ipset and iptables problem.

ipset and iptables problem.

[Husnu Demir]

[-- Attachment #1: Type: text/plain, Size: 1573 bytes --]

Hi,

I have problems with iptables and ipset. Is new iptables compatible with ipset?
The details are below?



 uname -a
Linux hai 2.6.28 #2 SMP Wed Jan 7 13:15:14 EET 2009 x86_64 GNU/Linux

 iptables -V
iptables v1.4.2-rc1

 ipset -V
ipset v2.4.5 Protocol version 2.


 ipset -S
# Generated by ipset 2.4.5 on Thu Jan  8 15:51:03 2009
-N yeni iphash --hashsize 1024 --probes 8 --resize 50
-A yeni 10.1.1.1
COMMIT
# Completed on Thu Jan  8 15:51:03 2009



 iptables -I FORWARD -m set --set yeni src -j ACCEPT
 hai kernel: Oops: 0000 [#8] SMP
 hai kernel: last sysfs file: /sys/devices/virtual/net/lo/operstate
 hai kernel: Stack:
 hai kernel: ffff88023ded0908 0000000000000070 ffff88023ded0898 ffff880223e31540
 hai kernel: ffff88023ded0800 ffffffffa00c4cc3 ffff88023ded090a ffffffffa00c4f64
 hai kernel: Call Trace:
 hai kernel: [<ffffffffa00ba280>] xt_check_match+0x12a/0x143 [x_tables]
 hai kernel: [<ffffffffa00c4cc3>] check_match+0x37/0x41 [ip_tables]
 hai kernel: [<ffffffffa00c4f64>] translate_table+0x238/0x3cb [ip_tables]
 hai kernel: [<ffffffffa00c60ff>] do_ipt_set_ctl+0xda/0x163 [ip_tables]
 hai kernel: [<ffffffff803a67c5>] nf_sockopt+0x5a/0x73
 hai kernel: [<ffffffff803a6804>] nf_setsockopt+0x1a/0x1d
 hai kernel: [<ffffffff803b16ad>] ip_setsockopt+0x63/0x7a
 hai kernel: [<ffffffff80382e76>] sys_setsockopt+0x77/0x9d
 hai kernel: [<ffffffff8020b0db>] system_call_fastpath+0x16/0x1b
 hai kernel: Code: <0f> b7 39 e8 0a c1 fc ff 66 ff c0 75 2f 48 c7 c2 c0 a0 11 a0
48 c7
 hai kernel: CR2: 0000000000000020


Should I go back?  Can you help on this?


hdemir.

[-- Attachment #2: hdemir.vcf --]
[-- Type: text/x-vcard, Size: 164 bytes --]

begin:vcard
fn:Husnu Demir
n:Demir;Husnu
email;internet:hdemir@metu.edu.tr
tel;work:+903122103330
tel;fax:+903122103303
x-mozilla-html:FALSE
version:2.1
end:vcard

Re: ipset and iptables problem.

[Jan Engelhardt]

On Thursday 2009-01-08 14:53, Husnu Demir wrote:

>Hi,
>
>I have problems with iptables and ipset. Is new iptables compatible with ipset?
>
>The details are below?

Well are they?

> uname -a
>Linux hai 2.6.28 #2 SMP Wed Jan 7 13:15:14 EET 2009 x86_64 GNU/Linux
> ipset -V
>ipset v2.4.5 Protocol version 2.

> iptables -I FORWARD -m set --set yeni src -j ACCEPT
> hai kernel: Oops: 0000 [#8] SMP
> hai kernel: last sysfs file: /sys/devices/virtual/net/lo/operstate
> hai kernel: Stack:
> hai kernel: ffff88023ded0908 0000000000000070 ffff88023ded0898 ffff880223e31540
> hai kernel: ffff88023ded0800 ffffffffa00c4cc3 ffff88023ded090a ffffffffa00c4f64
> hai kernel: Call Trace:
> hai kernel: [<ffffffffa00ba280>] xt_check_match+0x12a/0x143 [x_tables]

Compiling the unmodified 2.4.5 with 2.6.28 should give compiler warnings,
and they should not be ignored.

A modified version of ipset 2.4.5 ships with Xtables-addons 1.7 and is 
runnable with 2.6.28.

Re: ipset and iptables problem.

[Jozsef Kadlecsik]

On Thu, 8 Jan 2009, Husnu Demir wrote:

> I have problems with iptables and ipset. Is new iptables compatible with ipset?
> The details are below?

> Linux hai 2.6.28 #2 SMP Wed Jan 7 13:15:14 EET 2009 x86_64 GNU/Linux

>  ipset -V
> ipset v2.4.5 Protocol version 2.

That's an incompatibility with kernel release 2.6.28, I think. There'll be 
a new release of ipset to fix that before the weekend.

Best regards,
Jozsef
-
E-mail  : kadlec@blackhole.kfki.hu, kadlec@mail.kfki.hu
PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics
          H-1525 Budapest 114, POB. 49, Hungary