All of lore.kernel.org
 help / color / mirror / Atom feed
* Re: iptables is complaining with bogus unknown error 18446744073709551615
@ 2006-04-21  6:21 Maurice Volaski
  2006-04-21 11:15   ` Harald Welte
  0 siblings, 1 reply; 14+ messages in thread
From: Maurice Volaski @ 2006-04-21  6:21 UTC (permalink / raw)
  To: linux-kernel, netfilter

At least since 2.6.1.16.1, many calls to iptables no longer function 
at least under 64-bit x86, presumably due to a bug in the netfilter 
kernel code.

The problem is still present in 2.6.17-rc2.

The error from iptables is
iptables: unknown error 18446744073709551615

Examples of rules that give the error are

1) iptables -A INPUT -i bond0 -s 129.98.90.0/24 -p tcp --dport 548 -j ACCEPT
2) iptables -A INPUT -i bond0 -s 129.98.90.101/32 -p tcp --dport 497 -j ACCEPT
3) iptables -A INPUT -i bond0 -s 129.98.90.227/32 -p tcp --dport 22 -j ACCEPT

Example of a rule that does not give the error:
1) iptables -A INPUT -i bond0 -p ICMP --icmp-type echo-request -s 
129.98.90.13/32 -j ACCEPT

The computer is using IPv4 and not IPv6, which has not been compiled into the
kernel.

iptables is version 1.3.5.

Kernel configuration related to iptables follows:

CONFIG_IP_NF_CONNTRACK=m
CONFIG_IP_NF_CT_ACCT=y
CONFIG_IP_NF_CONNTRACK_MARK=y
CONFIG_IP_NF_CONNTRACK_EVENTS=y
CONFIG_IP_NF_CONNTRACK_NETLINK=m
# CONFIG_IP_NF_CT_PROTO_SCTP is not set
CONFIG_IP_NF_FTP=m
# CONFIG_IP_NF_IRC is not set
# CONFIG_IP_NF_NETBIOS_NS is not set
# CONFIG_IP_NF_TFTP is not set
# CONFIG_IP_NF_AMANDA is not set
# CONFIG_IP_NF_PPTP is not set
# CONFIG_IP_NF_H323 is not set
# CONFIG_IP_NF_QUEUE is not set
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_MATCH_IPRANGE=m
CONFIG_IP_NF_MATCH_TOS=m
CONFIG_IP_NF_MATCH_RECENT=m
CONFIG_IP_NF_MATCH_ECN=m
CONFIG_IP_NF_MATCH_DSCP=m
CONFIG_IP_NF_MATCH_AH=m
CONFIG_IP_NF_MATCH_TTL=m
CONFIG_IP_NF_MATCH_OWNER=m
CONFIG_IP_NF_MATCH_ADDRTYPE=m
CONFIG_IP_NF_MATCH_HASHLIMIT=m
CONFIG_IP_NF_FILTER=m
# CONFIG_IP_NF_TARGET_REJECT is not set
CONFIG_IP_NF_TARGET_LOG=m
CONFIG_IP_NF_TARGET_ULOG=m
CONFIG_IP_NF_TARGET_TCPMSS=m
# CONFIG_IP_NF_NAT is not set
CONFIG_IP_NF_MANGLE=m
# CONFIG_IP_NF_TARGET_TOS is not set
# CONFIG_IP_NF_TARGET_ECN is not set
# CONFIG_IP_NF_TARGET_DSCP is not set
# CONFIG_IP_NF_TARGET_TTL is not set
# CONFIG_IP_NF_TARGET_CLUSTERIP is not set
CONFIG_IP_NF_RAW=m
CONFIG_IP_NF_ARPTABLES=m
CONFIG_IP_NF_ARPFILTER=m
CONFIG_IP_NF_ARP_MANGLE=m

CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
# CONFIG_NETFILTER_XT_TARGET_CONNMARK is not set
CONFIG_NETFILTER_XT_TARGET_MARK=m
CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
# CONFIG_NETFILTER_XT_TARGET_NOTRACK is not set
CONFIG_NETFILTER_XT_MATCH_COMMENT=m
CONFIG_NETFILTER_XT_MATCH_CONNBYTES=m
CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
CONFIG_NETFILTER_XT_MATCH_DCCP=m
CONFIG_NETFILTER_XT_MATCH_ESP=m
CONFIG_NETFILTER_XT_MATCH_HELPER=m
CONFIG_NETFILTER_XT_MATCH_LENGTH=m
CONFIG_NETFILTER_XT_MATCH_LIMIT=m
CONFIG_NETFILTER_XT_MATCH_MAC=m
CONFIG_NETFILTER_XT_MATCH_MARK=m
CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
CONFIG_NETFILTER_XT_MATCH_PKTTYPE=m
CONFIG_NETFILTER_XT_MATCH_REALM=m
CONFIG_NETFILTER_XT_MATCH_SCTP=m
CONFIG_NETFILTER_XT_MATCH_STATE=m
CONFIG_NETFILTER_XT_MATCH_STRING=m
CONFIG_NETFILTER_XT_MATCH_TCPMSS=m

