Re: Linux 2.6.12/iptables 1.3.1+CLUSTERIP issues

[Pablo Neira <pablo@eurodev.net>]

[-- Attachment #1: Type: text/plain, Size: 1345 bytes --]

Hi Harald,

Harald Welte wrote:
>>2. I installed this rule just to test things out:
>>
>>iptables -A INPUT -d 192.168.1.3 -i eth0 -p tcp --dport 3000 -j
>>CLUSTERIP --new --hashmode sourceip-sourceport --clustermac
>>01:23:45:67:89:AB --total-nodes 2 --local-node 1
>>
>>I then tried to remove it (I didn't update iptables rules again since
>>then) by switching the -A to a -D and that failed. I tried all sorts
>>of combinations of the arguments to -j CLUSTERIP but they all failed.
>>Eventually, I was forced to remove the rule by using the iptables rule
>># (e.g. iptables -D INPUT 10). I feel that this is in error, but I've
>>seen at least two patches to CLUSTERIP that claim to fix rule
>>deletion. Am I doing something wrong?

fix-del-with-userspacesize-target.patch:

You still need to apply this patch to iptables, it got lost somehow 
since I've posted it some time ago. It fixes ipt_CLUSTERIP deletion. To 
be precise, it fixes rule deletion of targets whose userspace size part 
differs from the kernel part.

BTW, I forgot if you passed the patch here below (link) to davem? I 
can't see it in the current git snapshot. got lost as well ?

http://people.netfilter.org/pablo/patches/fixes/kernel/pending/fix-layout-CLUSTERIP.patch

@Tobias: With both patches applied you'll fix your problems with 
CLUSTERIP rule deletion.

--
Pablo

[-- Attachment #2: fix-del-with-userspacesize-target.patch --]
[-- Type: text/x-patch, Size: 795 bytes --]

Index: libiptc/libip4tc.c
===================================================================
--- libiptc/libip4tc.c	(revision 3742)
+++ libiptc/libip4tc.c	(working copy)
@@ -210,6 +210,7 @@
 	mptr = matchmask + sizeof(STRUCT_ENTRY);
 	if (IPT_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr))
 		return NULL;
+	mptr += IPT_ALIGN(sizeof(struct ipt_entry_target));
 
 	return mptr;
 }
Index: libiptc/libip6tc.c
===================================================================
--- libiptc/libip6tc.c	(revision 3742)
+++ libiptc/libip6tc.c	(working copy)
@@ -242,6 +242,7 @@
 	mptr = matchmask + sizeof(STRUCT_ENTRY);
 	if (IP6T_MATCH_ITERATE(a, match_different, a->elems, b->elems, &mptr))
 		return NULL;
+	mptr += IP6T_ALIGN(sizeof(struct ip6t_entry_target));
 
 	return mptr;
 }