Bug 2109933

Description of problem:
Man page of nft contains "nft fib expression" while the kernel support for same is added in RHEL 8.0

Version-Release number of selected component (if applicable):
nftables version : nftables-0.8-14.el7.x86_64

Kernel : 3.10.0-1160.53.1.el7.x86_64


Actual results:
Man page contains examples for "fib expression" which is for userspace nftables, however kernel does not support it.


Expected results:
Man page should explicitly mention "support for nftables fib expression is added to kernel from 4.10 version onwards".


Additional info:
We have a customer case requesting to backport the feature to RHEL 7.9 or to make changes to man page.

Its confusing to customers since man page shows examples of "fib expression" however the kernel does not support it.

contents from "man nft"

~~~
      Boolean specification
 
       The following expressions support a boolean comparison:
 
       ┌───────────┬──────────────────────────────────────┐
       │Expression │ Behaviour                            │
       ├───────────┼──────────────────────────────────────┤
       │fib        │ Check route existence.               │
       ├───────────┼──────────────────────────────────────┤
       │exthdr     │ Check IPv6  extension  header  exis‐ │
       │           │ tence.                               │
       ├───────────┼──────────────────────────────────────┤
       │tcp option │ Check TCP option header existence.   │
       └───────────┴──────────────────────────────────────┘
       # match if route exists
       filter input fib daddr . iif oif exists
 
       # match only non-fragmented packets in IPv6 traffic
       filter input exthdr frag missing
 
       # match if TCP timestamp option is present
       filter input tcp option timestamp exists
//
//
//
 
   FIB EXPRESSIONS
       fib {saddr | daddr | [mark | iif | oif]} {oif | oifname | type}
 
       A fib expression queries the fib (forwarding information base) to obtain information such as the  out‐
       put  interface  index a particular address would use. The input is a tuple of elements that is used as
       input to the fib lookup functions.
 
       fib expression specific types
 
       ┌────────┬────────────────────────┬──────────────────┐
       │Keyword │ Description            │ Type             │
       ├────────┼────────────────────────┼──────────────────┤
       │oif     │ Output interface index │ integer (32 bit) │
       ├────────┼────────────────────────┼──────────────────┤
       │oifname │ Output interface name  │ string           │
       ├────────┼────────────────────────┼──────────────────┤
       │type    │ Address type           │ fib_addrtype     │
       └────────┴────────────────────────┴──────────────────┘
       Using fib expressions
 
       # drop packets without a reverse path
       filter prerouting fib saddr . iif oif missing drop
 
       # drop packets to address not configured on ininterface
       filter prerouting fib daddr . iif type != { local, broadcast, multicast } drop
 
       # perform lookup in a specific 'blackhole' table (0xdead, needs ip appropriate ip rule)
       filter prerouting meta mark set 0xdead fib daddr . mark type vmap { blackhole : drop, prohibit : jump prohibited, unreachable : drop }
~~~

Error in RHEL 7 :

~~~
# RHEL7 - Fresh install of RHEL7.9 minimal + nftables installed.
[root@test7 ~]# nft flush ruleset
[root@test7 ~]# nft list ruleset
[root@test7 ~]# nft add table ip raw
[root@test7 ~]# nft add chain ip raw prerouting "{ type filter hook prerouting priority -300; }"
[root@test7 ~]# nft list ruleset
table ip raw {
        chain prerouting {
                type filter hook prerouting priority -300; policy accept;
        }
}
[root@test7 ~]# nft add rule raw prerouting fib saddr . iif oif missing counter drop
Error: Could not process rule: No such file or directory
add rule raw prerouting fib saddr . iif oif missing counter drop
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
[root@test7 ~]# nft list ruleset
table ip raw {
        chain prerouting {
                type filter hook prerouting priority -300; policy accept;
        }
}
~~~

RHEL 8 works as expected :

~~~
[root@rhel8 ~]# nft list ruleset
[root@rhel8 ~]# nft add table ip raw
[root@rhel8 ~]# nft add chain ip raw prerouting "{ type filter hook prerouting priority -300; }"
[root@rhel8 ~]# nft list ruleset
table ip raw {
	chain prerouting {
		type filter hook prerouting priority raw; policy accept;
	}
}
[root@rhel8 ~]# nft add rule raw prerouting fib saddr . iif oif missing counter drop
[root@rhel8 ~]# nft list ruleset
table ip raw {
	chain prerouting {
		type filter hook prerouting priority raw; policy accept;
		fib saddr . iif oif missing counter packets 0 bytes 0 drop
	}
}
~~~

I belive with below commit the support was added to kernel from RHEL 8.0

~~~
commit 7278e396d053e92270d8120d1e4588b92715206c
Author: Florian Westphal <fwestpha>
Date:   Thu Apr 12 15:04:51 2018 -0400

    [redhat] configs: netfilter: enable nftables fib expression
    
    Message-id: <1523545494-22232-10-git-send-email-fwestpha>
    Patchwork-id: 7622
    O-Subject: [kernel team] [RHEL8 09/12] configs: netfilter: enable nftables fib expression
    Bugzilla: 1566139
    RH-Acked-by: Jiri Benc <jbenc>
    RH-Acked-by: Marcelo Ricardo Leitner <mleitner>
    
    BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1566139
    
    This is glue to perform lookups in the ipv4/ipv6 fib table and
    useful/needed to build reverse path filters, i.e. dropping a
    packet if there is no route torwards the source address.
    
    The inet and netdev versions dispatch to the ipv4 or ipv6
    expression depending on the packet type.
    
    Signed-off-by: Florian Westphal <fwestpha>
    Signed-off-by: Herton R. Krzesinski <herton>

Looks like its from RHEL 8.0 :

$ git describe --contains 7278e396d0
kernel-4.17.0-3.el8~151

$ git tag --contains 7278e396d0 | head -7
RHEL-8.0.0
RHEL-8.1.0
RHEL-8.2.0
RHEL-8.3.0
RHEL-8.4.0
RHEL-8.5.0
RHEL-8.6.0
~~~

upstream commit from 2016 :

~~~
+++
$ git tag --contains f6d0cbcf09c506b9b022df8f9d7693a7cec3c732
v4.10
v4.10-rc1
v4.10-rc2
v4.10-rc3
v4.10-rc4
v4.10-rc5
v4.10-rc6
v4.10-rc7
v4.10-rc8
v4.11

commit f6d0cbcf09c506b9b022df8f9d7693a7cec3c732
Author: Florian Westphal <fw>
Date:   Mon Oct 24 16:56:40 2016 +0200

    netfilter: nf_tables: add fib expression
~~~