Bug 1297092 - ipset and iptables extension set: support for data type net or reject it (specifically hash:net,iface) [NEEDINFO]
ipset and iptables extension set: support for data type net or reje...
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
Unspecified Unspecified
unspecified Severity medium
: ---
: ---
Assigned To: Kernel Maintainer List
Fedora Extras Quality Assurance
Depends On:
  Show dependency treegraph
Reported: 2016-01-08 20:21 EST by an0nym
Modified: 2016-10-26 12:48 EDT (History)
10 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-10-26 12:48:36 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
labbott: needinfo? (an0nym)

Attachments (Terms of Use)

  None (edit)
Description an0nym 2016-01-08 20:21:18 EST
Description of problem:
It's possible to add,eth0 to hash:net,iface but it does not get matched by iptables set extension while it does get matched by ipset test. 

Manual does not say is restricted value for hash:net,iface contrary to most other hash:net* variations.

I'd prefer to be supported by all hash:net* variations. 

Version-Release number of selected component (if applicable):
ipset.x86_64                        6.27-1.fc23                         @updates
iptables.x86_64                     1.4.21-15.fc23                      @fedora 

How reproducible:

Steps to Reproduce:
1. ipset create test1 hash:net,iface
2. ipset add test1,eth0
3. ipset test test1,eth0
4. create iptables rule with -m set --match-set test1 src,src -j LOG --log-prefix "test1 "
5. let some traffic matching,eth0 pass through this rule
6. see journalctl for logs or iptables -L -n -v -x for this rule for packets

Actual results:
ipset test says,eth0 is in test1
iptables rule does not get matched (no entries in log, no packets through this rule)

Expected results:
ipset test says,eth0 is in test1
iptables rule should get matched

Additional info:
Workaround is to use two elements,eth0 and,eth0 instead of,eth0. They do get matched both by ipset test and iptables.
Comment 1 Thomas Woerner 2016-01-11 08:35:06 EST
This seems to be an issue in ipset:

It is not possible to add to hash:net, but it is possible to add,eth0 to hash:net,iface.

The test for the address if it is combined with another parameter seems not to be correct.

Reassigning to ipset
Comment 2 an0nym 2016-01-11 11:32:33 EST
Thomas, however issuing ipset test from terminal manages to do the test right. I imply iptables test implementation differs from the one in ipset test. And currently ipset test implementation is consistent with its manual and behaviour (it allows adding to hash:net,iface thus should be able to test it).

I. e. at the moment formally iptables is in the wrong. 

Apart from that I agree with you that since other hash:net* types do not allow to be added, hash:net,iface was meant to not allow as well. 

Nevertheless I'd prefer all of them to support adding and iptables to work properly in this case instead of restricting this value - simply because there are use cases for
Comment 3 Thomas Woerner 2016-01-12 05:17:08 EST
iptables is not handling, it is just removing it. Please have a look at the resulting rule if you are adding this rule: "iptables -A INPUT -s -j ACCEPT"
It results in "iptables -A INPUT -j ACCEPT". iptables is simply removing or ignoring a source or destination of

{-s,-d} could only be treated as not being set. I am not sure that this use case is supported by ipsets.
Comment 4 an0nym 2016-01-12 06:07:53 EST
Thomas, what you've demonstrated is true. 

However I see one major point. 

Removing {-s,-d} does not change the result of the rule execution, there are no side effects from this, i. e. it could be treated as just an optimization. 

Not honoring in case of set match extension, on the other hand, does change the result and have side effects.
Comment 5 an0nym 2016-01-12 06:10:07 EST
P. S. Changing the result is quite obvious. By side effects I mean e. g. ipset counters increment.
Comment 6 Thomas Woerner 2016-01-25 11:16:45 EST
Assigning to kernel.

Here is the netfilter upstream patch: http://git.netfilter.org/ipset/commit/?id=9b0be3d2545bfd0b482883bada1f4f0410b683ef
Comment 7 Laura Abbott 2016-09-23 15:33:07 EDT
*********** MASS BUG UPDATE **************
We apologize for the inconvenience.  There is a large number of bugs to go through and several of them have gone stale.  Due to this, we are doing a mass bug update across all of the Fedora 23 kernel bugs.
Fedora 23 has now been rebased to 4.7.4-100.fc23.  Please test this kernel update (or newer) and let us know if you issue has been resolved or if it is still present with the newer kernel.
If you have moved on to Fedora 24 or 25, and are still experiencing this issue, please change the version to Fedora 24 or 25.
If you experience different issues, please open a new bug report for those.
Comment 8 Laura Abbott 2016-10-26 12:48:36 EDT
*********** MASS BUG UPDATE **************
This bug is being closed with INSUFFICIENT_DATA as there has not been a response in 4 weeks. If you are still experiencing this issue, please reopen and attach the relevant data from the latest kernel you are running and any data that might have been requested previously.

Note You need to log in before you can comment on or make changes to this bug.