bugzilla-daemon at netfilter.org
2019-Jan-21 06:54 UTC
[Bug 1318] New: Fragmented packet filtering is broken iptables compatibility tools
https://bugzilla.netfilter.org/show_bug.cgi?id=1318
Bug ID: 1318
Summary: Fragmented packet filtering is broken iptables
compatibility tools
Product: nftables
Version: unspecified
Hardware: x86_64
OS: other
Status: NEW
Severity: normal
Priority: P5
Component: iptables over nftable
Assignee: pablo at netfilter.org
Reporter: arnova at rocky.eld.leidenuniv.nl
When using the iptables compatibility tools, creating rules for packet
defragmentation result in incorrect rules. When eg. using "iptables-compat
-A
INPUT -f -j DROP" it results in "ip frag-off & 65311 == 0
...." when it should
be "ip frag-off != 0 .....". The same thing occurs when using
iptables-compat
restore|save. I can confirm this happens with both "iptables (compat)
v1.6.1 /
nftables 0.8.2" on Mint x64 and RHEL 8-BETA with "iptables (compat)
1.8.0 and
nftables 0.9.0"
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20190121/c031f425/attachment.html>
bugzilla-daemon at netfilter.org
2019-Jul-14 09:31 UTC
[Bug 1318] Fragmented packet filtering is broken iptables compatibility tools
https://bugzilla.netfilter.org/show_bug.cgi?id=1318
Florian Westphal <fw at strlen.de> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |fw at strlen.de
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #1 from Florian Westphal <fw at strlen.de> ---
(In reply to Arno from comment #0)> When using the iptables compatibility tools, creating rules for packet
> defragmentation result in incorrect rules. When eg. using
"iptables-compat
> -A INPUT -f -j DROP" it results in "ip frag-off & 65311 == 0
...." when it
> should be "ip frag-off != 0 .....". The same thing occurs when
using
> iptables-compat restore|save. I can confirm this happens with both
"iptables
> (compat) v1.6.1 / nftables 0.8.2" on Mint x64 and RHEL 8-BETA with
"iptables
> (compat) 1.8.0 and nftables 0.9.0"
Works for me on iptables-nft 1.8.2.
--
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20190714/4d7dd7a6/attachment.html>