Re: [NETFILTER]: Unable to delete a SAME rule (Using SAME target problems)

[Patrick McHardy <kaber@trash.net>]

Konstantin Khorenko wrote:
> Dear all,
> 
> The problem description: unable to delete a SAME target rule.
> 
> [...]
> At the moment i can see only 3 ways of fixing this:
> * reassemble struct ipt_same_info - put 'ipnum' and 'iparray' at the end of the
> structure. This will save generic code both in kernel and userspace.
> 
> * let struct ipt_same_info be as is, teach userspace to manipulate more complex
> masks (not only first X bytes of the structure)
> 
> * let struct ipt_same_info be as is, teach kernel to zero pointers and all the
> fields which are used only in kernel.
> 
> All these ways are quite painful, but could someone please comment this - may
> be i just missed and some decision had been already done on this issue?


Actually yes, thats why haven't got compat support for SAME yet.
Because of these issues and since SAME is obsolete nowadays I've
decided to put it on feature-removal-schedule instead of trying
to work around the problems, it will be removed at 1.1.08:

What:   iptables SAME target 

When:   1.1. 2008
Files:  net/ipv4/netfilter/ipt_SAME.c, 
include/linux/netfilter_ipv4/ipt_SAME.h
Why:    Obsolete for multiple years now, NAT core provides the same 
behaviour.
         Unfixable broken wrt. 32/64 bit cleanness.
Who:    Patrick McHardy <kaber@trash.net>