lsmod shows
xt_state                4928  0
ipt_LOG                 8960  0
ip_conntrack_ftp       10000  0
ip_conntrack           57880  2 xt_state,ip_conntrack_ftp
nfnetlink               8520  1 ip_conntrack
iptable_filter          5440  0
ip_tables              22168  1 iptable_filter
x_tables               17800  3 xt_state,ipt_LOG,ip_tables


This issue has been posted to netfilter bugzilla as 
https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=467
and to kernel bugzilla as
http://bugzilla.kernel.org/show_bug.cgi?id=6420
-- 

Maurice Volaski, mvolaski@aecom.yu.edu
Computing Support, Rose F. Kennedy Center
Albert Einstein College of Medicine of Yeshiva University


^ permalink raw reply	[flat|nested] 14+ messages in thread
[parent not found: <200604210738.k3L7cBGO010103@mailgw.aecom.yu.edu>]
* Re: iptables is complaining with bogus unknown error 18446744073709551615
@ 2006-04-13 23:19 Maurice Volaski
  0 siblings, 0 replies; 14+ messages in thread
From: Maurice Volaski @ 2006-04-13 23:19 UTC (permalink / raw)
  To: netfilter

Some more info, the buggy netfilter in 2.6.16.1 is also present in 2.6.17-rc1.

Here's tail end of output from strace on executing

iptables -A INPUT -i bond0 -s 129.98.90.0/24 -p tcp --dport 548 -j ACCEPT

in 2.6.17-rc1

open("/lib64/iptables/libipt_standard.so", O_RDONLY) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0 \4\0\0\0"..., 
832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=3112, ...}) = 0
mmap(NULL, 1050528, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 
3, 0) = 0x2ac9564a1000
mprotect(0x2ac9564a2000, 1044480, PROT_NONE) = 0
mmap(0x2ac9565a1000, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0x2ac9565a1000
close(3)                                = 0
socket(PF_INET, SOCK_RAW, IPPROTO_RAW)  = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, 
"filter\0\377\0\0\0\0\0\0\0\0(\235v\361\0\201\377\377\241"..., [84]) 
= 0
getsockopt(3, SOL_IP, 0x41 /* IP_??? */, 
"filter\0\0\200\336(V\311*\0\0M\215@\0\0\0\0\0\1\0\0\0\0"..., [672]) 
= 0
setsockopt(3, SOL_IP, 0x40 /* IP_??? */, 
"filter\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 928) = 
-1 ENOENT (No such file or directory)
write(2, "iptables: Unknown error 18446744"..., 45iptables: Unknown 
error 18446744073709551615
) = 45
exit_group(1)                           = ?
-- 

Maurice Volaski, mvolaski@aecom.yu.edu
Computing Support, Rose F. Kennedy Center
Albert Einstein College of Medicine of Yeshiva University


^ permalink raw reply	[flat|nested] 14+ messages in thread
[parent not found: <200604111452.k3BEpxdo019103@mailgw.aecom.yu.edu>]
end of thread, other threads:[~2006-04-27 15:41 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-04-21  6:21 iptables is complaining with bogus unknown error 18446744073709551615 Maurice Volaski
2006-04-21 11:15 ` Harald Welte
2006-04-21 11:15   ` Harald Welte
2006-04-21 14:22   ` Maurice Volaski
2006-04-21 14:22     ` Maurice Volaski
     [not found]   ` <a06230913c06e96f75f32@129.98.90.227>
2006-04-21 18:26     ` Nick Warne
2006-04-22  0:05       ` Alessandro Suardi
2006-04-22 11:59         ` Nick Warne
     [not found] <200604210738.k3L7cBGO010103@mailgw.aecom.yu.edu>
2006-04-27  1:12 ` Maurice Volaski
2006-04-27 13:51   ` Harald Welte
2006-04-27 15:41     ` Maurice Volaski
  -- strict thread matches above, loose matches on Subject: below --
2006-04-13 23:19 Maurice Volaski
     [not found] <200604111452.k3BEpxdo019103@mailgw.aecom.yu.edu>
2006-04-11 17:14 ` Maurice Volaski
     [not found] ` <a06230909c06193cea962@129.98.90.227>
     [not found]   ` <876ef97a0604111146m742d75f0gb8240e82ba7426f1@mail.gmail.com>
2006-04-11 19:13     ` Maurice Volaski

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.