#959989 nftables: nft does not recognize imap service

Package:
nftables
Source:
nftables
Description:
Program to control packet filtering rules by Netfilter project
Submitter:
Artur Pydo
Date:
2021-02-19 17:03:05 UTC
Severity:
normal
Tags:
#959989#5
Date:
2020-05-07 23:03:42 UTC
From:
To:
Dear Maintainer,

While setting fail2ban with nftables (with default /etc/nftables.conf) the firewall initialization command failed on fail2ban start :

nft insert rule inet filter input tcp dport \{ smtp,465,submission,imap,imaps,pop3,pop3s \} ip saddr @f2b-postfix-sasl reject

failed with the following error : Error: Could not resolve service: Servname not found in nft services list
The error was related to 'imap' service.

However, in /etc/services imap service is defined as follows :
imap2           143/tcp         imap            # Interim Mail Access P 2 and 4

This service main name is 'imap2' and there is also an alias set to 'imap'.
It seems that nft does not take into account this service alias.

Replacing 'imap' with 'imap2' solved the nft problem :
nft insert rule inet filter input tcp dport \{ smtp,465,submission,imap2,imaps,pop3,pop3s \} ip saddr @f2b-postfix-sasl reject

Please note that to solve this problem in fail2ban, one have to change the default ports list in jail.local.
Example of working /etc/fail2ban/jail.local :
[DEFAULT]
banaction = nftables-multiport
banaction_allports = nftables-allports

[postfix-sasl]
enabled  = true
port     = smtp,465,submission,imap2,imaps,pop3,pop3s

[dovecot]
enabled  = true
port    = pop3,pop3s,imap2,imaps,submission,465,sieve

One may expect to have imap service resolved in nft and to have a default working configuration in fail2ban

Thanks for your attention.
#959989#10
Date:
2020-05-08 09:09:14 UTC
From:
To:
Control: tags -1 moreinfo

I cannot reproduce this. The same rule worked here:

=== 8< ===
arturo@endurance:~$ sudo nft insert rule inet filter input tcp dport \{
smtp,465,submission,imap,imaps,pop3,pop3s \}

arturo@endurance:~$ sudo nft -S list ruleset
table inet filter {
	chain input {
		type filter hook input priority filter; policy accept;
		tcp dport { "smtp", "pop3", "imap2", "submissions", "submission", "imaps",
"pop3s" }
[...]
=== 8< ===

This is my services file:

=== 8< ===
arturo@endurance:~$ grep imap /etc/services
imap2		143/tcp		imap		# Interim Mail Access P 2 and 4
imaps		993/tcp				# IMAP over SSL
=== 8< ===


I wonder if fail2ban is wrapping the call to the nft binary in a way that
prevents it from doing the getaddrinfo() call. This seems unlikely anyway.
#959989#17
Date:
2020-05-08 10:05:16 UTC
From:
To:
Hi,

Le 08/05/2020 à 11:09, Arturo Borrero Gonzalez a écrit :

I reproduce this problem the exact same way in shell :

# nft insert rule inet filter input tcp dport \{
smtp,465,submission,imap,imaps,pop3,pop3s \} ip saddr @f2b-pos
                                    tfix-sasl reject
Error: Could not resolve service: Servname not found in nft services list
insert rule inet filter input tcp dport {
smtp,465,submission,imap,imaps,pop3,pop3s } ip saddr @f2b-postfix-sasl
reject
                                                              ^^^^

I also tried 'sudo nft...' with the same error.

I am able to reproduce it on two different servers. One upgraded from
older Debian versions and the second one is a clean install on a cloud
instance.

How can I help ?