_alloc: Assertion `(((len) + (8) - 1) / (8)) > 0' failed.
    | zsh: abort      nft add rule t c iifname '"*"'
    
    Fix this by detecting the string in expr_evaluate_string() and returning
    an error message:
    
    | % nft add rule t c iifname '"*"'
    | Error: All-wildcard strings are not supported
    | add rule t c iifname "*"
    |                      ^^^
    
    While being at it, drop the 'datalen >= 1' clause from the following
    conditional as together with the added check for 'datalen == 0', all
    possible other values have been caught already.

(In reply to Phil Sutter from comment #3)
> (In reply to Tomas Dolezal from comment #1)
> > Adding Regression keyword. from nftables-0.9.3-12.el8 to
> > nftables-0.9.3-16.el8 the output for following ruleset changed in a way that
> > '\' before '*' in iifname is omitted thus cannot be saved and loaded again.
> For unknown reasons, I can't reproduce this on a machine with
> nftables-0.9.3-16.el8.x86_64 installed. If nft-a.rules contains 'iifname
> "\*"',
> so does 'nft list ruleset'.

I am sorry to be unable to reproduce this one as well. I can't explain it better than as a badly described environment or a mistake when observing versions. I also tried upgrading from nftables-0.9.3-12.el8 to R-16 with no success in reproducing on 8.2.1's kernel

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (nftables bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2021:4465