Firewall going OOM, possible related to nftables migration
Resolved (N/A)PublicBUG
Actions

Assigned To

None

Authored By

	kroy
	Nov 13 2020, 9:56 PM

Description

With the following config, withing minutes of adding rules 55 and 65, VyOS ground to a halt and ran OOM.

Deleting rule 45 brought it immediately back to life.

set firewall name WAN-LAN rule 45 action 'accept'
set firewall name WAN-LAN rule 45 description 'KF2'
set firewall name WAN-LAN rule 45 destination address '172.21.1.60'
set firewall name WAN-LAN rule 45 destination group port-group 'KF2'
set firewall name WAN-LAN rule 45 protocol 'udp'
set firewall name WAN-LAN rule 45 state new 'enable'
set firewall name WAN-LAN rule 55 action 'accept'
set firewall name WAN-LAN rule 55 description 'Factorio'
set firewall name WAN-LAN rule 55 destination address '172.21.1.61'
set firewall name WAN-LAN rule 55 destination port '27015'
set firewall name WAN-LAN rule 55 protocol 'tcp'
set firewall name WAN-LAN rule 55 state new 'enable'
set firewall name WAN-LAN rule 65 action 'accept'
set firewall name WAN-LAN rule 65 description 'Factorio'
set firewall name WAN-LAN rule 65 destination address '172.21.1.61'
set firewall name WAN-LAN rule 65 destination port '27015'
set firewall name WAN-LAN rule 65 protocol 'udp'
set firewall name WAN-LAN rule 65 state new 'enable'
set firewall group port-group KF2 port '7777'
set firewall group port-group KF2 port '27015'
set firewall group port-group KF2 port '20560'
set firewall group port-group KF2 port '123'

Associated NAT rules:

set nat destination rule 40 description 'KF2'
set nat destination rule 40 destination port '123,7777,20560,27015'
set nat destination rule 40 inbound-interface 'eth0'
set nat destination rule 40 protocol 'udp'
set nat destination rule 40 translation address '172.21.1.60'
set nat destination rule 50 description 'Factorio'
set nat destination rule 50 destination port '27105,34197'
set nat destination rule 50 inbound-interface 'eth0'
set nat destination rule 50 protocol 'udp'
set nat destination rule 50 translation address '172.21.1.61'
set nat destination rule 60 description 'Factorio'
set nat destination rule 60 destination port '27105'
set nat destination rule 60 inbound-interface 'eth0'
set nat destination rule 60 protocol 'tcp'
set nat destination rule 60 translation address '172.21.1.61'

Details

Difficulty level: Unknown (require assessment)
Version: 1.3
Why the issue appeared?: Will be filled on close
Is it a breaking change?: Unspecified (possibly destroys the router)
Issue type: Bug (incorrect behavior)

Event Timeline

@c-po It was thought that possibly the nftables migration was doing something funny here because of the potential overlaps.

vindenesen added a subscriber: vindenesen.Nov 14 2020, 1:20 PM

pasik added a subscriber: pasik.Nov 15 2020, 10:13 AM

Possible reason - ipset should be converted to nft list set

ipset

vyos@r4-roll:~$ sudo ipset -L
Name: KF2
Type: bitmap:port
Revision: 3
Header: range 1-65535
Size in memory: 8264
References: 1
Number of entries: 4
Members:
123
7777
20560
27015
vyos@r4-roll:~$

ipset show

vyos@r4-roll:~$ sudo ipset save
create KF2 bitmap:port range 1-65535
add KF2 123
add KF2 7777
add KF2 20560
add KF2 27015
vyos@r4-roll:~$

nft sets

vyos@r4-roll:~$ sudo nft list sets
table ip raw {
}
table ip filter {
}
table ip6 raw {
}
table ip6 filter {
}
table ip6 mangle {
}
table ip6 nat {
}
table ip nat {
}
vyos@r4-roll:~$

jack9603301 added a subscriber: jack9603301.Nov 15 2020, 1:41 PM

yun added a subscriber: yun.Dec 31 2020, 9:13 AM

dmbaturin added a project: test.Jul 29 2021, 8:50 AM

erkin set Issue type to Feature (new functionality).Aug 29 2021, 12:16 PM

erkin removed a subscriber: Active contributors.

syncer edited projects, added VyOS 1.3 Equuleus (1.3.0-epa1); removed test, VyOS 1.3 Equuleus.Sep 5 2021, 7:06 AM

@kroy Did you get it with any other rc versions?

syncer edited projects, added VyOS 1.3 Equuleus (1.3.0); removed VyOS 1.3 Equuleus (1.3.0-epa1).Nov 1 2021, 10:09 PM

@kroy Are you still having trouble with it?

syncer edited projects, added VyOS 1.3 Equuleus (1.3.3); removed VyOS 1.3 Equuleus (1.3.0).Aug 29 2022, 7:04 AM

syncer edited projects, added VyOS 1.3 Equuleus (1.3.4); removed VyOS 1.3 Equuleus (1.3.3).Jul 12 2023, 9:40 PM

syncer edited projects, added VyOS 1.3 Equuleus (1.3.5); removed VyOS 1.3 Equuleus (1.3.4).Aug 25 2023, 9:29 PM