Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
Not able to add synproxy rule in nftables. Gives below error.
NOTE:- nftables service without the synproxy rule is restarting properly.
# nft -f /etc/sysconfig/nftables.conf
/etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory
tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
^^^^^^^^
# systemctl status nftables.service -l
× nftables.service - Netfilter Tables
Loaded: loaded (/usr/lib/systemd/system/nftables.service; disabled; vendor preset: disabled)
Active: failed (Result: exit-code) since Wed 2022-03-30 14:13:31 IST; 11s ago
Docs: man:nft(8)
Process: 2632 ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf (code=exited, status=1/FAILURE)
Main PID: 2632 (code=exited, status=1/FAILURE)
CPU: 15ms
Mar 30 14:13:31 localhost.localdomain systemd[1]: Starting Netfilter Tables...
Mar 30 14:13:31 localhost.localdomain nft[2632]: /etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory
Mar 30 14:13:31 localhost.localdomain nft[2632]: tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
Mar 30 14:13:31 localhost.localdomain nft[2632]: ^^^^^^^^
Mar 30 14:13:31 localhost.localdomain systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE
Mar 30 14:13:31 localhost.localdomain systemd[1]: nftables.service: Failed with result 'exit-code'.
Mar 30 14:13:31 localhost.localdomain systemd[1]: Failed to start Netfilter Tables.
nftables service does not start.
Version-Release number of selected component (if applicable):
# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.0 Beta (Plow)
# uname -a
Linux localhost.localdomain 5.14.0-63.el9.x86_64 #1 SMP PREEMPT Thu Feb 17 17:02:42 EST 2022 x86_64 x86_64 x86_64 GNU/Linux
# rpm -qa | egrep -i nftables
nftables-0.9.8-10.el9.x86_64
python3-nftables-0.9.8-10.el9.x86_64
How reproducible:
Add the below rule in the nftables.conf file and restart the nftables service.
tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
Steps to Reproduce:
1. I have created a table and 2 chains for it and added the rule in the chain.
Below is my nftables.conf file.
# cat /etc/sysconfig/nftables.conf
# Uncomment the include statement here to load the default config sample
# in /etc/nftables for nftables service.
#include "/etc/nftables/main.nft"
# To customize, either edit the samples in /etc/nftables, append further
# commands to the end of this file or overwrite it after first service
# start by calling: 'nft list ruleset >/etc/sysconfig/nftables.conf'.
#
table ip anon_synproxy_demo {
chain PRE {
type filter hook prerouting priority raw; policy accept;
tcp dport 8888 tcp flags syn notrack
}
chain IN {
type filter hook input priority filter; policy accept;
tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
ct state invalid drop
}
}
2. Restart the nftables service.
# systemctl start nftables
Or if you have mentioned the rule in some other file, other than nftabes.conf then try to read the file using below command..
# nft -f <file_path>
Actual results:
Gives error.
# nft -f /etc/sysconfig/nftables.conf
/etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory
tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm
Expected results:
The nftables service should start with the synproxy rule.
Hi,
This is a kernel limitation, the respective config option is not enabled. We realized this just recently, so you barely missed the ticket tracking this. Thanks for the report though!
Cheers, Phil
*** This bug has been marked as a duplicate of bug 2069735 ***
Description of problem: Not able to add synproxy rule in nftables. Gives below error. NOTE:- nftables service without the synproxy rule is restarting properly. # nft -f /etc/sysconfig/nftables.conf /etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm ^^^^^^^^ # systemctl status nftables.service -l × nftables.service - Netfilter Tables Loaded: loaded (/usr/lib/systemd/system/nftables.service; disabled; vendor preset: disabled) Active: failed (Result: exit-code) since Wed 2022-03-30 14:13:31 IST; 11s ago Docs: man:nft(8) Process: 2632 ExecStart=/sbin/nft -f /etc/sysconfig/nftables.conf (code=exited, status=1/FAILURE) Main PID: 2632 (code=exited, status=1/FAILURE) CPU: 15ms Mar 30 14:13:31 localhost.localdomain systemd[1]: Starting Netfilter Tables... Mar 30 14:13:31 localhost.localdomain nft[2632]: /etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory Mar 30 14:13:31 localhost.localdomain nft[2632]: tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm Mar 30 14:13:31 localhost.localdomain nft[2632]: ^^^^^^^^ Mar 30 14:13:31 localhost.localdomain systemd[1]: nftables.service: Main process exited, code=exited, status=1/FAILURE Mar 30 14:13:31 localhost.localdomain systemd[1]: nftables.service: Failed with result 'exit-code'. Mar 30 14:13:31 localhost.localdomain systemd[1]: Failed to start Netfilter Tables. nftables service does not start. Version-Release number of selected component (if applicable): # cat /etc/redhat-release Red Hat Enterprise Linux release 9.0 Beta (Plow) # uname -a Linux localhost.localdomain 5.14.0-63.el9.x86_64 #1 SMP PREEMPT Thu Feb 17 17:02:42 EST 2022 x86_64 x86_64 x86_64 GNU/Linux # rpm -qa | egrep -i nftables nftables-0.9.8-10.el9.x86_64 python3-nftables-0.9.8-10.el9.x86_64 How reproducible: Add the below rule in the nftables.conf file and restart the nftables service. tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm Steps to Reproduce: 1. I have created a table and 2 chains for it and added the rule in the chain. Below is my nftables.conf file. # cat /etc/sysconfig/nftables.conf # Uncomment the include statement here to load the default config sample # in /etc/nftables for nftables service. #include "/etc/nftables/main.nft" # To customize, either edit the samples in /etc/nftables, append further # commands to the end of this file or overwrite it after first service # start by calling: 'nft list ruleset >/etc/sysconfig/nftables.conf'. # table ip anon_synproxy_demo { chain PRE { type filter hook prerouting priority raw; policy accept; tcp dport 8888 tcp flags syn notrack } chain IN { type filter hook input priority filter; policy accept; tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm ct state invalid drop } } 2. Restart the nftables service. # systemctl start nftables Or if you have mentioned the rule in some other file, other than nftabes.conf then try to read the file using below command.. # nft -f <file_path> Actual results: Gives error. # nft -f /etc/sysconfig/nftables.conf /etc/sysconfig/nftables.conf:21:51-58: Error: Could not process rule: No such file or directory tcp dport 8888 ct state invalid,untracked synproxy mss 1460 wscale 7 timestamp sack-perm Expected results: The nftables service should start with the synproxy rule.