What happened to ipt_physdev.c ?

What happened to ipt_physdev.c ?

[Paul Reilly]

In recent kernels, 2.6.16.x   there is no longer any

net/ipv4/netfilter/ipt_physdev.c

and no option in kernel config to enable CONFIG_NETFILTER_XT_MATCH_PHYSDEV
So I have no physdev in /proc/net/ip_tables_matches
and my rules which include a -m physdev fail with:

iptables: No chain/target/match by that name

Has PHYSDEV been moved somewhere else?
How do I enable it?

Paul

Re: What happened to ipt_physdev.c ?

[Andy Furniss]

Paul Reilly wrote:
> In recent kernels, 2.6.16.x   there is no longer any
> 
> net/ipv4/netfilter/ipt_physdev.c
> 
> and no option in kernel config to enable CONFIG_NETFILTER_XT_MATCH_PHYSDEV
> So I have no physdev in /proc/net/ip_tables_matches
> and my rules which include a -m physdev fail with:
> 
> iptables: No chain/target/match by that name
> 
> Has PHYSDEV been moved somewhere else?
> How do I enable it?
> 
> Paul
> 
> 

It's there in 17 & 19 somewhere :-)

grep -i phy /boot/config-2.6.19-rc6
...
CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
...

Re: What happened to ipt_physdev.c ?

[Robert P. J. Day]

On Wed, 22 Nov 2006, Andy Furniss wrote:

> Paul Reilly wrote:
> > In recent kernels, 2.6.16.x   there is no longer any
> >
> > net/ipv4/netfilter/ipt_physdev.c
> >
> > and no option in kernel config to enable CONFIG_NETFILTER_XT_MATCH_PHYSDEV
> > So I have no physdev in /proc/net/ip_tables_matches
> > and my rules which include a -m physdev fail with:
> >
> > iptables: No chain/target/match by that name
> >
> > Has PHYSDEV been moved somewhere else?
> > How do I enable it?
> >
> > Paul
> >
> >
>
> It's there in 17 & 19 somewhere :-)
>
> grep -i phy /boot/config-2.6.19-rc6
> ...
> CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
> ...

if you have a kernel source tree, just pop into "make menuconfig" and
do a search for any matching options:

/physdev

Symbol: NETFILTER_XT_MATCH_PHYSDEV [=m]
Prompt: "physdev" match support
  Defined at net/netfilter/Kconfig:368
  Depends on: NET && NETFILTER && NETFILTER_XTABLES && BRIDGE &&

... etc etc ...

rday

Re: What happened to ipt_physdev.c ?

[Paul Reilly]

> > grep -i phy /boot/config-2.6.19-rc6
> > CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m

Yes, I can see it in 2.6.18.3 as well.
There's no longer an ipt_physdev.c in netfilter, so it must
be included in another c file.

However I need to use 2.6.16.2x and it seems to be either missing
or buggy in there. For example it's in Kconfig, but enabling
all the dependencies does not display it in menuconfig, and when
you output the .config it's not listed in there at all.

Paul

> if you have a kernel source tree, just pop into "make menuconfig" and
> do a search for any matching options:
>
> /physdev
>
> Symbol: NETFILTER_XT_MATCH_PHYSDEV [=m]
> Prompt: "physdev" match support
>   Defined at net/netfilter/Kconfig:368
>   Depends on: NET && NETFILTER && NETFILTER_XTABLES && BRIDGE &&
>
> ... etc etc ...
>
> rday
>


-- 

Re: What happened to ipt_physdev.c ?

[Pascal Hambourg]

Hello,

Paul Reilly a écrit :
> In recent kernels, 2.6.16.x   there is no longer any
> 
> net/ipv4/netfilter/ipt_physdev.c

Yes, since 2.6.16 it was replaced by net/netfilter/xt_physdev.c.

> and no option in kernel config to enable CONFIG_NETFILTER_XT_MATCH_PHYSDEV

Yes there is. I just checked in vanilla 2.6.16 and 2.6.16.20.

> So I have no physdev in /proc/net/ip_tables_matches
> and my rules which include a -m physdev fail with:
> 
> iptables: No chain/target/match by that name
> 
> Has PHYSDEV been moved somewhere else?

Since 2.6.16 the corresponding module is named xt_physdev.ko and depends 
on x_tables and bridge.

> How do I enable it?

Symbol: NETFILTER_XT_MATCH_PHYSDEV [=m]
Prompt: "physdev" match support
   Defined at net/netfilter/Kconfig:282
   Depends on: NET && NETFILTER && NETFILTER_XTABLES && BRIDGE_NETFILTER
   Location:
     -> Networking
       -> Networking support (NET [=y])
         -> Networking options
           -> Network packet filtering (replaces ipchains) (NETFILTER [=y])
             -> Core Netfilter Configuration
               -> Netfilter Xtables support (required for ip_tables) 
(NETFILTER_XTABLES [=m])

CONFIG_NETFILTER_XT_MATCH_PHYSDEV is located in the "Core Netfilter 
Configuration" submenu and depends on CONFIG_NETFILTER_XTABLES 
(Netfilter Xtables support) and CONFIG_BRIDGE_NETFILTER (Bridged IP/ARP 
packets filtering) which depends on CONFIG_BRIDGE (802.1d Ethernet 
Bridging).