Receive: netlink receive: numerical result out of range

[greenpau]

Getting the following error:

Receive: netlink receive: numerical result out of range

It is somehow kernel related. It appeared when I was testing on CentoOS 7 with Linux test1.local 3.10.0-1127.18.2.el7.x86_64 #1 SMP Sun Jul 26 15:27:06 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux. It was not happening with CentOS 8.

The code triggering the issue:

            // Add a new chain
            // defaultDropPolicy := nftables.ChainPolicyDrop
            chain := p.conn.AddChain(&nftables.Chain{
                Name: chainName,
                //Table:    addr.table,
                Table: &nftables.Table{Name: addr.table.Name, Family: addr.table.Family},
                //Type:     nftables.ChainTypeFilter,
                //Hooknum:  nftables.ChainHookForward,
                //Priority: nftables.ChainPriorityFilter,
                //Policy:   &defaultDropPolicy,
            })
            if err := p.conn.Flush(); err != nil {
                return fmt.Errorf(
                    "failed adding chain %s for address %v of interface %s: %s",
                    chainName, addr.conf, intfName, err,
                )
            }

It looks related to: #62

[greenpau]

Further, it is somehow related to chainName. If it is short, e.g. cnins-3-4026535195-dummy0, things work and it gets added. However, if it is longer, e.g. cnins-3-4026535425-dummy0-dummy-9714e150-b953-9224-a988-185420908de0, then it fails.

The max len for the name is 31 characters ...

[greenpau]

Version info:

nftables v0.8 (Joe Btfsplk)

[greenpau]

Once a chain gets created, I am running into the issue #109 . These are connected somehow.

[stapelberg]

Linux 3.10 is pretty old.

There may well be kernel bugs or changes that you’re running into.

Is CentOS one of the distributions that ships a heavily modified kernel? Might be another thing to check/consider.

You could try using the nft command line tool before translating your expressions/code to the nftables Go package, just to narrow down what’s related to the kernel vs. the Go implementation.

[greenpau]

Is CentOS one of the distributions that ships a heavily modified kernel? Might be another thing to check/consider.

@stapelberg , yes. Those are RHEL kernels. The number is a bit misleading.

You could try using the nft command line tool before translating your expressions/code to the nftables Go package, just to narrow down what’s related to the kernel vs. the Go implementation.

Will do.