* Re: 2.6.13-mm2
[not found] ` <1126396015l.6300l.1l@werewolf.able.es>
@ 2005-09-10 23:56 ` Andrew Morton
2005-09-11 0:07 ` 2.6.13-mm2 Patrick McHardy
0 siblings, 1 reply; 7+ messages in thread
From: Andrew Morton @ 2005-09-10 23:56 UTC (permalink / raw)
To: J.A. Magallon; +Cc: linux-kernel, netdev
"J.A. Magallon" <jamagallon@able.es> wrote:
>
>
> On 09.08, Andrew Morton wrote:
> >
> > ftp://ftp.kernel.org/pub/linux/kernel/people/akpm/patches/2.6/2.6.13/2.6.13-mm2/
> >
> > (kernel.org propagation is slow. There's a temp copy at
> > http://www.zip.com.au/~akpm/linux/patches/stuff/2.6.13-mm2.bz2)
> >
> >
>
> I can not ifup an interface while iptables is using it.
> Is this expected behaviour ?
Maybe it's expected, but breaking existing userspace is a serious issue.
> There is a possible bug (IMHO) in Mandrake initscripts, that start iptables
> before network interfaces, but this had always worked.
>
> Any ideas ?
Please always cc netdev@vger.kernel.org on networking matters.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: 2.6.13-mm2
2005-09-10 23:56 ` 2.6.13-mm2 Andrew Morton
@ 2005-09-11 0:07 ` Patrick McHardy
2005-09-11 0:49 ` 2.6.13-mm2 J.A. Magallon
0 siblings, 1 reply; 7+ messages in thread
From: Patrick McHardy @ 2005-09-11 0:07 UTC (permalink / raw)
To: Andrew Morton; +Cc: J.A. Magallon, linux-kernel, netdev
Andrew Morton wrote:
> "J.A. Magallon" <jamagallon@able.es> wrote:
>
>>I can not ifup an interface while iptables is using it.
>>Is this expected behaviour ?
>
> Maybe it's expected, but breaking existing userspace is a serious issue.
No, its not expected.
>>There is a possible bug (IMHO) in Mandrake initscripts, that start iptables
>>before network interfaces, but this had always worked.
>>
>>Any ideas ?
What's happening when you try to set the interface up? Please
provide output of ifup and strace of the failing command. Thanks.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: 2.6.13-mm2
2005-09-11 0:07 ` 2.6.13-mm2 Patrick McHardy
@ 2005-09-11 0:49 ` J.A. Magallon
2005-09-11 0:58 ` 2.6.13-mm2 J.A. Magallon
0 siblings, 1 reply; 7+ messages in thread
From: J.A. Magallon @ 2005-09-11 0:49 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Andrew Morton, linux-kernel, netdev
On 09.11, Patrick McHardy wrote:
> Andrew Morton wrote:
> > "J.A. Magallon" <jamagallon@able.es> wrote:
> >
> >>I can not ifup an interface while iptables is using it.
> >>Is this expected behaviour ?
> >
> > Maybe it's expected, but breaking existing userspace is a serious issue.
>
> No, its not expected.
>
> >>There is a possible bug (IMHO) in Mandrake initscripts, that start iptables
> >>before network interfaces, but this had always worked.
> >>
> >>Any ideas ?
>
> What's happening when you try to set the interface up? Please
> provide output of ifup and strace of the failing command. Thanks.
werewolf:~# ifdown eth0
werewolf:~# service iptables start
Applying iptables firewall rules:
[ OK ]
werewolf:~# iptables -v -t nat -L
Chain PREROUTING (policy ACCEPT 2 packets, 156 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 5 packets, 300 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- any eth0 anywhere anywhere
Chain OUTPUT (policy ACCEPT 5 packets, 300 bytes)
pkts bytes target prot opt in out source destination
werewolf:~# iptables -v -t filter -L
Chain INPUT (policy ACCEPT 257 packets, 51631 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- eth0 eth1 anywhere anywhere state RELATED,ESTABLISHED
0 0 ACCEPT all -- eth1 eth0 anywhere anywhere
Chain OUTPUT (policy ACCEPT 251 packets, 51163 bytes)
pkts bytes target prot opt in out source destination
werewolf:~# ifup eth0
Determining IP information for eth0...Operation failed.
failed.
