From mboxrd@z Thu Jan  1 00:00:00 1970
From: Pablo Neira Ayuso <pablo@netfilter.org>
Subject: Re: [PATCH iptables] libxtables: fix wrong naddr when using localhost
Date: Wed, 8 Mar 2017 10:55:32 +0100
Message-ID: <20170308095532.GA1723@salvia>
References: <20170307232813.17428-1-alexander@alemayhu.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: netfilter-devel@vger.kernel.org
To: Alexander Alemayhu <alexander@alemayhu.com>
Return-path: <netfilter-devel-owner@vger.kernel.org>
Received: from mail.us.es ([193.147.175.20]:46122 "EHLO mail.us.es"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1751291AbdCHKuI (ORCPT <rfc822;netfilter-devel@vger.kernel.org>);
        Wed, 8 Mar 2017 05:50:08 -0500
Received: from antivirus1-rhel7.int (unknown [192.168.2.11])
        by mail.us.es (Postfix) with ESMTP id CA2D31AAAF9
        for <netfilter-devel@vger.kernel.org>; Wed,  8 Mar 2017 10:55:36 +0100 (CET)
Received: from antivirus1-rhel7.int (localhost [127.0.0.1])
        by antivirus1-rhel7.int (Postfix) with ESMTP id BB460DA7FA
        for <netfilter-devel@vger.kernel.org>; Wed,  8 Mar 2017 10:55:36 +0100 (CET)
Received: from antivirus1-rhel7.int (localhost [127.0.0.1])
        by antivirus1-rhel7.int (Postfix) with ESMTP id 601EBDA7E0
        for <netfilter-devel@vger.kernel.org>; Wed,  8 Mar 2017 10:55:34 +0100 (CET)
Content-Disposition: inline
In-Reply-To: <20170307232813.17428-1-alexander@alemayhu.com>
Sender: netfilter-devel-owner@vger.kernel.org
List-ID: <netfilter-devel.vger.kernel.org>

On Wed, Mar 08, 2017 at 12:28:13AM +0100, Alexander Alemayhu wrote:
> $ iptables-translate -A INPUT -p tcp -s localhost --dport 8000 -j ACCEPT
> 
> gives
> 
>  nft add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 8000 counter accept
>  add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 8000 counter accept
> 
> with this patch we get
> 
>  nft add rule ip filter INPUT ip saddr 127.0.0.1 tcp dport 8000 counter accept

This is actually a generic problem:

# iptables -I INPUT -p tcp -s localhost

results in:

# iptables-save 
# Generated by iptables-save v1.6.1 on Wed Mar  8 10:53:07 2017
*filter
:INPUT ACCEPT [13:1628]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [4:317]
-A INPUT -s 127.0.0.1/32 -p tcp
-A INPUT -s 127.0.0.1/32 -p tcp
COMMIT
# Completed on Wed Mar  8 10:53:07 2017

Original problem was introduce at:

commit 2d2b5e046aa56a518160716a9ddf9df53fc79c1f
Author: Arpan Kapoor <rpnkpr@gmail.com>
Date:   Thu Mar 17 18:27:19 2016 +0530

    libxtables: Replace gethostbyname() with getaddrinfo()

Did you also run iptables tests? See iptables-test.py, although I
guess our test infrastructure is not catching up this case.

Thanks!