limit rule on sparc-linux

limit rule on sparc-linux

[Christian Birchinger]

Hello
Is there a known patch for the non-working limit rule on
sparc/linux? The last version Kernel i've tested is 2.4.20
and it still refuses limit rules.

I'm not sure if the problem has been reported on this list.
I saw it on many places (Google also found it on some Debian
mailinglists).

Heres a quick example of a rule which perfectly works on x86 but
fails on sparc64:
# iptables -A INPUT -j ACCEPT -p icmp -m limit --limit 120/minute
iptables: Invalid argument
#

If it helps, here are the last lines of a strace with this
command:
open("/lib/iptables/libipt_limit.so", O_RDONLY) = 3
read(3,"\177ELF\1\2\1\0\0\0\0\0\0\0\0\0\0\3\0\22\0\0\0\1\0\0\6"... ,1024) = 1024
fstat64(3, {st_mode=S_IFREG|0755, st_size=5758, ...}) = 0
mmap(NULL, 69552, PROT_READ|PROT_EXEC, MAP_PRIVATE, 3, 0) = 0x701b8000
mprotect(0x701ba000, 61360, PROT_NONE)  = 0
mmap(0x701c8000, 8192, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED, 3, 0) = 0x701c8000
close(3)                                = 0
socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, [1718185076], [84]) = 0
getsockopt(3, SOL_IP, 0x41 /* IP_??? */, [1718185076], [672]) = 0
rt_sigtimedwait(ptrace: umoven: Input/output error
[?], 0x3)               = -1 EINVAL (Invalid argument)
write(2, "iptables: Invalid argument\n", 27iptables: Invalid argument
) = 27
exit(1)                                 = ?

-- 
Christian Birchinger

Re: limit rule on sparc-linux

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 819 bytes --]

On Thu, Jan 09, 2003 at 09:58:40AM +0100, Christian Birchinger wrote:
> Hello
> Is there a known patch for the non-working limit rule on
> sparc/linux? The last version Kernel i've tested is 2.4.20
> and it still refuses limit rules.

yes, patch has been posted very recently on this list.  However, I'm
still not sure that this is the solution we will finally implement.

btw: please always indicate that you are talking about sparc64 linux.
sparc32 should work straight ahead.

> -- 
> Christian Birchinger

-- 
- Harald Welte / laforge@gnumonks.org               http://www.gnumonks.org/
============================================================================
"If this were a dictatorship, it'd be a heck of a lot easier, just so long
 as I'm the dictator."  --  George W. Bush Dec 18, 2000

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]