[Bug 1422] iptables-nft raw notrack rules are wrong

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1422

--- Comment #5 from Etienne Champetier <champetier.etienne at gmail.com> ---
Still not working for me :(

# nft flush table ip raw
# nft -s list ruleset
table ip raw {
    chain PREROUTING {
        type filter hook prerouting priority raw; policy accept;
    }

    chain OUTPUT {
        type filter hook output priority raw; policy accept;
    }
}
# ./iptables/xtables-nft-multi iptables-nft -t raw -I OUTPUT -p udp -d
169.254.25.10 --dport 53 -j NOTRACK
# nft -s list ruleset
table ip raw {
    chain PREROUTING {
        type filter hook prerouting priority raw; policy accept;
    }

    chain OUTPUT {
        type filter hook output priority raw; policy accept;
        meta l4proto udp ip daddr 169.254.25.10 udp dport 53 counter # NOTRACK
    }
}


# nft flush table ip raw
# ./iptables/xtables-nft-multi iptables-nft -t raw -I OUTPUT -p udp -d
169.254.25.10 --dport 53 -j CT --notrack
# nft -s list ruleset
table ip raw {
    chain PREROUTING {
        type filter hook prerouting priority raw; policy accept;
    }

    chain OUTPUT {
        type filter hook output priority raw; policy accept;
        meta l4proto udp ip daddr 169.254.25.10 udp dport 53 counter # CT
notrack
    }
}

# nft --version
nftables v0.9.4 (Jive at Five)

# ./iptables/xtables-nft-multi iptables-nft --version
iptables v1.8.4 (nf_tables)

# git log --oneline 
8d8d2647 (HEAD -> master) extensions: libxt_CT: add translation for NOTRACK
74ef6f1c (origin/master, origin/HEAD) iptables: open eBPF programs in read only
mode

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200415/1820893a/attachment.html>