<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW - Segfault with iptables-nft-restore when flush rules included"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1407">1407</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>Segfault with iptables-nft-restore when flush rules included
</td>
</tr>
<tr>
<th>Product</th>
<td>nftables
</td>
</tr>
<tr>
<th>Version</th>
<td>unspecified
</td>
</tr>
<tr>
<th>Hardware</th>
<td>x86_64
</td>
</tr>
<tr>
<th>OS</th>
<td>Debian GNU/Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P5
</td>
</tr>
<tr>
<th>Component</th>
<td>iptables over nftable
</td>
</tr>
<tr>
<th>Assignee</th>
<td>pablo@netfilter.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>alb.molina@gmail.com
</td>
</tr></table>
<p>
<div>
<pre>Forwarded from Debian <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950535">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950535</a>
A user reported a segfault with the next ruleset using iptables-nft-restore:
*nat
-F PREROUTING
-A PREROUTING -i eth0 -p tcp --dport 22 -j REDIRECT --to-ports 1194
-F PREROUTING
-F POSTROUTING
COMMIT
I wonder with the inclusion of '-F' rules, but after some tests I can confirm
the segfault with iptables-nft-restore in several iptables releases (1.8.2,
1.8.3 and 1.8.4) while iptables-legacy-restore executes it without a segfault.
The user reported the ruleset was obtained from ufw [1], but according to a
conversation with ufw's creator, this program doesn't include any '-F' rules in
the nat table, so it seems a customization and accidental inclusion of those
rules.
In any case, I considered that this behaviour should be reported upstream.
Regards,
Alberto
[1] <a href="https://launchpad.net/ufw">https://launchpad.net/ufw</a></pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>