View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0017478 | CentOS-8 | iptables | public | 2020-06-17 15:30 | 2020-08-04 14:46 |
| Reporter | zztalker | ||||
| Priority | normal | Severity | major | Reproducibility | always |
| Status | new | Resolution | open | ||
| Product Version | 8.1.1911 | ||||
| Target Version | Fixed in Version | ||||
| Summary | 0017478: iptables-restore couldn't check valid rules | ||||
| Description | When I use iptables-restore to check the persistence of valid rules I've got strange errors: # cat /vagrant/fail1.check *filter --check INPUT -j test_chain --check test_chain -j jump_chain --check test_chain -j jump_chain2 --check test_chain -p tcp -m multiport --dports 20003,20004,20013,20014 -j DROP COMMIT *nat --check PREROUTING -j test_chain COMMIT # iptables-restore --noflush --verbose < /vagrant/fail1.check iptables-restore v1.8.2 (nf_tables): Extension does not know id 63 | ||||
| Steps To Reproduce | To reproduce: # ipset create test_set hash:net # ipset create test.set.v4.1 hash:net # ipset create test.set.v4.2 hash:net # ipset create test.set.v4.3 hash:net # ipset create test.set.v4.4 hash:net # ipset create test.set.v4.5 hash:net # ipset create test.set.v4.6 hash:net # iptables-restore < /vagrant/fill_iptables # cat /vagrant/fill_iptables # Generated by xtables-save v1.8.2 on Tue Jun 2 09:45:46 2020 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :test_chain - [0:0] :jump_chain - [0:0] :jump_chain2 - [0:0] -A INPUT -j test_chain -A test_chain -m set --match-set test.set.v4.1 src -j RETURN -A test_chain -m set --match-set test.set.v4.2 src -j RETURN -A test_chain -m set --match-set test.set.v4.3 src -j RETURN -A test_chain -m set --match-set test.set.v4.4 src -j RETURN -A test_chain -m set --match-set test.set.v4.5 src -j DROP -A test_chain -m set --match-set test.set.v4.6 src -j DROP -A test_chain -j jump_chain -A test_chain -p tcp -m multiport --dports 20003,20004,20013,20014 -j DROP -A test_chain -j jump_chain2 -A test_chain -m set --match-set test_set src -j RETURN COMMIT # Completed on Tue Jun 2 09:45:46 2020 # Generated by xtables-save v1.8.2 on Tue Jun 2 09:45:46 2020 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :test_chain - [0:0] -A PREROUTING -j test_chain -A test_chain -m set --match-set test_set src -j RETURN COMMIT # Completed on Tue Jun 2 09:45:46 2020 # cat /vagrant/fail1.check *filter --check INPUT -j test_chain --check test_chain -j jump_chain --check test_chain -j jump_chain2 --check test_chain -p tcp -m multiport --dports 20003,20004,20013,20014 -j DROP COMMIT *nat --check PREROUTING -j test_chain COMMIT # iptables-restore --noflush --verbose < /vagrant/fail1.check iptables-restore v1.8.2 (nf_tables): Extension does not know id 63 It may be examined with Vagrant: git clone https://github.com/zztalker/centos8iptables_bug.git cd centos8iptables_bug/c8 vagrant up && vagrant ssh -c "sudo bash /vagrant/fails.sh" | ||||
| Tags | iptables | ||||