I traced the problem to pump, and I did a diff between strace of pump
when it works and when it doesnt (witout and with iptables started):
socket(PF_FILE, SOCK_STREAM, 0) = 3
connect(3, {sa_family=AF_FILE, path="/var/run/pump.sock"}, 20) = 0
write(3, "\0\0\0\0eth0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300"..., 4280) = 4280
-read(3, "\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4280) = 4280
-exit_group(0) = ?
-Process 7931 detached
+read(3, "\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4280) = 4280
+socket(PF_FILE, SOCK_STREAM, 0) = 4
+connect(4, {sa_family=AF_FILE, path="/var/run/pump.sock"}, 20) = 0
+write(4, "\0\0\0\0eth0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300"..., 4280) = 4280
+read(4, "\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4280) = 4280
+write(2, "Operation failed.\n", 18Operation failed.
+) = 18
+exit_group(1) = ?
+Process 7822 detached
pump seems to write something in the socket, try to read it again and gets
different results.
Note, my iptables are modular and I did not unload the modules, just stopped
them with 'service iptables stop'. Digging further, if I just do
iptables -t nat -F, pump works again.
Hope this helps.
--
J.A. Magallon <jamagallon()able!es> \ Software is like sex:
werewolf!able!es \ It's better when it's free
Mandriva Linux release 2006.0 (Cooker) for i586
Linux 2.6.13-jam3 (gcc 4.0.1 (4.0.1-5mdk for Mandriva Linux release 2006.0))
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: 2.6.13-mm2
2005-09-11 0:49 ` 2.6.13-mm2 J.A. Magallon
@ 2005-09-11 0:58 ` J.A. Magallon
2005-09-11 1:03 ` 2.6.13-mm2 Patrick McHardy
0 siblings, 1 reply; 7+ messages in thread
From: J.A. Magallon @ 2005-09-11 0:58 UTC (permalink / raw)
To: Linux-Kernel Lista; +Cc: Patrick McHardy, Andrew Morton, netdev
On 09.11, J.A. Magallon wrote:
>
> On 09.11, Patrick McHardy wrote:
> > Andrew Morton wrote:
> > > "J.A. Magallon" <jamagallon@able.es> wrote:
> > >
> > >>I can not ifup an interface while iptables is using it.
> > >>Is this expected behaviour ?
> > >
> > > Maybe it's expected, but breaking existing userspace is a serious issue.
> >
> > No, its not expected.
> >
> > >>There is a possible bug (IMHO) in Mandrake initscripts, that start iptables
> > >>before network interfaces, but this had always worked.
> > >>
> > >>Any ideas ?
> >
> > What's happening when you try to set the interface up? Please
> > provide output of ifup and strace of the failing command. Thanks.
>
> werewolf:~# ifdown eth0
> werewolf:~# service iptables start
> Applying iptables firewall rules:
> [ OK ]
> werewolf:~# iptables -v -t nat -L
> Chain PREROUTING (policy ACCEPT 2 packets, 156 bytes)
> pkts bytes target prot opt in out source destination
>
> Chain POSTROUTING (policy ACCEPT 5 packets, 300 bytes)
> pkts bytes target prot opt in out source destination
> 0 0 MASQUERADE all -- any eth0 anywhere anywhere
>
> Chain OUTPUT (policy ACCEPT 5 packets, 300 bytes)
> pkts bytes target prot opt in out source destination
> werewolf:~# iptables -v -t filter -L
> Chain INPUT (policy ACCEPT 257 packets, 51631 bytes)
> pkts bytes target prot opt in out source destination
>
> Chain FORWARD (policy DROP 0 packets, 0 bytes)
> pkts bytes target prot opt in out source destination
> 0 0 ACCEPT all -- eth0 eth1 anywhere anywhere state RELATED,ESTABLISHED
> 0 0 ACCEPT all -- eth1 eth0 anywhere anywhere
>
> Chain OUTPUT (policy ACCEPT 251 packets, 51163 bytes)
> pkts bytes target prot opt in out source destination
>
> werewolf:~# ifup eth0
>
> Determining IP information for eth0...Operation failed.
> failed.
>
> I traced the problem to pump, and I did a diff between strace of pump
> when it works and when it doesnt (witout and with iptables started):
>
> socket(PF_FILE, SOCK_STREAM, 0) = 3
> connect(3, {sa_family=AF_FILE, path="/var/run/pump.sock"}, 20) = 0
> write(3, "\0\0\0\0eth0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300"..., 4280) = 4280
> -read(3, "\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4280) = 4280
> -exit_group(0) = ?
