Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Description of problem:
using iptables to enter a dccp rule causes nft ruleset to contain invalid rule that prevents re-loading the rules.
Version-Release number of selected component (if applicable):
iptables-1.8.4-15.el8
nftables-0.9.3-16.el8
How reproducible:
always
Steps to Reproduce:
iptables -A INPUT -p dccp -m dccp --dccp-type RESET,INVALID -j LOG
nft list ruleset | tee rules-1.nft
nft 'flush ruleset; include "./rules-1.nft"'
In file included from (null):1:16-39:
./rules-1.nft:4:27-33: Error: syntax error, unexpected counter, expecting type or sport or dport
meta l4proto dccp dccp counter packets 0 bytes 0 log
^^^^^^^
Actual results:
ruleset is rejected because of invalid dccp rule format
Expected results:
dccp type support is added or the rule is converted to legacy/incompatible format and uses comment to signify that as usual.
Additional info:
iptables-transalte alredy knows that the rule is not supported in nft:
iptables-translate -A INPUT -p dccp -m dccp --dccp-type RESET,INVALID -j LOG
nft # -A INPUT -p dccp -m dccp --dccp-type RESET,INVALID -j LOG
Upstream commit to backport:
commit 4bcbc8e11a2764f4537dc405962f83cd072cccfe
Author: Phil Sutter <phil>
Date: Wed Dec 2 13:37:06 2020 +0100
extensions: dccp: Fix for DCCP type 'INVALID'
Support for matching on invalid DCCP type field values was pretty
broken: While RFC4340 declares any type value from 10 to 15 invalid, the
extension's type name 'INVALID' mapped to type value 10 only. Fix this
by introduction of INVALID_OTHER_TYPE_MASK which has the remaining
invalid type's bits set and apply it if bit 10 is set after parsing the
type list. When printing, stop searching type names after printing
'INVALID' - unless numeric output was requested. The latter prints all
actual type values. Since parsing types in numeric form is not
supported, changing the output should not break existing scripts.
When translating into nftables syntax, the code returned prematurely if
'INVALID' was among the list of types - thereby emitting invalid syntax.
Instead print a real match for invalid types by use of a range
expression.
While being at it, fix syntax of translator output: If only
'--dccp-types' was translated, the output contained an extra 'dccp'. On
the other hand, if '--sport' and '--dport' was present, a required
'dccp' between the translations of both was missing.
Fixes: e40b11d7ef827 ("add support for new 'dccp' protocol match")
Fixes: c94a998724143 ("extensions: libxt_dccp: Add translation to nft")
Signed-off-by: Phil Sutter <phil>
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (iptables bug fix and enhancement update), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2021:1642