[Bug 1394] New: "Bad argument `ACCEPT'" when iptables-restore (nft) parses stdin

bugzilla-daemon at netfilter.org bugzilla-daemon at netfilter.org
Mon Jan 6 19:34:00 CET 2020


            Bug ID: 1394
           Summary: "Bad argument `ACCEPT'" when iptables-restore (nft)
                    parses stdin
           Product: iptables
           Version: unspecified
          Hardware: x86_64
               URL: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=9462
                OS: All
            Status: NEW
          Severity: enhancement
          Priority: P5
         Component: iptables-restore
          Assignee: netfilter-buglog at lists.netfilter.org
          Reporter: jamie at strandboge.com

In Debian, a user reported that ufw (a frontend to iptables) was not working:

After investigating, this turned out to be an issue with iptables-nft-restore
(recall that in Debian there are both the nft and the legacy commands that
users may choose). Here is a simple reproducer on Debian with 1.8.4-1:

Create some simple policy:

$ cat /tmp/pol
# builtin chains

With 1.8.2-4 on buster:

$ cat /tmp/pol | sudo /usr/sbin/iptables-legacy-restore -n
$ cat /tmp/pol | sudo /usr/sbin/iptables-nft-restore -n

With 1.8.4-1 on sid:

$ cat /tmp/pol | sudo /usr/sbin/iptables-legacy-restore -n
$ cat /tmp/pol | sudo /usr/sbin/iptables-nft-restore -n
Bad argument `ACCEPT'
Error occurred at line: 4
Try `iptables-nft-restore -h' or 'iptables-nft-restore --help' for more

but everything seems fine when parsing the file directly:

$ sudo /usr/sbin/iptables-legacy-restore /tmp/pol
$ sudo /usr/sbin/iptables-nft-restore /tmp/pol

The reporter in the bug claimed that downgrading to 1.8.3 allowed things to
work again, so it appears that this was introduced in 1.8.4.

I see that parsing behavior changed in
but I did not perform a bisect to determine it as the cause for the regression.

You are receiving this mail because:
You are watching all bug changes.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.netfilter.org/pipermail/netfilter-buglog/attachments/20200106/d94b993a/attachment.html>

More information about the netfilter-buglog mailing list