> -Process 7931 detached
> +read(3, "\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4280) = 4280
> +socket(PF_FILE, SOCK_STREAM, 0) = 4
> +connect(4, {sa_family=AF_FILE, path="/var/run/pump.sock"}, 20) = 0
> +write(4, "\0\0\0\0eth0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\300"..., 4280) = 4280
> +read(4, "\1\0\0\0\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 4280) = 4280
> +write(2, "Operation failed.\n", 18Operation failed.
> +) = 18
> +exit_group(1) = ?
> +Process 7822 detached
>
> pump seems to write something in the socket, try to read it again and gets
> different results.
>
> Note, my iptables are modular and I did not unload the modules, just stopped
> them with 'service iptables stop'. Digging further, if I just do
> iptables -t nat -F, pump works again.
>
> Hope this helps.
>
And I also get this on syslog:
Sep 11 02:56:58 werewolf kernel: MASQUERADE: eth0 ate my IP address
Sep 11 02:56:58 werewolf kernel: MASQUERADE: eth0 ate my IP address
--
J.A. Magallon <jamagallon()able!es> \ Software is like sex:
werewolf!able!es \ It's better when it's free
Mandriva Linux release 2006.0 (Cooker) for i586
Linux 2.6.13-jam3 (gcc 4.0.1 (4.0.1-5mdk for Mandriva Linux release 2006.0))
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: 2.6.13-mm2
2005-09-11 0:58 ` 2.6.13-mm2 J.A. Magallon
@ 2005-09-11 1:03 ` Patrick McHardy
2005-09-11 1:22 ` 2.6.13-mm2 J.A. Magallon
0 siblings, 1 reply; 7+ messages in thread
From: Patrick McHardy @ 2005-09-11 1:03 UTC (permalink / raw)
To: J.A. Magallon; +Cc: Linux-Kernel Lista, Andrew Morton, netdev
[-- Attachment #1: Type: text/plain, Size: 547 bytes --]
J.A. Magallon wrote:
> And I also get this on syslog:
>
> Sep 11 02:56:58 werewolf kernel: MASQUERADE: eth0 ate my IP address
> Sep 11 02:56:58 werewolf kernel: MASQUERADE: eth0 ate my IP address
Thanks, I'm pretty sure its caused by this patch. The problem is that
pump uses a regular UDP socket (some other dhcp clients use AF_PACKET
sockets), and packet sent by it are also handled by iptables. The
MASQUERADE rule can't find a local IP address and drops the packet.
I'm not sure how to fix it yet, reverting the patch is not a good
option.
[-- Attachment #2: x --]
[-- Type: text/plain, Size: 1219 bytes --]
[NETFILTER]: Don't exclude local packets from MASQUERADING
Increases consistency in source-address selection.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---
commit 9baa5c67ff4ce57b6b9f68c90714a1bb876fccd7
tree 27f2c48e12e1bb5e3e6d5f8320651c213892ed20
parent fb13ab2849074244a51ae5147483610529a29ced
author Patrick McHardy <kaber@trash.net> Sun, 14 Aug 2005 17:32:50 -0700
committer David S. Miller <davem@sunset.davemloft.net> Mon, 29 Aug 2005 15:58:36 -0700
net/ipv4/netfilter/ipt_MASQUERADE.c | 5 -----
1 files changed, 0 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
--- a/net/ipv4/netfilter/ipt_MASQUERADE.c
+++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
@@ -86,11 +86,6 @@ masquerade_target(struct sk_buff **pskb,
IP_NF_ASSERT(hooknum == NF_IP_POST_ROUTING);
- /* FIXME: For the moment, don't do local packets, breaks
- testsuite for 2.3.49 --RR */
- if ((*pskb)->sk)
- return NF_ACCEPT;
-
ct = ip_conntrack_get(*pskb, &ctinfo);
IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
|| ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: 2.6.13-mm2
2005-09-11 1:03 ` 2.6.13-mm2 Patrick McHardy
@ 2005-09-11 1:22 ` J.A. Magallon
2005-09-11 1:25 ` 2.6.13-mm2 Patrick McHardy
0 siblings, 1 reply; 7+ messages in thread
From: J.A. Magallon @ 2005-09-11 1:22 UTC (permalink / raw)
To: Patrick McHardy; +Cc: Linux-Kernel Lista, Andrew Morton, netdev
On 09.11, Patrick McHardy wrote:
> J.A. Magallon wrote:
> > And I also get this on syslog:
> >
> > Sep 11 02:56:58 werewolf kernel: MASQUERADE: eth0 ate my IP address
> > Sep 11 02:56:58 werewolf kernel: MASQUERADE: eth0 ate my IP address
>
> Thanks, I'm pretty sure its caused by this patch. The problem is that
> pump uses a regular UDP socket (some other dhcp clients use AF_PACKET
> sockets), and packet sent by it are also handled by iptables. The
> MASQUERADE rule can't find a local IP address and drops the packet.
