Package: iptables Version: 1.8.1-2 Severity: normal Dear Maintainer,
I am the maintainer of ufw in Debian and received bug report #911986 with a preliminary analysis here: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=911986#35 In short, the nf_tables variety of iptables differs in how it handles -Z for user defined chains. Eg: With legacy: $ sudo iptables-legacy --version iptables v1.8.1 (legacy) $ sudo iptables-legacy -N foo $ sudo iptables-legacy -L foo Chain foo (0 references) target prot opt source destination $ sudo iptables-legacy -Z foo $ sudo iptables-legacy -X foo And with nf_tables: $ sudo iptables --version iptables v1.8.1 (nf_tables) $ sudo iptables -N foo $ sudo iptables -L foo Chain foo (0 references) target prot opt source destination # Warning: iptables-legacy tables present, use iptables-legacy to see them $ sudo iptables -Z foo # REGRESSION ??? iptables v1.8.1 (nf_tables): (null) failed (Operation not supported): chain foo $ sudo iptables -X foo I tested with ip6tables and ip6tables-legacy and -Z is not supported by ip6tables either, where it is in ip6tables-legacy. The man page for iptables states that -Z is supported (the man page is unchanged from 1.6 wrt -Z). Can you advise if this is indeed a regression in 1.8 or is it intended behavior? If intended behavior, I'll need to update ufw accordingly (preliminary testing shows it seems otherwise to work ok with the nf_tables variety of iptables). Thanks! -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: amd64 (x86_64) Kernel: Linux 4.18.0-2-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages iptables depends on: ii libc6 2.27-8 ii libip4tc0 1.8.1-2 ii libip6tc0 1.8.1-2 ii libiptc0 1.8.1-2 ii libmnl0 1.0.4-2 ii libnetfilter-conntrack3 1.0.7-1 ii libnfnetlink0 1.0.1-3+b1 ii libnftnl7 1.1.1-1 ii libxtables12 1.8.1-2 iptables recommends no packages. Versions of packages iptables suggests: ii kmod 25-1 -- no debconf information
