NFTablesで'nftrace monitor verdict BUG' となったときの対処法

# はじめに
centos8を仮想環境にminimalインストールし、nftablesでNetfilterを操作していた時のこと
[RedHatのページで紹介しているデバッグ方法](https://access.redhat.com/documentation/ja-jp/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/debugging-nftables-rules_getting-started-with-nftables)に従いNFTraceを仕掛けてパケットの行方を追おうとしたところ下記のエラーが出力

```bash
$ nft monitor
trace id 17feb476 ip filter FORWARD packet: iif "docker0" oif "enp0s3" ether saddr 02:42:ac:11:00:02 ether daddr 02:42:3f:22:d2:29 ip saddr 172.17.0.2 ip daddr 192.168.13.1 ip dscp cs0 ip ecn not-ect ip ttl 63 ip id 46652 ip length 56 udp sport 52796 udp dport domain udp length 36 @th,64,96 309489732188109413346705408 
trace id 17feb476 ip filter FORWARD rule udp dport domain nftrace set 1 (verdict continue)
trace id 17feb476 ip filter FORWARD rule counter packets 0 bytes 0 jump DOCKER-USER (verdict BUG: verdict expression length 2048 is too large (2048 bits max)nft: datatype.c:265: verdict_jump_chain_print: Assertion `0' failed.
Aborted (core dumped)
```

これ以上のトレースはできなくなってしまいました。
無事解決できたのでメモ

# 解決
trace機能をつけたときのverdictする際の実装に問題がありそうな内容だが、`coredumpctl`を見たところで関数の内部までわかるはずもなく、Googleに頼ったところ[同じ内容で問い合わせている物を見つけました。](https://bugzilla.redhat.com/show_bug.cgi?id=1763262)どうやら既知のもので、nftables-0.9.2-2.el8.x86_64でFixされている模様。
バグ見つけた時点（2020/05/15）でパッケージマネージャで入れられたnftablesのバージョンは0.9.0でした。

```bash
$ nft --version
nftables v0.9.0 (Fearless Fosdick)
```
そのため[netfilter.org](https://netfilter.org/projects/nftables/)からビルドしてみる。
ファイルをcurlで持ってきて解凍するとINSTALLのインストラクションが入っていた。
以降これに従ってビルドを進めていく

```bash
# Prerequiresをインストール
$ dnf install gcc flex bison pkg-config libtool asciidoc gmp-devel readline-devel

# build用ツールもインストール
$ dnf install make git


# libmnl.pc, libnftnl.psが必要になるのでそれぞれビルドする
# まずlibmnl
$ git clone git://git.netfilter.org/libmnl.git ~/libmnl
$ cd ~/libmnl
$ ./autogen.sh
$ ./configure
$ make && make install

# ./configureの際何も指定しなければこちらのディレクトリにlibmnl.pcが配置されるので環境変数を合わす
$ export 'PKG_CONFIG_PATH=/usr/local/lib/pkgconfig/'

# 次にlibnftnl
$ git clone git://git.netfilter.org/libnftnl.git ~/libnftnl
$ cd ~/libnftnl
$ ./autogen.sh
$ ./configure
$ make && make install

# 最後に本題のnftables
$ git clone git://git.netfilter.org/nftables.git ~/nftables
$ cd ~/nftables
$ ./autogen.sh
$ ./configure
$ make && make install
```

```bash
# 無事インストールできたことを確認 
$ nft --version
nftables v0.9.4 (Jive at Five)
```