> I'm not sure how to fix it yet, reverting the patch is not a good
> option.
>
>
> [NETFILTER]: Don't exclude local packets from MASQUERADING
>
> Increases consistency in source-address selection.
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
> Signed-off-by: David S. Miller <davem@davemloft.net>
>
> ---
> commit 9baa5c67ff4ce57b6b9f68c90714a1bb876fccd7
> tree 27f2c48e12e1bb5e3e6d5f8320651c213892ed20
> parent fb13ab2849074244a51ae5147483610529a29ced
> author Patrick McHardy <kaber@trash.net> Sun, 14 Aug 2005 17:32:50 -0700
> committer David S. Miller <davem@sunset.davemloft.net> Mon, 29 Aug 2005 15:58:36 -0700
>
> net/ipv4/netfilter/ipt_MASQUERADE.c | 5 -----
> 1 files changed, 0 insertions(+), 5 deletions(-)
>
> diff --git a/net/ipv4/netfilter/ipt_MASQUERADE.c b/net/ipv4/netfilter/ipt_MASQUERADE.c
> --- a/net/ipv4/netfilter/ipt_MASQUERADE.c
> +++ b/net/ipv4/netfilter/ipt_MASQUERADE.c
> @@ -86,11 +86,6 @@ masquerade_target(struct sk_buff **pskb,
>
> IP_NF_ASSERT(hooknum == NF_IP_POST_ROUTING);
>
> - /* FIXME: For the moment, don't do local packets, breaks
> - testsuite for 2.3.49 --RR */
> - if ((*pskb)->sk)
> - return NF_ACCEPT;
> -
> ct = ip_conntrack_get(*pskb, &ctinfo);
> IP_NF_ASSERT(ct && (ctinfo == IP_CT_NEW || ctinfo == IP_CT_RELATED
> || ctinfo == IP_CT_RELATED + IP_CT_IS_REPLY));
>
Thanks, reverting this made things work again.
Are you confident in fixing this shortly, or should I just drop pump ?
--
J.A. Magallon <jamagallon()able!es> \ Software is like sex:
werewolf!able!es \ It's better when it's free
Mandriva Linux release 2006.0 (Cooker) for i586
Linux 2.6.13-jam3 (gcc 4.0.1 (4.0.1-5mdk for Mandriva Linux release 2006.0))
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: 2.6.13-mm2
2005-09-11 1:22 ` 2.6.13-mm2 J.A. Magallon
@ 2005-09-11 1:25 ` Patrick McHardy
0 siblings, 0 replies; 7+ messages in thread
From: Patrick McHardy @ 2005-09-11 1:25 UTC (permalink / raw)
To: J.A. Magallon; +Cc: Linux-Kernel Lista, Andrew Morton, netdev
J.A. Magallon wrote:
> On 09.11, Patrick McHardy wrote:
>
>>[NETFILTER]: Don't exclude local packets from MASQUERADING
>>
> Thanks, reverting this made things work again.
>
> Are you confident in fixing this shortly, or should I just drop pump ?
I should have a fix within the next couple of days.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2005-09-11 1:25 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20050908053042.6e05882f.akpm@osdl.org>
[not found] ` <1126396015l.6300l.1l@werewolf.able.es>
2005-09-10 23:56 ` 2.6.13-mm2 Andrew Morton
2005-09-11 0:07 ` 2.6.13-mm2 Patrick McHardy
2005-09-11 0:49 ` 2.6.13-mm2 J.A. Magallon
2005-09-11 0:58 ` 2.6.13-mm2 J.A. Magallon
2005-09-11 1:03 ` 2.6.13-mm2 Patrick McHardy
2005-09-11 1:22 ` 2.6.13-mm2 J.A. Magallon
2005-09-11 1:25 ` 2.6.13-mm2 Patrick McHardy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).