iptables random support

iptables random support

[Daniel Williams]

Hi,

I have been trying to get iptables -m random support working to very
little success.

Does anyone have a modern 2.6 kernel with iptables -m random working ?

I tried using the random and nth patches from patch-o-matic-ng-20050918,
with 2.6.17.7 and iptables 1.2.11 and 1.3.5.

The modules are loaded:
root@server2:/usr/src# lsmod | grep ipt
iptable_nat             8196  0
ip_nat                 17580  1 iptable_nat
iptable_filter          3968  0
ipt_random              3200  0
ipt_nth                 3584  0
iptable_mangle          3968  0
ip_tables              14580  3
iptable_nat,iptable_filter,iptable_mangle
x_tables               14724  5
xt_tcpudp,iptable_nat,ipt_random,ipt_nth,ip_tables


When I type a command that uses random or nth I get:
# iptables -A INPUT -m random --average 1 -j ACCEPT
iptables: Invalid argument
# iptables -A INPUT -m nth --every 2 -j ACCEPT
iptables: Invalid argument
with iptables 1.2.11 and with iptables 1.3.5:
# iptables -A INPUT -m nth --every 2 -j ACCEPT
iptables: Unknown error 4294967295
# iptables -A INPUT -m random -j ACCEPT
iptables: Unknown error 4294967295


I realize the 'unknown error' is a known, unrelated bug.

I have some complicated routing requirements that I plan to use random
in combination with mark/fwmark routing.

I am also interested if anyone has this setup and can tell me the
performance of there setup.

Daniel

Fwd: iptables random support

[Daniel De Graaf]

(Sorry if you get this twice; I forgot to cc: the list before)
On 7/30/06, Daniel Williams <danielw@staff.iinet.net.au> wrote:
>
> Hi,
>
> I have been trying to get iptables -m random support working to very
> little success.
>
> Does anyone have a modern 2.6 kernel with iptables -m random working ?
>
> I tried using the random and nth patches from patch-o-matic-ng-20050918,
> with 2.6.17.7 and iptables 1.2.11 and 1.3.5.
>
> The modules are loaded:
> root@server2:/usr/src# lsmod | grep ipt
> iptable_nat             8196  0
> ip_nat                 17580  1 iptable_nat
> iptable_filter          3968  0
> ipt_random              3200  0
> ipt_nth                 3584  0
> iptable_mangle          3968  0
> ip_tables              14580  3
> iptable_nat,iptable_filter,iptable_mangle
> x_tables               14724  5
> xt_tcpudp,iptable_nat,ipt_random,ipt_nth,ip_tables
>
>
> When I type a command that uses random or nth I get:
> # iptables -A INPUT -m random --average 1 -j ACCEPT
> iptables: Invalid argument
> # iptables -A INPUT -m nth --every 2 -j ACCEPT
> iptables: Invalid argument
> with iptables 1.2.11 and with iptables 1.3.5:
> # iptables -A INPUT -m nth --every 2 -j ACCEPT
> iptables: Unknown error 4294967295
> # iptables -A INPUT -m random -j ACCEPT
> iptables: Unknown error 4294967295
>
>
> I realize the 'unknown error' is a known, unrelated bug.
>
> I have some complicated routing requirements that I plan to use random
> in combination with mark/fwmark routing.
>
> I am also interested if anyone has this setup and can tell me the
> performance of there setup.
>
> Daniel
>

Patching the source code for -m random is very simple if you know C:
just change the function definitions of match and checkentry to the
ones below, and add ".matchsize = sizeof(ipt_rand_info)" to the struct
ipt_match definition. The same can be done to ipt_nth.

These two modules are unified in the 2.6.18 mainline as xt_statistic.