この状態でnftraceを行うと、無事トレースすることができました。

```bash
$ nft monitor
trace id cd2ca6af ip filter FORWARD packet: iif "docker0" oif "enp0s3" ether saddr 02:42:ac:11:00:02 ether daddr 02:42:2c:05:ca:aa ip saddr 172.17.0.2 ip daddr 192.168.13.1 ip dscp cs0 ip ecn not-ect ip ttl 63 ip id 17336 ip length 56 udp sport 56284 udp dport 53 udp length 36 @th,64,96 309489732188109413346705408                                                                                            
trace id cd2ca6af ip filter FORWARD rule meta nftrace set 1 (verdict continue)
trace id cd2ca6af ip filter FORWARD rule counter packets 0 bytes 0 jump DOCKER-USER (verdict jump DOCKER-USER)                                                                                             
trace id cd2ca6af ip filter DOCKER-USER verdict return
trace id cd2ca6af ip filter FORWARD rule counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-1 (verdict jump DOCKER-ISOLATION-STAGE-1)                                                                   
trace id cd2ca6af ip filter DOCKER-ISOLATION-STAGE-1 rule iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 jump DOCKER-ISOLATION-STAGE-2 (verdict jump DOCKER-ISOLATION-STAGE-2)           
trace id cd2ca6af ip filter DOCKER-ISOLATION-STAGE-2 verdict return
trace id cd2ca6af ip filter DOCKER-ISOLATION-STAGE-1 verdict return
trace id cd2ca6af ip filter FORWARD rule iifname "docker0" oifname != "docker0" counter packets 0 bytes 0 accept (verdict accept)                                                                          
trace id cd2ca6af inet firewalld filter_FORWARD packet: iif "docker0" oif "enp0s3" ether saddr 02:42:ac:11:00:02 ether daddr 02:42:2c:05:ca:aa ip saddr 172.17.0.2 ip daddr 192.168.13.1 ip dscp cs0 ip ecn
not-ect ip ttl 63 ip id 17336 ip protocol udp ip length 56 udp sport 56284 udp dport 53 udp length 36 @th,64,96 309489732188109413346705408                                                                
trace id cd2ca6af inet firewalld filter_FORWARD rule jump filter_FORWARD_IN_ZONES_SOURCE (verdict jump filter_FORWARD_IN_ZONES_SOURCE)                                                                     
trace id cd2ca6af inet firewalld filter_FORWARD_IN_ZONES_SOURCE verdict continue
trace id cd2ca6af inet firewalld filter_FORWARD rule jump filter_FORWARD_IN_ZONES (verdict jump filter_FORWARD_IN_ZONES)                                                                                   
trace id cd2ca6af inet firewalld filter_FORWARD_IN_ZONES rule goto filter_FWDI_public (verdict goto filter_FWDI_public)                                                                                    
trace id cd2ca6af inet firewalld filter_FWDI_public rule jump filter_FWDI_public_pre (verdict jump filter_FWDI_public_pre)                                                                                 
trace id cd2ca6af inet firewalld filter_FWDI_public_pre verdict continue
trace id cd2ca6af inet firewalld filter_FWDI_public rule jump filter_FWDI_public_log (verdict jump filter_FWDI_public_log)                                                                                 
trace id cd2ca6af inet firewalld filter_FWDI_public_log verdict continue
trace id cd2ca6af inet firewalld filter_FWDI_public rule jump filter_FWDI_public_deny (verdict jump filter_FWDI_public_deny)                                                                               
trace id cd2ca6af inet firewalld filter_FWDI_public_deny verdict continue
trace id cd2ca6af inet firewalld filter_FWDI_public rule jump filter_FWDI_public_allow (verdict jump filter_FWDI_public_allow)                                                                             
trace id cd2ca6af inet firewalld filter_FWDI_public_allow verdict continue
trace id cd2ca6af inet firewalld filter_FWDI_public rule jump filter_FWDI_public_post (verdict jump filter_FWDI_public_post)                                                                               
trace id cd2ca6af inet firewalld filter_FWDI_public_post verdict continue
trace id cd2ca6af inet firewalld filter_FWDI_public verdict continue
trace id cd2ca6af inet firewalld filter_FORWARD rule jump filter_FORWARD_OUT_ZONES_SOURCE (verdict jump filter_FORWARD_OUT_ZONES_SOURCE)                                                                   
trace id cd2ca6af inet firewalld filter_FORWARD_OUT_ZONES_SOURCE verdict continue
trace id cd2ca6af inet firewalld filter_FORWARD rule jump filter_FORWARD_OUT_ZONES (verdict jump filter_FORWARD_OUT_ZONES)                                                                                 
trace id cd2ca6af inet firewalld filter_FORWARD_OUT_ZONES rule oifname "enp0s3" goto filter_FWDO_public (verdict goto filter_FWDO_public)                                                                  
trace id cd2ca6af inet firewalld filter_FWDO_public rule jump filter_FWDO_public_pre (verdict jump filter_FWDO_public_pre)                                                                                 
trace id cd2ca6af inet firewalld filter_FWDO_public_pre verdict continue
trace id cd2ca6af inet firewalld filter_FWDO_public rule jump filter_FWDO_public_log (verdict jump filter_FWDO_public_log)                                                                                 
trace id cd2ca6af inet firewalld filter_FWDO_public_log verdict continue
trace id cd2ca6af inet firewalld filter_FWDO_public rule jump filter_FWDO_public_deny (verdict jump filter_FWDO_public_deny)                                                                               
trace id cd2ca6af inet firewalld filter_FWDO_public_deny verdict continue
trace id cd2ca6af inet firewalld filter_FWDO_public rule jump filter_FWDO_public_allow (verdict jump filter_FWDO_public_allow)                                                                             
trace id cd2ca6af inet firewalld filter_FWDO_public_allow verdict continue
trace id cd2ca6af inet firewalld filter_FWDO_public rule jump filter_FWDO_public_post (verdict jump filter_FWDO_public_post)                                                                               
trace id cd2ca6af inet firewalld filter_FWDO_public_post verdict continue
trace id cd2ca6af inet firewalld filter_FWDO_public verdict continue
trace id cd2ca6af inet firewalld filter_FORWARD rule reject with icmpx type admin-prohibited (verdict drop)
```

パケットの追跡がぐっと楽になりましたね、めでたしめでたし。
近いうちにパッケージマネージャーで管理されるようになるといいなと思います。