netfilter buglog - Feb 2020 - [Bug 1408] New: The Check option of iptables does not work as expected

https://bugzilla.netfilter.org/show_bug.cgi?id=1408

            Bug ID: 1408
           Summary: The Check option of iptables does not work as expected
           Product: nftables
           Version: unspecified
          Hardware: arm
                OS: Ubuntu
            Status: NEW
          Severity: minor
          Priority: P5
         Component: iptables over nftable
          Assignee: pablo at netfilter.org
          Reporter: ed at kapitein.org

when checking if a dnat rule exist ( with the --check option )  the
--to-destination is not checked correctly.

i have a rule:
 pkts bytes target     prot opt in     out     source               destination 
    1    44 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0  
         tcp dpt:80 to:192.168.59.43:80

if i check if the rule exists, the exit code is 0, as expected:
sudo iptables -t nat -C PREROUTING --proto tcp --dport 80 -j DNAT
--to-destination 192.168.59.43:80; echo $?
0

however, if i change the -to-destination to a bogus value,
the check still returns 0, and that is unexpected:
sudo iptables -t nat -C PREROUTING --proto tcp --dport 80 -j DNAT
--to-destination 1.2.3.4:5; echo $?
0

if i change the protocol from tcp to udp the check fails, as expected:
sudo iptables -t nat -C PREROUTING --proto udp --dport 80 -j DNAT
--to-destination 192.168.59.43:80; echo $?
iptables: Bad rule (does a matching rule exist in that chain?).
1

Is there a way to check the -to-destination also?


Some info on the environment:
Version: iptables v1.8.2 (nf_tables)
OS: raspbian buster
Kernel: Linux blahblah 4.19.93-v7+ #1290 SMP Fri Jan 10 16:39:50 GMT 2020
armv7l GNU/Linux
Platform: raspberry pi 3B+

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200222/ace2a49c/attachment.html>

https://bugzilla.netfilter.org/show_bug.cgi?id=1408

Pablo Neira Ayuso <pablo at netfilter.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

--- Comment #1 from Pablo Neira Ayuso <pablo at netfilter.org> ---
Could you give a try latest iptables? If I understood the problem correctly, it
is working here in the most recent iptables release.

# iptables-nft -V
iptables v1.8.4 (nf_tables)

# iptables-nft -t nat -C PREROUTING --proto tcp --dport 80 -j DNAT
--to-destination 1.1.1.1:80; echo $?
0
# iptables-nft -t nat -C PREROUTING --proto tcp --dport 80 -j DNAT
--to-destination 1.1.1.2:80; echo $?
iptables: Bad rule (does a matching rule exist in that chain?).
1

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200415/d7b46bbe/attachment.html>