Re: status of ipchains in 2.6?

Re: status of ipchains in 2.6?

[David S. Miller]

On Mon, 27 Oct 2003 17:27:22 -0800
David Mosberger <davidm@napali.hpl.hp.com> wrote:

> I recently discovered that ipchains is rather broken.  I noticed the
> problem on ia64, but suspect that it's likely to affect all 64-bit
> platforms (if not 32-bit platforms).  A more detailed description of
> the problem I'm seeing is here:
> 
> 	http://tinyurl.com/sm9d
> 
> Unlike ipchains, iptables works perfectly fine, so perhaps we just
> need to update Kconfig to discourage ipchains on ia64 (and/or other
> 64-bit platforms)?

Might want to post this to the netfilter lists or netdev....
Nah, that might actually get the bug fixed.

linux-kernel is always the wrong place to report networking
problems, most networking developers do not read linux-kernel.
They do read netdev@oss.sgi.com so please post things there.

Re: status of ipchains in 2.6?

[David Mosberger]

>>>>> On Tue, 28 Oct 2003 01:50:32 -0800, "David S. Miller" <davem@redhat.com> said:

  DaveM> On Mon, 27 Oct 2003 17:27:22 -0800 David Mosberger
  DaveM> <davidm@napali.hpl.hp.com> wrote:

  >> I recently discovered that ipchains is rather broken.  I noticed
  >> the problem on ia64, but suspect that it's likely to affect all
  >> 64-bit platforms (if not 32-bit platforms).  A more detailed
  >> description of the problem I'm seeing is here:

  >> http://tinyurl.com/sm9d

  >> Unlike ipchains, iptables works perfectly fine, so perhaps we
  >> just need to update Kconfig to discourage ipchains on ia64
  >> (and/or other 64-bit platforms)?

  DaveM> Might want to post this to the netfilter lists or netdev....
  DaveM> Nah, that might actually get the bug fixed.

$ fgrep -i ipchain MAINTAINERS
$

Might want to consider updating the MAINTAINERS file?

	--david

Re: status of ipchains in 2.6?

[David S. Miller]

On Tue, 28 Oct 2003 09:56:58 -0800
David Mosberger <davidm@napali.hpl.hp.com> wrote:

> >>>>> On Tue, 28 Oct 2003 01:50:32 -0800, "David S. Miller" <davem@redhat.com> said:
> 
> $ fgrep -i ipchain MAINTAINERS

Try netfilter, ipchains is a part of netfilter.

Re: status of ipchains in 2.6?

[David Mosberger]

>>>>> On Tue, 28 Oct 2003 09:57:47 -0800, "David S. Miller" <davem@redhat.com> said:

  David> On Tue, 28 Oct 2003 09:56:58 -0800 David Mosberger
  David> <davidm@napali.hpl.hp.com> wrote:

  >> >>>>> On Tue, 28 Oct 2003 01:50:32 -0800, "David S. Miller"
  >> <davem@redhat.com> said:

  >> $ fgrep -i ipchain MAINTAINERS

  David> Try netfilter, ipchains is a part of netfilter.

I took ipchains not being mentioned in MAINTAINERS as a sign that
nobody wanted to hear bug reports about it, hence my choice of lkml.
Perhaps you prefer to flame people rather than making it easier
for them to find the right mailing-list?

	--david

Re: status of ipchains in 2.6?

[Martin Josefsson]

[-- Attachment #1: Type: text/plain, Size: 1725 bytes --]

On Tue, 2003-10-28 at 02:27, David Mosberger wrote:
> I recently discovered that ipchains is rather broken.  I noticed the
> problem on ia64, but suspect that it's likely to affect all 64-bit
> platforms (if not 32-bit platforms).  A more detailed description of
> the problem I'm seeing is here:
> 
> 	http://tinyurl.com/sm9d
> 
> Unlike ipchains, iptables works perfectly fine, so perhaps we just
> need to update Kconfig to discourage ipchains on ia64 (and/or other
> 64-bit platforms)?

Please try this patch that just got included in linus tree.

