Re: iptables: considers incomplete rule in -C and finds an erroneous match

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]



On Mon, Feb 05, 2024 at 04:45:19AM +0500, Roman Mamedov wrote:
> Hello,
> According to my ip6tables, a rule like this already exists:
>   # ip6tables -C INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT && echo Exists
>   Exists
> Except that it doesn't, and an extra IP filter is present:
>   # ip6tables-save | grep 80,443
>   -A INPUT -s fd39::/16 -p tcp -m multiport --dports 80,443 -j ACCEPT
> Is that the expected behaviour?
> ip6tables v1.8.9 (legacy)

This is already fixed in v1.8.10 by commit 78850e7dba64a ("ip6tables:
Fix checking existence of rule").

Cheers, Phil

[Index of Archives]     [Netfitler Users]     [Berkeley Packet Filter]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux