Netfilter rules check NOT successful: immediate-goto rule not found

[pkuzak]

rtpengine version the issue has been seen with

Master branch, commit 840c2a84e3e3e40c3c73a9faa9a48e3ffbb5de9e

Used distribution and its version

Debian 11

Linux kernel version used

5.10.0-27-amd64

CPU architecture issue was seen on (see uname -m)

x86_64

Expected behaviour you didn't see

Getting Netfilter rules check SUCCESSFUL upon executing rtpengine --nftables-status

Unexpected behaviour you saw

Getting Netfilter rules check NOT successful: immediate-goto rule not found upon executing rtpengine --nftables-status

Steps to reproduce the problem

Start rtpengine without any nftables* options in configuration file and execute rtpengine --nftables-status after successfully starting the service with Kernel forwarding support.

Additional program output to the terminal or logs illustrating the issue

No response

Anything else?

Actually I am not sure if this is a bug in the code or a bug in my configuration. As mentioned, I do not have any nftables* options present in my configuration file, so default values are used. The output of nft list ruleset looks OK to me compared to the example from the doc:

table ip filter {
....
    chain INPUT {
        type filter hook input priority filter; policy accept;
        ip protocol udp counter packets 4894 bytes 915243 jump rtpengine
        ct state invalid counter packets 49 bytes 10984 drop
        ct state related,established counter packets 32453 bytes 89562936 accept
        meta l4proto icmp counter packets 655 bytes 30726 accept
        iifname "lo" fib saddr type local  counter packets 384 bytes 37132 accept
        iifname "eth0" counter packets 475 bytes 54280 jump rules_int
        iifname "eth1" counter packets 53 bytes 5147 jump rules_ext
        counter packets 0 bytes 0 log prefix "[FW-OTH] " level debug
        counter packets 0 bytes 0 jump BLOCK
    }
....
    chain rtpengine {
        counter packets 690 bytes 75019
    }
....

When making a call, the logs look also OK and counters in /proc/rtpengine/0/list are also increased during the call. (0 is the configured Kernel table in configuration file). For more background information: We want to migrate to a newer rtpengine version which uses nftables. We still want to use iptables for managing the firewall, and use nftables just to forward RT(C)P packets to rtpengine Kernel module. I think this should be doable, at least this is how I understand the comment in #1739.

[rfuchs]

Can't really reproduce this on a Debian 11. Are you running rtpengine --nftables-status under sudo?

[pkuzak]

Strange. Yes, I run it as root. Does your nft list ruleset output look the same as I've posted?

[rfuchs]

Strange. Yes, I run it as root. Does your nft list ruleset output look the same as I've posted?

It does (almost) except for the additional complaint about not knowing what RTPENGINE is, which is at the very top of the output.

XT target RTPENGINE not found
XT target RTPENGINE not found
table ip filter {
    chain rtpengine {
        counter packets 6 bytes 989
    }

    chain INPUT {
        type filter hook input priority filter; policy accept;
        ip protocol udp counter packets 6 bytes 989 jump rtpengine
    }
}
table ip6 filter {
...

[pkuzak]

OK I know what's the difference between your and my setup. I initially have rules in iptables. When I start nftables some of the rules get migrated there (and the content of iptables gets flushed). So my nftables rule set is not empty. When I start the nftables service with an empty iptables list, the check command succeeds as well.

[rfuchs]

There should be a compatibility package that lets you use iptables together with nftables, but it looks like that doesn't exist in Debian 11?

[pkuzak]

I think I can use both together, this is not the issue. After starting nftables service I can fill back my iptables rules and everything works OK. Just the question whether the nftables-status command is broken or not for not empty nftables rule set.

[rfuchs]

Ok I see the problem. Patch is coming.