netfilter buglog - Mar 2018 - [Bug 1233] New: Problem with import of small iptables rule sets with multiport match

https://bugzilla.netfilter.org/show_bug.cgi?id=1233

            Bug ID: 1233
           Summary: Problem with import of small iptables rule sets with
                    multiport match
           Product: nftables
           Version: unspecified
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: iptables over nftable
          Assignee: pablo at netfilter.org
          Reporter: michael at mi-pietsch.de

Created attachment 531
  --> https://bugzilla.netfilter.org/attachment.cgi?id=531&action=edit
command in and output files

I found problems when importing iptables rules with iptables-compat-restore
<filename> if it contains multiport matches. 

Steps to reproduce:
1. import the iptables file X.in with `iptables-compat-restore X.in` 
2. run `nft list ruleset > x.out`
3. output for a.in, d.in, e.in, f.in contain unexpected output
The files with the used iptables rules and output are include in the bug.tar
attachment.

I found the following results:
* having an single rule containing `multiport` results in output of available
protocols (e.in, f.in)
* having two `multiport` rules with different match rules (eg. one with `-m
state`) results in garbage characters for the rules (a.in, d.in)
* having two `multiport` rules with same match and protocols works correctly
without garbage characters in output (b.in, g.in)

Order of the rules in the iptables file, the defined ports, define
single/multiple ports do not change the result.

Also noticable is that iptables-compat-save prints the imported iptables rules
correctly.

System: Debian Jessie (amd64) with current updates (14.03.2018)
nftables v0.7 (Scrooge McDuck)  (dpkg-version 0.7-1)
iptables-nftables-compat 1.6.0+snapshot2016117-6
libnftnl4  1.0.7-1
Linux 4.9.0-6

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180314/6553c421/attachment.html>