conntrack-tools and kernel 2.6.22

conntrack-tools and kernel 2.6.22

[Ben Young]

Hello,

I have been working on switching some systems over to kernel version
2.6.22.  In the transition, conntrack-tools has stopped working on
these systems.  Depending on which commands I issue to conntrack, I
get one of the two errors below, neither of which is particularly
helpful in diagnosing the problem.

Operation failed: Can't open handler
Operation failed: sorry, you must be root or get CAP_NET_ADMIN
capability to do this

Does anyone know why conntrack wouldn't work on kernel 2.6.22 when it
works just fine when I'm running 2.6.17 or 2.6.18?  Or have any
suggestions for how to go about determining the root cause of this
issue?

FYI, I am currently using these versions of the conntrack tools:

libnetfilter_conntrack: 0.0.81
libnfnetlink: 0.0.30
conntrack: 1.00beta2

Thanks,

Ben

Re: conntrack-tools and kernel 2.6.22

[Pablo Neira Ayuso]

Ben Young wrote:
> I have been working on switching some systems over to kernel version
> 2.6.22.  In the transition, conntrack-tools has stopped working on
> these systems.  Depending on which commands I issue to conntrack, I
> get one of the two errors below, neither of which is particularly
> helpful in diagnosing the problem.
> 
> Operation failed: Can't open handler
> Operation failed: sorry, you must be root or get CAP_NET_ADMIN
> capability to do this
> 
> Does anyone know why conntrack wouldn't work on kernel 2.6.22 when it
> works just fine when I'm running 2.6.17 or 2.6.18?  Or have any
> suggestions for how to go about determining the root cause of this
> issue?
> 
> FYI, I am currently using these versions of the conntrack tools:
> 
> libnetfilter_conntrack: 0.0.81
> libnfnetlink: 0.0.30
> conntrack: 1.00beta2
               ^^^
This is an old version of the conntrack userspace commandline tool, get 
conntrack-tools 0.9.5 that contains conntrack and conntrackd.

http://people.netfilter.org/pablo/conntrack-tools/

Re: conntrack-tools and kernel 2.6.22

[Patrick McHardy]

Pablo Neira Ayuso wrote:
> Ben Young wrote:
>> I have been working on switching some systems over to kernel version
>> 2.6.22.  In the transition, conntrack-tools has stopped working on
>> these systems.  Depending on which commands I issue to conntrack, I
>> get one of the two errors below, neither of which is particularly
>> helpful in diagnosing the problem.
>>
>> Operation failed: Can't open handler
>> Operation failed: sorry, you must be root or get CAP_NET_ADMIN
>> capability to do this
>>
>> Does anyone know why conntrack wouldn't work on kernel 2.6.22 when it
>> works just fine when I'm running 2.6.17 or 2.6.18?  Or have any
>> suggestions for how to go about determining the root cause of this
>> issue?
>>
>> FYI, I am currently using these versions of the conntrack tools:
>>
>> libnetfilter_conntrack: 0.0.81
>> libnfnetlink: 0.0.30
>> conntrack: 1.00beta2
>               ^^^
> This is an old version of the conntrack userspace commandline tool, get 
> conntrack-tools 0.9.5 that contains conntrack and conntrackd.
> 
> http://people.netfilter.org/pablo/conntrack-tools/


Why doesn't it work on current kernels? Things shouldn't break
when updating the kernel.

Re: conntrack-tools and kernel 2.6.22

[Pablo Neira Ayuso]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
>> Ben Young wrote:
>>> I have been working on switching some systems over to kernel version
>>> 2.6.22.  In the transition, conntrack-tools has stopped working on
>>> these systems.  Depending on which commands I issue to conntrack, I
>>> get one of the two errors below, neither of which is particularly
>>> helpful in diagnosing the problem.
>>>
>>> Operation failed: Can't open handler
>>> Operation failed: sorry, you must be root or get CAP_NET_ADMIN
>>> capability to do this
>>>
>>> Does anyone know why conntrack wouldn't work on kernel 2.6.22 when it
>>> works just fine when I'm running 2.6.17 or 2.6.18?  Or have any
>>> suggestions for how to go about determining the root cause of this
>>> issue?
>>>
>>> FYI, I am currently using these versions of the conntrack tools:
>>>
>>> libnetfilter_conntrack: 0.0.81
>>> libnfnetlink: 0.0.30
>>> conntrack: 1.00beta2
>>               ^^^
>> This is an old version of the conntrack userspace commandline tool, 
>> get conntrack-tools 0.9.5 that contains conntrack and conntrackd.
>>
>> http://people.netfilter.org/pablo/conntrack-tools/
> 
> Why doesn't it work on current kernels? Things shouldn't break
> when updating the kernel.

Sure. Ben, in the meantime, could you try to reproduce the problem with 
the lastest version of the conntrack tools, please? I'll investigate 
what's wrong the old version.

Re: conntrack-tools and kernel 2.6.22

[Patrick McHardy]

Pablo Neira Ayuso wrote:
> Patrick McHardy wrote:
>> Pablo Neira Ayuso wrote:
>>> Ben Young wrote:

>>>> Operation failed: Can't open handler
>>>> Operation failed: sorry, you must be root or get CAP_NET_ADMIN
>>>> capability to do this
>>>>
>>> This is an old version of the conntrack userspace commandline tool, 
>>> get conntrack-tools 0.9.5 that contains conntrack and conntrackd.
>>>
>>> http://people.netfilter.org/pablo/conntrack-tools/
>>
>> Why doesn't it work on current kernels? Things shouldn't break
>> when updating the kernel.
> 
> Sure. Ben, in the meantime, could you try to reproduce the problem with 
> the lastest version of the conntrack tools, please? I'll investigate 
> what's wrong the old version.


Ah, I though you knew :) Actually it sounds very much like Ben
made a mistake converting his .config to nf_conntrack.