<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - SET target unreliable in iptables - add does not work as expected"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1101">1101</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>SET target unreliable in iptables - add does not work as expected
</td>
</tr>
<tr>
<th>Product</th>
<td>netfilter/iptables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>major
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>ip_tables (kernel)
</td>
</tr>
<tr>
<th>Assignee</th>
<td>netfilter-buglog@lists.netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>koetter@luis.uni-hannover.de
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=486" name="attach_486" title="iptables -nvL special-unused:filter">attachment 486</a> <a href="attachment.cgi?id=486&action=edit" title="iptables -nvL special-unused:filter">[details]</a></span>
iptables -nvL special-unused:filter
I'm with debian Jessie,
Linux <> 3.16.0-4-amd64 #1 SMP Debian 3.16.36-1+deb8u2 (2016-10-19) x86_64
GNU/Linux
iptables v1.4.21
ipset v6.23, protocol version: 6
I use the ipset SET target to create dynamic lists of addresses to block.
The problem: the SET target fails with ~50% of the cases to add an address
properly. A subsequent match on the ipset fails - the address is not added to
the set.
To provide an example, I modified my rules to add & match subsequently - one
would expect the counters to match, but they do not.
It is possible to verify an address is not added to the set using ipset
userspace as well.
The ipset has about 20k entries, adding via ipset cli always works as expected.
The machine I'm working does quite some traffic - so it may be a race condition
and hard to reproduce.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>