Skip to content

iptables -C returns 0 even with non-exist rules, may breaking applications depends on iptables

Leo requested to merge leo980/iptables:fix-checking into main

iptables -C command is used to check the existance of an iptables rule, it returns 0 when rules exist, and returns non-zero when not exist.

iptables 1.8.11 introduced a bug that iptables -C returns 0 even when rules are not exist.

iptables-nft==1.8.10-2 outputs

$ sudo iptables -A INPUT -i eth_nonexist -j ACCEPT
$ sudo iptables -C INPUT -i eth_nonexist -j ACCEPT; echo $?
0
$ sudo iptables -C INPUT -i eth_nonexist_1 -j ACCEPT; echo $?
iptables: Bad rule (does a matching rule exist in that chain?).
1

iptables-nft==1.8.11-1 outputs

$ sudo iptables -A INPUT -i eth_nonexist -j ACCEPT
$ sudo iptables -C INPUT -i eth_nonexist -j ACCEPT; echo $?
0
$ sudo iptables -C INPUT -i eth_nonexist_1 -j ACCEPT; echo $?
0

This issue may break applications which relies on iptables, says, docker.

This issue has been fixed by an upstream commit which is newer than the commit tag with v1.8.11, and not yet included in Arch Linux.

This pull request backports the commit fixing this issue and bump version to iptables-nft==1.8.11-2.

After build, install and test, its behaviours are matched with expectations.

iptables-nft==1.8.11-2 outputs

$ sudo iptables -A INPUT -i eth_nonexist -j ACCEPT
$ sudo iptables -C INPUT -i eth_nonexist -j ACCEPT; echo $?
0
$ sudo iptables -C INPUT -i eth_nonexist_1 -j ACCEPT; echo $?
iptables: Bad rule (does a matching rule exist in that chain?).
1

Merge request reports