Package: nftables
Version: 0.5-1~bpo8+1
This is jessie with jessie-backports enabled and kernel
4.1.0-0.bpo.2-amd64 installed from backports as well.
libc version 2.19-18+deb8u1.
nft started to segfault right after update to 0.5:
(ruleset is empty)
# nft -f /etc/nftables.conf
Segmentation fault
Contents of nftables.conf:
#!/usr/sbin/nft -f
flush ruleset
define ports_nfs = {111, 2049, 9750, 9760}
define ipaddr_yjin = 212.47.240.255/24
define ipaddr4_vpn_melf = 192.168.98.2
define ipaddr6_vpn_melf = 2001:xxxx:xxxx:xxxx::xxxx
define net4_vpn = 192.168.98.0/23
define net6_vpn = 2001:xxxx:xxxx:xxxx::/60
define ipaddr4_ours = 195.154.99.30
table inet filter {
chain icmpfilt {
limit rate 100/second accept
counter drop
}
chain input {
type filter hook input priority 0;
ip protocol icmp jump icmpfilt
ip6 nexthdr ipv6-icmp jump icmpfilt
iif eth0 tcp dport $ports_nfs drop
iif eth0 udp dport $ports_nfs drop
iif != eth0 tcp dport {25, 2022, 17860} drop
iif != eth0 udp dport 17860 drop
iif eth0 ip saddr != $ipaddr_yjin tcp dport 9000 drop
}
chain forward {
type filter hook forward priority 0;
ip protocol icmp jump icmpfilt
ip6 nexthdr ipv6-icmp jump icmpfilt
ct state established,related accept
ip saddr $net4_vpn ip daddr $net4_vpn accept
ip6 saddr $net6_vpn ip6 daddr $net6_vpn accept
iif eth0 ip daddr $ipaddr4_vpn_melf tcp dport 15800
accept
iif eth0 ip daddr $ipaddr4_vpn_melf udp dport 15800
accept
iif eth0 ip6 daddr $ipaddr6_vpn_melf tcp dport 15800
accept
iif eth0 ip6 daddr $ipaddr6_vpn_melf udp dport 15800
accept
iif eth0 drop
}
}
table ip6 filter {
chain output {
type filter hook output priority 0;
udp dport 547 limit rate 10/minute accept
udp dport 547 drop
}
}
table ip nat {
chain prerouting {
type nat hook prerouting priority 0;
iif eth0 ip daddr $ipaddr4_ours tcp dport 15800 dnat
$ipaddr4_vpn_melf
iif eth0 ip daddr $ipaddr4_ours udp dport 15800 dnat
$ipaddr4_vpn_melf
iif eth0 ip daddr $ipaddr4_ours udp dport 443 dnat
$ipaddr4_ours:1194
}
chain postrouting {
type nat hook postrouting priority 0;
oif eth0 ip saddr 192.168.98.0/23 masquerade
}
}