<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - nft: nft -f and nft list ruleset use different sets of service -> port mappings"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1118">1118</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>nft: nft -f and nft list ruleset use different sets of service -> port mappings
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>All
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>nft
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>joakim.nohlgard@eistec.se
</td>
</tr></table>
<p>
<div>
<pre>Commit ccc5da470e76032f8e175920553516835efb30f1
(<a href="http://git.netfilter.org/nftables/commit/?id=ccc5da470e76032f8e175920553516835efb30f1">http://git.netfilter.org/nftables/commit/?id=ccc5da470e76032f8e175920553516835efb30f1</a>)
introduced the services.c file which maps port numbers to symbolic service
names as a hard-coded table instead of going through the system services list
in /etc/services.
The restore functionality, on the other hand, still uses the /etc/services list
to convert the service names back to port numbers when loading a configuration
through nft -f <config file>. This can therefore cause problems if the service
list in /etc/services does not match what is hard-coded in the nft binary.
For example, the Dropbox LAN sync service (db-lsp) on 17500/tcp is found in
services.c, but not in the system default /etc/services on an up-to-date
(2017-02-06) Gentoo installation, resulting in a broken configuration when
using nft list ruleset to generate the file.
It will also cause inconsistent state if any of the default ports were modified
in a system configuration and the configuration generated by nft list ruleset
is restored.
There is a trivial work-around: Add all missing services to the /etc/services
file and never change any port numbers.
However, it is unintuitive and inconsistent to have the load and the "save"
functionality use different sets of service names. I use "save" within quotes
because I don't know whether nft list ruleset is meant to use as a backup
functionality, but at least that is how it is used in practice on at least
Gentoo with systemd, possibly more systems.
The error message when a service is missing in /etc/services is:
/var/lib/nftables/rules-save:19:29-34: Error: Could not resolve service:
tcp dport { db-lsp} counter packets 0 bytes 0 accept
^^^^^^</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>