search for: mcduck

I''m working with a pretty simple config at the moment to track down some issues I''m seeing with custom facts and plugins. I have factsync = true (default locations) and I have a simple fact in /var/lib/puppet/facts/ (actually it''s David''s netmask plugin) my pp file I''m testing with contains only: notice "netmask: ${netmask}" puppet -v

...p tcpproxy { chain preproxy { type nat hook prerouting priority -150; policy accept; tcp dport isakmp mark set 0x00000001 dnat to :smtp } } It seems to work ok, but you can't find out what the rule actually once it's inserted. # nft --version nftables v0.7 (Scrooge McDuck) -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170629/efabb4d4/attachment.html>

....in) Order of the rules in the iptables file, the defined ports, define single/multiple ports do not change the result. Also noticable is that iptables-compat-save prints the imported iptables rules correctly. System: Debian Jessie (amd64) with current updates (14.03.2018) nftables v0.7 (Scrooge McDuck) (dpkg-version 0.7-1) iptables-nftables-compat 1.6.0+snapshot2016117-6 libnftnl4 1.0.7-1 Linux 4.9.0-6 -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/piperma...

...lter { set someset { type ipv4_addr elements = { 1.1.1.1 } } } nft> flush set inet filter someset Error: Could not process rule: Invalid argument flush set inet filter someset ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ # nft --version nftables v0.7 (Scrooge McDuck) and also verified with # nft --version nftables v0.9.0 (Fearless Fosdick) # cat /proc/version Linux version 4.9.0-8-amd64 (debian-kernel at lists.debian.org) (gcc version 6.3.0 20170516 (Debian 6.3.0-18+deb9u1) ) #1 SMP Debian 4.9.144-3 (2019-02-02) -- You are receiving this mail because: You...

...root at max-laptop # journalctl -e -k | grep TEST ``` Current result : no log matching TEST Expected result : 1 log line matching TEST I am using Archlinux ``` % uname -a Linux max-laptop 4.12.6-1-ARCH #1 SMP PREEMPT Sat Aug 12 09:16:22 CEST 2017 x86_64 GNU/Linux % nft -v nftables v0.7 (Scrooge McDuck) ``` -- You are receiving this mail because: You are watching all bug changes. -------------- next part -------------- An HTML attachment was scrubbed... URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170815/d5db0f6b/attachment.html>

...in /usr/share/nftables/ table ip nat { chain input { type nat hook input priority 0; iifname ens3 snat to 10.0.0.0/28 } } System information: # uname -a Linux archlinux 4.13.3-1-ARCH #1 SMP PREEMPT Thu Sep 21 20:33:16 CEST 2017 x86_64 GNU/Linux # nft --version nftables v0.7 (Scrooge McDuck) stack trace (without symbols) with message above shows it's probably an assertion failure: Stack trace of thread 685: #0 0x00007f622879a8a0 raise (libc.so.6) #1 0x00007f622879bf09 abort (libc.so.6) #2 0x00007f62287930dc __ass...

...doesn't move either (no "FORWARD …" logs) which isn't normal ! Did I do something wrong ? Did I misunderstand something ? If arp can't be use on forward hook, why nft doesn't raise an error when I added the chain ? ``` max at mde-test % nft -v nftables v0.7 (Scrooge McDuck) max at mde-test % uname -a Linux mde-test 4.10.13-1-ARCH #1 SMP PREEMPT Thu Apr 27 12:15:09 CEST 2017 x86_64 GNU/Linux ``` More informations can be found here: https://pelican.craoc.fr/nftables.html#arp-vm1-vm2 -- You are receiving this mail because: You are watching all bug changes. ----------...