ChangeSet 1.1360, 2003/10/27 00:01:25-08:00, rusty@rustcorp.com.au

	[NETFILTER]: Fix ipchains oops in NAT
	
	We updated ip_nat_setup_info to set the initialized flag and call
	place_in_hashes, but *didn't* change the call in ip_fw_compat_masq.c
	which also calls place_in_hashes() itself (again!).  Result: corrupt
	list, and next thing which lands in the same hash bucket goes boom.
	
	Thanks to Andy Polyakov for chasing this down.


# This patch includes the following deltas:
#	           ChangeSet	1.1359  -> 1.1360 
#	net/ipv4/netfilter/ip_fw_compat_masq.c	1.11    -> 1.12   
#

 ip_fw_compat_masq.c |    3 ---
 1 files changed, 3 deletions(-)


diff -Nru a/net/ipv4/netfilter/ip_fw_compat_masq.c b/net/ipv4/netfilter/ip_fw_compat_masq.c
--- a/net/ipv4/netfilter/ip_fw_compat_masq.c	Mon Oct 27 12:07:33 2003
+++ b/net/ipv4/netfilter/ip_fw_compat_masq.c	Mon Oct 27 12:07:33 2003
@@ -91,9 +91,6 @@
 			WRITE_UNLOCK(&ip_nat_lock);
 			return ret;
 		}
-
-		place_in_hashes(ct, info);
-		info->initialized = 1;
 	} else
 		DEBUGP("Masquerading already done on this conn.\n");
 	WRITE_UNLOCK(&ip_nat_lock);

-- 
/Martin

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 189 bytes --]

Re: status of ipchains in 2.6?

[David Mosberger]

Yes, Rusty mentioned the same patch yesterday.  I tried it now and
ipchain masquerading seems to be working fine again.

	--david

>>>>> On Tue, 28 Oct 2003 19:23:37 +0100, Martin Josefsson <gandalf@wlug.westbo.se> said:

  Martin> Please try this patch that just got included in linus tree.

  Martin> ChangeSet 1.1360, 2003/10/27 00:01:25-08:00, rusty@rustcorp.com.au

  Martin> [NETFILTER]: Fix ipchains oops in NAT

  Martin> We updated ip_nat_setup_info to set the initialized flag and call
  Martin> place_in_hashes, but *didn't* change the call in ip_fw_compat_masq.c
  Martin> which also calls place_in_hashes() itself (again!).  Result: corrupt
  Martin> list, and next thing which lands in the same hash bucket goes boom.

  Martin> Thanks to Andy Polyakov for chasing this down.


  Martin> # This patch includes the following deltas:
  Martin> #	           ChangeSet	1.1359  -> 1.1360 
  Martin> #	net/ipv4/netfilter/ip_fw_compat_masq.c	1.11    -> 1.12   
  Martin> #

  Martin> ip_fw_compat_masq.c |    3 ---
  Martin> 1 files changed, 3 deletions(-)


  Martin> diff -Nru a/net/ipv4/netfilter/ip_fw_compat_masq.c b/net/ipv4/netfilter/ip_fw_compat_masq.c
  Martin> --- a/net/ipv4/netfilter/ip_fw_compat_masq.c	Mon Oct 27 12:07:33 2003
  Martin> +++ b/net/ipv4/netfilter/ip_fw_compat_masq.c	Mon Oct 27 12:07:33 2003
  Martin> @@ -91,9 +91,6 @@
  Martin> WRITE_UNLOCK(&ip_nat_lock);
  Martin> return ret;
  Martin> }
  Martin> -
  Martin> -		place_in_hashes(ct, info);
  Martin> -		info->initialized = 1;
  Martin> } else
  Martin> DEBUGP("Masquerading already done on this conn.\n");
  Martin> WRITE_UNLOCK(&ip_nat_lock);

  Martin> -- 
  Martin> /Martin

Re: status of ipchains in 2.6?

[Andi Kleen]

Éric Brunet <Eric.Brunet@lps.ens.fr> writes:
> 
> In my case, 2.6.0-test4 is working fine.

Can you do a binary search in the versions to see which version
broke it? 

test5-test8 all had netfilter changes.

-Andi