bugzilla-daemon at netfilter.org
2018-Mar-14 14:40 UTC
[Bug 1233] New: Problem with import of small iptables rule sets with multiport match
https://bugzilla.netfilter.org/show_bug.cgi?id=1233 Bug ID: 1233 Summary: Problem with import of small iptables rule sets with multiport match Product: nftables Version: unspecified Hardware: x86_64 OS: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: iptables over nftable Assignee: pablo at netfilter.org Reporter: michael at mi-pietsch.de Created attachment 531 --> https://bugzilla.netfilter.org/attachment.cgi?id=531&action=edit command in and output files I found problems when importing iptables rules with iptables-compat-restore <filename> if it contains multiport matches. Steps to reproduce: 1. import the iptables file X.in with `iptables-compat-restore X.in` 2. run `nft list ruleset > x.out` 3. output for a.in, d.in, e.in, f.in contain unexpected output The files with the used iptables rules and output are include in the bug.tar attachment. I found the following results: * having an single rule containing `multiport` results in output of available protocols (e.in, f.in) * having two `multiport` rules with different match rules (eg. one with `-m state`) results in garbage characters for the rules (a.in, d.in) * having two `multiport` rules with same match and protocols works correctly without garbage characters in output (b.in, g.in) Order of the rules in the iptables file, the defined ports, define single/multiple ports do not change the result. Also noticable is that iptables-compat-save prints the imported iptables rules correctly. System: Debian Jessie (amd64) with current updates (14.03.2018) nftables v0.7 (Scrooge McDuck) (dpkg-version 0.7-1) iptables-nftables-compat 1.6.0+snapshot2016117-6 libnftnl4 1.0.7-1 Linux 4.9.0-6 -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180314/6553c421/attachment.html>
Maybe Matching Threads
- [Bug 1329] New: flush set not working: "Could not process rule: Invalid argument"
- [Bug 1160] New: dnat ip address not shown in nft list output when using port value
- [Bug 1168] New: type nat hook output doesn't work anymore
- [Bug 1187] New: SIGABRT: "BUG: unknown expression type prefix"
- [Bug 1155] New: arp forward filter doesn't work