Hi Pablo,
Thanks a lot for the quick reponse!
On Sun, Jun 25, 2023, at 18:05 CDT, Pablo Neira Ayuso pablo@netfilter.org wrote:
[...]
Could you give a try to these two fixes on top?
26b5a5712eb8 netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain 4bedf9eee016 netfilter: nf_tables: fix chain binding transaction logic
These two patches alone were not enough, I had to apply the third patch you mentioned:
https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230625224219.64...
With all three patches I do not run into the oops any more.
Nevertheless, please find below a (somehwat minimal) reproducer. Loading this ruleset into nft_tables via $ nft -f reproducer.ruleset previously oopsed the kernel.
Best, Matthias
define guarded_ports = {ssh}
table inet portknock { set clients_ipv4 { type ipv4_addr flags timeout }
set candidates_ipv4 { type ipv4_addr . inet_service flags timeout }
chain input { type filter hook input priority -10; policy accept;
tcp dport 10001 add @candidates_ipv4 {ip saddr . 10002 timeout 1s} tcp dport 10002 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip saddr . 10003 timeout 1s} tcp dport 10003 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip saddr . 10004 timeout 1s} tcp dport 10004 ip saddr . tcp dport @candidates_ipv4 add @candidates_ipv4 {ip saddr . 10005 timeout 1s} tcp dport 10005 ip saddr . tcp dport @candidates_ipv4 add @clients_ipv4 {ip saddr timeout 600s} log prefix "Successful portknock: "
tcp dport $guarded_ports ip saddr @clients_ipv4 counter accept tcp dport $guarded_ports ct state established,related counter accept
tcp dport $guarded_ports reject with tcp reset } }