opennds: nds_ft_INC grows by one rule every 15 s with nftables 1.1.x (fixed upstream in 8b5a23f / v11.0.0)

Open Beginner friendly
  • Is something wrong?
#31,124 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
72/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
linux, shell
Domain
networking

Research direction

The bug is in the device comparison in libopennds.sh, around lines 2477-2498, where the flowtable's device list from nft -a list flowtables is compared with { usb0 }. nftables prints the name quoted, so the comparison fails on every gatewayroute pass. Start by running the reproduction commands in the issue and confirm the quoted and unquoted forms differ. Done means the comparison matches after stripping the quotes, and the counter return count in nds_mangle nds_ft_INC stays at 1 across several passes 15 s apart.

Written by the indexing model from the issue text.

Description

bug
Package Name

opennds

Maintainer

@bluewavenet

OpenWrt Version

25.12.5

OpenWrt Target/Subtarget

mediatek/filogic

Steps to Reproduce

This is what we did on our device. We have not tried other configurations.

  1. OpenWrt 25.12.x with nftables 1.1.x and opennds 10.3.1-r3 installed and started, with a gatewayinterface, and a default route of the form default via <gw> dev <wan> whose gateway has a neighbour entry (the pass then finds one online:<gw>,<wan> gateway and enters the block at line 2477).

  2. Look at what nftables prints and what the script compares it with:

    nft -a list flowtables | grep -w -A 4 "ndsftINC" | awk -F "devices = " 'NF>1 {printf "%s", $2}'; echo
{ "usb0" }          # quoted; line 2498 compares it with:  { usb0 }

  3. Count the return rules in the chain a few times, 15 s apart. Expected: 1, and no change. Actual: it goes up by one per pass.

    nft -a list chain ip nds_mangle nds_ft_INC | grep -c 'counter.* return'

  4. The comparison on its own, without OpenWrt:

    ftdevices='{ "usb0" }'     # what nftables 1.1.6 prints after "devices = "
wandevices='usb0'          # what libopennds.sh builds from the default routes
[ "$ftdevices" != "{ $wandevices }" ] && echo "differs -> flowtable is re-created on every pass"
ftdevices=$(printf '%s' "$ftdevices" | tr -d "\"")
[ "$ftdevices" = "{ $wandevices }" ] && echo "equal after tr -d"
Actual Behaviour

net/opennds (10.3.1-r1, added in 85f2da3) has the same defect as opennds 10.3.1-r3 in the openwrt-25.12 routing feed. libopennds.sh compares the flowtable's device list with { usb0 } while nftables 1.1.x prints { "usb0" }, so on every gatewayroute pass (about every 15 s) the flowtable is re-created and one more counter return rule is appended to nds_mangle nds_ft_INC (28,788 rules after 5 d 3 h on a GL-MT6000 with OpenWrt 25.12.5).

Upstream fixed it in openNDS 8b5a23f (2025-11-29; contained in v11.0.0). Please either add the one-line patch or update to v11.0.0. Details, reproduction steps and a patch that applies to 10.3.1: https://github.com/openwrt/routing/issues/1208

Confirmation Checklist
Dominant language
Makefile
Stars
4.7k
Forks
4k
Avg merge
2d 14h
Merged PRs (30d)
244

Getting set up

Open in Codespaces

Starts the project's dev container in your browser, under your own GitHub account.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from openwrt/packages

All issues in openwrt/packages

Similar issues

More Networking issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.