[Bug 1422] iptables-nft raw notrack rules are wrong

[bugzilla-daemon at netfilter.org]

https://bugzilla.netfilter.org/show_bug.cgi?id=1422

--- Comment #9 from Etienne Champetier <champetier.etienne at gmail.com> ---
Using '-j CT --notrack' works
Using '-j NOTRACK' I still can't check/delete

# /usr/local/sbin/iptables-nft -t raw -I OUTPUT -p udp -d 169.254.25.10 --dport
53 -j NOTRACK && echo ok
ok
# /usr/local/sbin/nft -s list ruleset
table ip raw {
    chain PREROUTING {
        type filter hook prerouting priority raw; policy accept;
    }

    chain OUTPUT {
        type filter hook output priority raw; policy accept;
        meta l4proto udp ip daddr 169.254.25.10 udp dport 53 counter notrack
    }
}
# /usr/local/sbin/iptables-nft -t raw -C OUTPUT -p udp -d 169.254.25.10 --dport
53 -j NOTRACK
iptables: Bad rule (does a matching rule exist in that chain?).
# /usr/local/sbin/iptables-nft -t raw -D OUTPUT -p udp -d 169.254.25.10 --dport
53 -j NOTRACK
iptables: Bad rule (does a matching rule exist in that chain?).

-- 
You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200415/c6f13a7c/attachment.html>