Re: [iptables PATCH] iptables-nft: fix basechain policy configuration

Phil Sutter <phil@xxxxxx> · Fri, 2 Oct 2020 14:07:32 +0200

Hi,

On Fri, Oct 02, 2020 at 01:44:36PM +0200, Arturo Borrero Gonzalez wrote:
> Previous to this patch, the basechain policy could not be properly configured if it wasn't
> explictly set when loading the ruleset, leading to iptables-nft-restore (and ip6tables-nft-restore)
> trying to send an invalid ruleset to the kernel.

I fear this is not sufficient: iptables-legacy-restore leaves the
previous chain policy in place if '-' is given in dump file. Please try
this snippet from a testcase I wrote:

$XT_MULTI iptables -P FORWARD DROP

diff -u -Z <($XT_MULTI iptables-save | grep '^:FORWARD') \
           <(echo ":FORWARD DROP [0:0]")

$XT_MULTI iptables-restore -c <<< "$TEST_RULESET"
diff -u -Z <($XT_MULTI iptables-save | grep '^:FORWARD') \
           <(echo ":FORWARD DROP [0:0]")

Thanks, Phil