netfilter buglog - Mar 2018 - [Bug 1234] New: iptables match-set with multiple ipsets doesn't work

https://bugzilla.netfilter.org/show_bug.cgi?id=1234

            Bug ID: 1234
           Summary: iptables match-set with multiple ipsets doesn't work
           Product: iptables
           Version: 1.4.x
          Hardware: x86_64
                OS: Debian GNU/Linux
            Status: NEW
          Severity: normal
          Priority: P5
         Component: iptables
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: kevin at zattoo.com

I try to add multiple match-sets in one rule. I can add it, but afterwards the
rule doesn't work (counter stays at zero)

iptables -A INPUT -p tcp -m multiport --dports 22 -m comment --comment "012
accept incoming SSH" -m set --match-set trustednet src -m set --match-set
NETS
src -j ACCEPT

If I split them into two rules, it works without any issue.

Tested it with iptables 1.4 and 1.6.
ipset v6.23

Maybe this behavior is expected, but I didn't find anything in the man pages
or
documentation.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180316/7546e124/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1234

Jozsef Kadlecsik <kadlec at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |kadlec at netfilter.org

--- Comment #1 from Jozsef Kadlecsik <kadlec at netfilter.org> ---
All matches in an iptables rule are AND-ed, so your rule matches only if the
source address of the packet matches both the trustednets and NETS sets.

With this in mind I cannot reproduce the problem.

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20180601/b767b053/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1234

Jozsef Kadlecsik <kadlec at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |INVALID
             Status|NEW                         |RESOLVED

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20190712/dce09230/attachment.html>