<html>
    <head>
      <base href="https://bugzilla.netfilter.org/" />
    </head>
    <body><table border="1" cellspacing="0" cellpadding="8">
        <tr>
          <th>Bug ID</th>
          <td><a class="bz_bug_link 
          bz_status_NEW "
   title="NEW - Segfault with iptables-nft-restore when flush rules included"
   href="https://bugzilla.netfilter.org/show_bug.cgi?id=1407">1407</a>
          </td>
        </tr>

        <tr>
          <th>Summary</th>
          <td>Segfault with iptables-nft-restore when flush rules included
          </td>
        </tr>

        <tr>
          <th>Product</th>
          <td>nftables
          </td>
        </tr>

        <tr>
          <th>Version</th>
          <td>unspecified
          </td>
        </tr>

        <tr>
          <th>Hardware</th>
          <td>x86_64
          </td>
        </tr>

        <tr>
          <th>OS</th>
          <td>Debian GNU/Linux
          </td>
        </tr>

        <tr>
          <th>Status</th>
          <td>NEW
          </td>
        </tr>

        <tr>
          <th>Severity</th>
          <td>normal
          </td>
        </tr>

        <tr>
          <th>Priority</th>
          <td>P5
          </td>
        </tr>

        <tr>
          <th>Component</th>
          <td>iptables over nftable
          </td>
        </tr>

        <tr>
          <th>Assignee</th>
          <td>pablo@netfilter.org
          </td>
        </tr>

        <tr>
          <th>Reporter</th>
          <td>alb.molina@gmail.com
          </td>
        </tr></table>
      <p>
        <div>
        <pre>Forwarded from Debian <a href="https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950535">https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=950535</a>

A user reported a segfault with the next ruleset using iptables-nft-restore:

*nat
-F PREROUTING
-A PREROUTING -i eth0 -p tcp --dport 22 -j REDIRECT --to-ports 1194
-F PREROUTING
-F POSTROUTING
COMMIT

I wonder with the inclusion of '-F' rules, but after some tests I can confirm
the segfault with iptables-nft-restore in several iptables releases (1.8.2,
1.8.3 and 1.8.4) while iptables-legacy-restore executes it without a segfault.

The user reported the ruleset was obtained from ufw [1], but according to a
conversation with ufw's creator, this program doesn't include any '-F' rules in
the nat table, so it seems a customization and accidental inclusion of those
rules.

In any case, I considered that this behaviour should be reported upstream.

Regards,

Alberto

[1] <a href="https://launchpad.net/ufw">https://launchpad.net/ufw</a></pre>
        </div>
      </p>
      <hr>
      <span>You are receiving this mail because:</span>
      
      <ul>
          <li>You are watching all bug changes.</li>
      </ul>
    </body>
</html>