[Bug 1118] New: nft: nft -f and nft list ruleset use different sets of service -> port mappings

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1118

            Bug ID: 1118
           Summary: nft: nft -f and nft list ruleset use different sets of
                    service -> port mappings
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: All
            Status: NEW
          Severity: normal
          Priority: P5
         Component: nft
          Assignee: pablo at netfilter.org
          Reporter: joakim.nohlgard at eistec.se

Commit ccc5da470e76032f8e175920553516835efb30f1
(http://git.netfilter.org/nftables/commit/?id=ccc5da470e76032f8e175920553516835efb30f1)
introduced the services.c file which maps port numbers to symbolic service
names as a hard-coded table instead of going through the system services list
in /etc/services.
The restore functionality, on the other hand, still uses the /etc/services list
to convert the service names back to port numbers when loading a configuration
through nft -f <config file>. This can therefore cause problems if the service
list in /etc/services does not match what is hard-coded in the nft binary.

For example, the Dropbox LAN sync service (db-lsp) on 17500/tcp is found in
services.c, but not in the system default /etc/services on an up-to-date
(2017-02-06) Gentoo installation, resulting in a broken configuration when
using nft list ruleset to generate the file.
It will also cause inconsistent state if any of the default ports were modified
in a system configuration and the configuration generated by nft list ruleset
is restored.

There is a trivial work-around: Add all missing services to the /etc/services
file and never change any port numbers.
However, it is unintuitive and inconsistent to have the load and the "save"
functionality use different sets of service names. I use "save" within quotes
because I don't know whether nft list ruleset is meant to use as a backup
functionality, but at least that is how it is used in practice on at least
Gentoo with systemd, possibly more systems.

The error message when a service is missing in /etc/services is:

/var/lib/nftables/rules-save:19:29-34: Error: Could not resolve service:
                 tcp dport { db-lsp} counter packets 0 bytes 0 accept
                             ^^^^^^

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170206/04016901/attachment.html>