[Bug 1166] New: negated rule and rule with mistyped interface name looks identical in non-verbose iptables output

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1166

            Bug ID: 1166
           Summary: negated rule and rule with mistyped interface name
                    looks identical in  non-verbose iptables output
           Product: iptables
           Version: unspecified
          Hardware: x86_64
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: iptables
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: suawekk at gmail.com

Here's the thing:

I was adding rule for masquerading packets from VM bridge, and I wanted to add
rule that applies masquerade for packages leaving laptop with VMs on all
interfaces excluding one (vm bridge) because why not.

And I made little typo
Instead of 

iptables -t nat -A POSTROUTING -s 10.118.196.0/24 \! -o lxdbr0 -j MASQUERADE 

I typed:
iptables -vv -t nat -A POSTROUTING -s 10.118.196.0/24 -o \! lxdbr0 -j
MASQUERADE 

I noticed that rule wasn't matching so after a while I noticed what was the
problem.

But funny thing is:
both rules when displaying them with `iptables -t nat -nvL` are shown as
follows:

    0     0 MASQUERADE  all  --  *      !lxdbr0  10.118.196.0/24      0.0.0.0/0 
    6   628 MASQUERADE  all  --  *      !lxdbr0  10.118.196.0/24      0.0.0.0/0 

You can see that first rule (one with mistake) is displayed identically but
doesn't match.
Displaying rules with more verbosity (iptables -nvvL) show that first rule
tries to match packets going 
through interface with literal name `!lxdbr0` while second rule matches packets
going through `lxdbr0` but 
with inversion flag set to `02`

I'm not sure whether it's expected so I wrote this report so you can decide
whether it's bug or feature ;)

System info:
OS: archlinux latest
iptables v.1.6.1
kernel: 4.12.3-1-ARCH

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20170807/20152fbf/attachment.html>