Re: Fw: [Bugme-new] [Bug 6349] New: iptables DNAT returns unknown error 4294967295

Re: Fw: [Bugme-new] [Bug 6349] New: iptables DNAT returns unknown error 4294967295

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 1272 bytes --]

Andrew Morton wrote:
> 
> Begin forwarded message:
> 
> Date: Fri, 7 Apr 2006 06:12:07 -0700
> From: bugme-daemon@bugzilla.kernel.org
> To: bugme-new@lists.osdl.org
> Subject: [Bugme-new] [Bug 6349] New: iptables DNAT returns unknown error 4294967295
> 
> 
> http://bugzilla.kernel.org/show_bug.cgi?id=6349
> 
>            Summary: iptables DNAT returns unknown error 4294967295
>     Kernel Version: 2.6.17-rc1
>             Status: NEW
>           Severity: blocking
>              Owner: laforge@gnumonks.org
>          Submitter: dmb@pochta.ru
> 
> 
> Problem Description:
> When I try to add the rule with target DNAT to the OUTPUT chain I get the error
> message:
> [root@dbagrii:~]# iptables -t nat -A OUTPUT -p tcp -d 192.168.1.1 --dport 119 -j
> DNAT --to-destination 192.168.1.10:8119
> iptables: Unknown error 4294967295
> 
> No rule is added, and the kernel says the message to the syslog:
> Apr  7 15:20:05 dbagrii kernel: ip_tables: DNAT target: bad hook_mask 8
> 
> This error appears with iptables tool version 1.3.3 and 1.3.5 i tried to use.
> 
> Steps to reproduce:
> Run the iptables tool with this arguments:
> $ iptables -t nat -A OUTPUT -p tcp -d 192.168.1.1 --dport 119 -j DNAT
> --to-destination 192.168.1.10:8119

Please try if this patch helps.


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 973 bytes --]

[NETFILTER]: Fix DNAT in LOCAL_OUT

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 0fc7ff57191de5c09afe7db3932009963bba44d6
tree 02bc033088605bfd51fa4ea7ceb57d0aae1db65e
parent 8cc24d7ca2ffc6d9d70e1d94dc8dffbdf677e58f
author Patrick McHardy <kaber@trash.net> Sat, 08 Apr 2006 13:52:18 +0200
committer Patrick McHardy <kaber@trash.net> Sat, 08 Apr 2006 13:52:18 +0200

 net/ipv4/netfilter/ip_nat_rule.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
index efba8c4..250b8ed 100644
--- a/net/ipv4/netfilter/ip_nat_rule.c
+++ b/net/ipv4/netfilter/ip_nat_rule.c
@@ -279,7 +279,7 @@ static struct ipt_target ipt_dnat_reg = 
 	.target		= ipt_dnat_target,
 	.targetsize	= sizeof(struct ip_nat_multi_range_compat),
 	.table		= "nat",
-	.hooks		= 1 << NF_IP_PRE_ROUTING,
+	.hooks		= 1 << NF_IP_PRE_ROUTING || 1 << NF_IP_LOCAL_OUT,
 	.checkentry	= ipt_dnat_checkentry,
 };
 

Re: Fw: [Bugme-new] [Bug 6349] New: iptables DNAT returns unknown error 4294967295

[Patrick McHardy]

[-- Attachment #1: Type: text/plain, Size: 211 bytes --]

Patrick McHardy wrote:
> Please try if this patch helps.
> 
> +	.hooks		= 1 << NF_IP_PRE_ROUTING || 1 << NF_IP_LOCAL_OUT,

I shouldn't send patches before getting out of bed .. :)

Please try this one instead.


[-- Attachment #2: x --]
[-- Type: text/plain, Size: 976 bytes --]

[NETFILTER]: Fix DNAT in LOCAL_OUT

Signed-off-by: Patrick McHardy <kaber@trash.net>

---
commit 2ceefa038e908d5da21aefedae02da4eab1b2787
tree 417f03eca3b97b16a78321ace1556e57f5c60351
parent 8cc24d7ca2ffc6d9d70e1d94dc8dffbdf677e58f
author Patrick McHardy <kaber@trash.net> Sat, 08 Apr 2006 13:59:53 +0200
committer Patrick McHardy <kaber@trash.net> Sat, 08 Apr 2006 13:59:53 +0200

 net/ipv4/netfilter/ip_nat_rule.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/ipv4/netfilter/ip_nat_rule.c b/net/ipv4/netfilter/ip_nat_rule.c
index efba8c4..1aba926 100644
--- a/net/ipv4/netfilter/ip_nat_rule.c
+++ b/net/ipv4/netfilter/ip_nat_rule.c
@@ -279,7 +279,7 @@ static struct ipt_target ipt_dnat_reg = 
 	.target		= ipt_dnat_target,
 	.targetsize	= sizeof(struct ip_nat_multi_range_compat),
 	.table		= "nat",
-	.hooks		= 1 << NF_IP_PRE_ROUTING,
+	.hooks		= (1 << NF_IP_PRE_ROUTING) | (1 << NF_IP_LOCAL_OUT),
 	.checkentry	= ipt_dnat_checkentry,
 };
 

Re: [Bugme-new] [Bug 6349] New: iptables DNAT returns unknown error 4294967295

[David S. Miller]

From: Patrick McHardy <kaber@trash.net>
Date: Sat, 08 Apr 2006 13:58:10 +0200

> Patrick McHardy wrote:
> > Please try if this patch helps.
> > 
> > +	.hooks		= 1 << NF_IP_PRE_ROUTING || 1 << NF_IP_LOCAL_OUT,
> 
> I shouldn't send patches before getting out of bed .. :)
> 
> Please try this one instead.

I'm applying this to my tree.

If it's wrong for some reason, we still have time in the 2.6.17-X
devel cycle to correct it.