- Daniel De Graaf

static int match(const struct sk_buff *skb,
             const struct net_device *in,
             const struct net_device *out,
             const struct xt_match *match,
             const void *matchinfo,
             int offset,
             unsigned int protoff,
             int *hotdrop)

static int checkentry(const char *tablename,
              const void *ip,
              const struct xt_match *match,
              void *matchinfo,
              unsigned int matchinfosize,
              unsigned int hook_mask)

Re: iptables random support

[Jan Engelhardt]

>
>I have been trying to get iptables -m random support working to very
>little success.
>
>Does anyone have a modern 2.6 kernel with iptables -m random working ?

http://freshmeat.net/p/jen_kernel/
look for random in the .tar.bz2


Jan Engelhardt
-- 

Re: iptables random support

[Ming-Ching Tiew]

I took the patch and apply to a vanilla 2.6.17.7, it failed :-

patching file include/linux/netfilter_ipv4/ipt_random.h
patching file include/linux/netfilter_ipv6/ip6t_random.h
patching file net/ipv4/netfilter/Kconfig
Hunk #1 succeeded at 314 with fuzz 2 (offset -34 lines).
patching file net/ipv4/netfilter/Makefile
Hunk #1 FAILED at 64.
1 out of 1 hunk FAILED -- saving rejects to file net/ipv4/netfilter/Makefile.rej
patching file net/ipv4/netfilter/ipt_random.c
patching file net/ipv6/netfilter/Kconfig
Hunk #1 succeeded at 123 with fuzz 2 (offset -24 lines).
patching file net/ipv6/netfilter/Makefile
Hunk #1 FAILED at 12.
1 out of 1 hunk FAILED -- saving rejects to file net/ipv6/netfilter/Makefile.rej
patching file net/ipv6/netfilter/ip6t_random.c


----- Original Message ----- 
From: "Jan Engelhardt" <jengelh@linux01.gwdg.de>
To: "Daniel Williams" <danielw@staff.iinet.net.au>
Cc: <netfilter@lists.netfilter.org>
Sent: Tuesday, August 01, 2006 7:06 PM
Subject: Re: iptables random support


> >
> >I have been trying to get iptables -m random support working to very
> >little success.
> >
> >Does anyone have a modern 2.6 kernel with iptables -m random working ?
> 
> http://freshmeat.net/p/jen_kernel/
> look for random in the .tar.bz2
> 
> 
> Jan Engelhardt
> -- 
> 

RE: iptables random support

[Daniel Williams]

To add to this dmesg reports the following when trying to add a random
or nth match rule:
ip_tables: random match: invalid size 0 != 4
and
ip_tables: nth match: invalid size 0 != 8


Daniel

-----Original Message-----
From: netfilter-bounces@lists.netfilter.org
[mailto:netfilter-bounces@lists.netfilter.org] On Behalf Of Daniel
Williams
Sent: Sunday, 30 July 2006 9:53 PM
To: netfilter@lists.netfilter.org
Subject: iptables random support


Hi,

I have been trying to get iptables -m random support working to very
little success.

Does anyone have a modern 2.6 kernel with iptables -m random working ?

I tried using the random and nth patches from patch-o-matic-ng-20050918,
with 2.6.17.7 and iptables 1.2.11 and 1.3.5.

The modules are loaded:
root@server2:/usr/src# lsmod | grep ipt
iptable_nat             8196  0
ip_nat                 17580  1 iptable_nat
iptable_filter          3968  0
ipt_random              3200  0
ipt_nth                 3584  0
iptable_mangle          3968  0
ip_tables              14580  3
iptable_nat,iptable_filter,iptable_mangle
x_tables               14724  5
xt_tcpudp,iptable_nat,ipt_random,ipt_nth,ip_tables


When I type a command that uses random or nth I get:
# iptables -A INPUT -m random --average 1 -j ACCEPT
iptables: Invalid argument
# iptables -A INPUT -m nth --every 2 -j ACCEPT
iptables: Invalid argument
with iptables 1.2.11 and with iptables 1.3.5:
# iptables -A INPUT -m nth --every 2 -j ACCEPT
iptables: Unknown error 4294967295
# iptables -A INPUT -m random -j ACCEPT
iptables: Unknown error 4294967295


I realize the 'unknown error' is a known, unrelated bug.

I have some complicated routing requirements that I plan to use random
in combination with mark/fwmark routing.

I am also interested if anyone has this setup and can tell me the
performance of there setup.

Daniel