Unable to add rule on Chain with 30 characters.

Unable to add rule on Chain with 30 characters.

[Rafael Dreher]

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with exactly 30 characters.

The chain have bee added without any problem, but when I add the rule, iptables says that it's unable do find the chain.

See bellow:

-----------------------------------------------------------------------
[root@ward] [16:55:58]
[~]#iptables -t nat -N ecommerce-internet@POSTROUTING

[root@ward] [16:56:01]
[~]#iptables -t nat -A POSTROUTING -j ecommerce-internet@POSTROUTING
iptables: No chain/target/match by that name

[root@ward] [16:56:19]
[~]#iptables -t nat -N 123456789012345678901234567890

[root@ward] [17:04:15]
[~]#iptables -t nat -A POSTROUTING -j 123456789012345678901234567890
iptables: No chain/target/match by that name

[root@ward] [17:04:23]
[~]#

-------------------------------------------------------------------------

If I reduce the chain to 28 characters, it works. I'm trying to migrate a set of rules form iptables-1.2.11 to 1.3.1,
and I don't want to rewrite the rules.

Someone can help me?

My iptables version: 1.3.1
My kernel version: 2.4.31

POM-Patches:

CLASSIFY
SAME
comment
NETMAP
iprange
quota
time
IPMARK
ROUTE
account
h323-conntrack-nat
ipp2p
l7-filter-pom-1.4
mms-conntrack-nat
msnp-conntrack-nat
pptp-conntrack-nat
quake3-conntrack-nat
string
mport

Thanks in advance.
-- 
Rafael Dreher

-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify

Re: Unable to add rule on Chain with 30 characters.

[Patrick McHardy]

Rafael Dreher wrote:
> Hi,
> 
> I'm trying do add a rule on a user-defined chain, on the NAT table, with 
> exactly 30 characters.
> 
> The chain have bee added without any problem, but when I add the rule, 
> iptables says that it's unable do find the chain.
> 
> If I reduce the chain to 28 characters, it works. I'm trying to migrate 
> a set of rules form iptables-1.2.11 to 1.3.1,
> and I don't want to rewrite the rules.

The maximum name length for matches and targets (and user-defined
chains) has been reduced by one to make room for a versioning byte.
You seem to be the first unlucky person that uses all available
bytes. The only possible solution is to reduce the length of your
chain-names.

Regards
Patrick