Issue

+++ This bug was initially created as a clone of Bug #2176859 +++ When printing a ruleset containing compat expressions for which libxtables didn't provide a translation, nft used to print info about the expression after a comment ('#') marker: # iptables -A FORWARD -p tcp -m osf --genre linux # nft list ruleset table ip filter { chain FORWARD { type filter hook forward priority filter; policy accept; meta l4proto tcp # OS fingerprint match linux counter packets 0 bytes 0 } } This is problematic if the output is used unattendedly for a later ruleset restore. As seen in the example above, not just the osf match itself is lost but the following counter statement as well. To avoid subtle ruleset breakages like this, upstream changed the way these expressions are printed: table ip filter { chain FORWARD { type filter hook forward priority filter; policy accept; meta l4proto tcp xt match osf counter packets 0 bytes 0 } } This seems worse, but the parser will recognize "match" and "target" keywords and print a message pointing out the details: # nft list ruleset | nft -f - # Warning: table ip filter is managed by iptables-nft, do not touch! /dev/stdin:4:20-33: Error: unsupported xtables compat expression, use iptables-nft with this ruleset meta l4proto tcp xt match "osf" counter packets 0 bytes 0 ^^^^^^^^^^^^^^ The example also shows the non-intrusive warning emitted which makes sense on its own because perfectly translated rulesets may be unparsable even by the version of iptables-nft which created them due to missing reverse translation capability for most translations. The list of proposed backports is: c327e9331e50d Warn for tables with compat expressions in rules 5c30feeee5cfe xt: Delay libxtables access until translation e432477f5c013 xt: Purify enum nft_xt_type 79195a8cc9e9d xt: Rewrite unsupported compat expression dumping e41c53ca5b043 xt: Fall back to generic printing from translation aef5330fe7827 xt: Fix fallback printing for extensions matching keywords Due to the high impact I propose to backport these commits until RHEL8.6.z.

Release Notes

Cause: When listing rules created by iptables-nft, any extension called via compat expression for which no translation was available would be printed as a comment following the rule in format &#39;# xt_&lt;extension_name&gt;&#39;. <br/> <br/> Consequence: Storing a ruleset containing such rules and restoring it later (e.g. after a reboot) would restore only the known parts of the rule and likely lead to inadvertent firewall behaviour. <br/> <br/> Fix: Unsupported compat expressions now print in the format &#39;xt &lt;match|target&gt; &lt;extension_name&gt;&#39;. This format is not only more informative, but also recognized by nft tool and rejected with a descriptive error message. <br/> <br/> Result: Accidental firewall ruleset sabotage by reloading a ruleset created by iptables-nft using nft tool is prevented. <br/>

No. of Comments

Resolution

Done-Errata