Package: iptables
Version: 1.8.3-2
Severity: normal
Dear Maintainer,
When i try to zeroed iptables counters it fails with:
root@kali:~# iptables -t filter -Z OUTPUT
iptables v1.8.3 (nf_tables): RULE_REPLACE failed (Invalid argument): rule in
chain OUTPUT
root@kali:~#
root@kali:~# iptables -t filter -L OUTPUT -v -n
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
402 126K LOG-ACCEPT-OUTPUT all -- * eth0 0.0.0.0/0
0.0.0.0/0 owner UID match 127
39 3587 LOG-ACCEPT-OUTPUT tcp -- * eth0 0.0.0.0/0
0.0.0.0/0 tcp dpt:853
771 434K LOG-ACCEPT-OUTPUT all -- * lo 0.0.0.0/0
127.0.0.1
0 0 LOG-ACCEPT-OUTPUT udp -- * * 0.0.0.0/0
0.0.0.0/0 udp spt:68
0 0 LOG-ACCEPT-OUTPUT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG-DROP-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
Aditional debug i tried:
when i add rules like
root@kali:~# iptables -I OUTPUT 1 -o eth0 -m owner --uid-owner "debian-tor" -j
LOG-ACCEPT-OUTPUT
root@kali:~# iptables -I OUTPUT 2 -o eth0 -p tcp -m tcp --dport 80 -j
LOG-ACCEPT-OUTPUT
and the 2ond rule has some counters, it fails to zeroed.
root@kali:~# curl www.google.es
^C
root@kali:~# iptables -t filter -L OUTPUT -n -v
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
3 1228 LOG-ACCEPT-OUTPUT all -- * eth0 0.0.0.0/0 0.0.0.0/0
owner UID match 127
2 120 LOG-ACCEPT-OUTPUT tcp -- * eth0 0.0.0.0/0 0.0.0.0/0
tcp dpt:80
4 532 LOG-ACCEPT-OUTPUT all -- * lo 0.0.0.0/0 127.0.0.1
0 0 LOG-ACCEPT-OUTPUT udp -- * * 0.0.0.0/0 0.0.0.0/0
udp spt:68
0 0 LOG-ACCEPT-OUTPUT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 LOG-DROP-OUTPUT all -- * * 0.0.0.0/0 0.0.0.0/0
root@kali:~# iptables -t filter -Z OUTPUT
iptables v1.8.3 (nf_tables): RULE_REPLACE failed (Invalid argument): rule in
chain OUTPUT
root@kali:~#
if i delete the rule below the zeroed works again.
root@kali:~# iptables -D OUTPUT -o eth0 -p tcp -m tcp --dport 80 -j
LOG-ACCEPT-OUTPUT
root@kali:~# iptables -t filter -Z OUTPUT
root@kali:~#
root@kali:~# uname -a Linux kali 5.2.0-kali2-amd64 #1 SMP Debian 5.2.9-2kali1
(2019-08-22) x86_64 GNU/Linux
root@kali:~# dpkg -l | grep netfilter
ii libip4tc2:amd64 1.8.3-2 amd64 netfilter
libip4tc library
ii libip6tc2:amd64 1.8.3-2 amd64 netfilter
libip6tc library
ii libiptc0:amd64 1.8.3-2 amd64 netfilter
libiptc library
ii libnetfilter-conntrack3:amd64 1.0.7-2 amd64 Netfilter
netlink-conntrack library
ii libnetfilter-queue1 1.0.3-1 amd64 Netfilter
netlink-queue library
ii libxtables12:amd64 1.8.3-2 amd64 netfilter
xtables library
root@kali:~# dpkg -l | grep nftables
ii libnftnl11:amd64 1.1.3-2 amd64 Netfilter
nftables userspace API library
root@kali:~# dpkg -l | grep iptables
ii iptables 1.8.3-2 amd64 administration
tools for packet filtering and NAT
-- System Information:
Distributor ID: Kali
Description: Kali GNU/Linux Rolling
Release: 2019.3
Codename: kali-rolling
Architecture: x86_64
Kernel: Linux 5.2.0-kali2-amd64 (SMP w/12 CPU cores)
Locale: LANG=es_ES.UTF-8, LC_CTYPE=es_ES.UTF-8 (charmap=UTF-8),
LANGUAGE=es_ES.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: sysvinit (via /sbin/init)
LSM: AppArmor: enabled
Versions of packages iptables depends on:
ii libc6 2.29-2
ii libip4tc2 1.8.3-2
ii libip6tc2 1.8.3-2
ii libiptc0 1.8.3-2
ii libmnl0 1.0.4-2+b1
ii libnetfilter-conntrack3 1.0.7-2
ii libnfnetlink0 1.0.1-3+b1
ii libnftnl11 1.1.3-2
ii libxtables12 1.8.3-2
Versions of packages iptables recommends:
pn nftables <none>
Versions of packages iptables suggests:
ii kmod 26-1
-- no debconf information
