[pkg-netfilter-team] Bug#950535: iptables-restore segfaults on nat table

[Christoph Martin]

Package: iptables
Version: 1.8.2-4
Severity: grave

Dear Maintainer,

after updateing from stretch to buster ufw failed to work.

we have nat-table entries for PREROUTING and POSTROUTING . iptables-restore
segfaults on these rules. The following rules lead to the error:

*nat
-F PREROUTING
-A PREROUTING -i eth0 -p tcp --dport 22 -j REDIRECT --to-ports 1194
-F PREROUTING
-F POSTROUTING
COMMIT

The version from backports: 1.8.3-2~bpo10+1 does not have this problem.
Please bring this fix to the stable release. The ufw firewall ist disabled
after this error. So I consider this a security problem

Christoph

-- System Information:
Debian Release: 10.2
  APT prefers stable-updates
  APT policy: (700, 'stable-updates'), (700, 'stable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-6-amd64 (SMP w/8 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8),
LANGUAGE=en_US:\
en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages iptables depends on:
ii  libc6                    2.28-10
ii  libip4tc0                1.8.2-4
ii  libip6tc0                1.8.2-4
ii  libiptc0                 1.8.2-4
ii  libmnl0                  1.0.4-2
ii  libnetfilter-conntrack3  1.0.7-1
ii  libnfnetlink0            1.0.1-3+b1
ii  libnftnl11               1.1.2-2
ii  libxtables12             1.8.2-4

Versions of packages iptables recommends:
ii  nftables  0.9.0-2

Versions of packages iptables suggests:
ii  kmod  26-1

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-netfilter-team/attachments/20200203/c50f1e0d/attachment.sig>