<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW - "COMMIT expected at line ..." when iptables-restore 1.8.4 (nft) parses stdin with empty lines"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1400#c1">Comment # 1</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW - "COMMIT expected at line ..." when iptables-restore 1.8.4 (nft) parses stdin with empty lines"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1400">bug 1400</a>
from <span class="vcard"><a class="email" href="mailto:jamie@strandboge.com" title="jamie@strandboge.com">jamie@strandboge.com</a>
</span></b>
<pre>In looking to find a workaround for ufw to workaround this bug, I found that in
addition to blank lines in the middle of the policy causing
iptables-nft-restore to cause an error (the original report), a blank line
outside of the policy causes iptables-nft-restore to silently ignore the policy
but return a successful error code. Eg:
$ cat /tmp/pol
# this next blank line causes the file to not load
*filter
# comment
-A INPUT -j ACCEPT
COMMIT
$
Calling iptables-nft-restore on the policy file itself works fine:
$ sudo iptables-nft-restore /tmp/pol && echo yes
yes
$ sudo iptables-nft -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
$ sudo iptables-nft -D INPUT -j ACCEPT # remove the test rule
$ sudo iptables-nft -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
But reading the file on stdin results in a successful return code but no rule
added:
$ cat /tmp/pol | sudo iptables-nft-restore -n && echo yes
yes
$ sudo iptables-nft -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
This is a regression over 1.8.2 where it works correctly:
$ cat /tmp/pol
# this next blank line causes the file to not load
*filter
# comment
-A INPUT -j ACCEPT
COMMIT
$
$ sudo iptables-nft-restore /tmp/pol && echo yes
yes
$ sudo iptables-nft -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
$ sudo iptables-nft -D INPUT -j ACCEPT # remove the test rule
$ sudo iptables-nft -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
$ cat /tmp/pol | sudo iptables-nft-restore -n && echo yes
yes
$ sudo iptables-nft -L INPUT -n
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>