iptables 1.4.1 + iprange fails for me

iptables 1.4.1 + iprange fails for me

[Maxim Britov]

I updated yesterday kernel + iptables on my router (into Internet) box.
Kernel from kernel.org 2.6.25.6 + iptables 1.4.1-1 from fedora rawhide.
I'm use kernel without modules on that box.

I found troubles with iprange:
# iptables -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2 -j DROP
# iptables-save |fgrep range
-A INPUT -m iprange -j DROP

iptables -L -n show it as:
DROP       all  --  0.0.0.0/0            0.0.0.0/0           



-- 
Maxim Britov

GnuPG KeyID 0x4580A6D66F3DB1FB              xmpp:maxim@modum.by
Fingerprint:  4059 B5C5 8985 5A47 8F5A 8623 4580 A6D6 6F3D B1FB
GnuPG-ru Team (http://lists.gnupg.org/mailman/listinfo/gnupg-ru
               xmpp:gnupg-ru@conference.jabber.ru)

RE: iptables 1.4.1 + iprange fails for me

[Rob Sterenborg]

> I updated yesterday kernel + iptables on my router (into Internet)
> box. Kernel from kernel.org 2.6.25.6 + iptables 1.4.1-1 from
> fedora rawhide.
> I'm use kernel without modules on that box.
> 
> I found troubles with iprange:
> # iptables -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2 -j DROP
> # iptables-save |fgrep range -A INPUT -m iprange -j DROP
> 
> iptables -L -n show it as:
> DROP       all  --  0.0.0.0/0            0.0.0.0/0

And what does "iptables -nvL" say?


Grts,
Rob

RE: iptables 1.4.1 + iprange fails for me

[Rob Sterenborg]

Maxim Britov <mailto:maxim.britov@gmail.com> wrote on Friday , 13 June 2008
09:49:

Please post answers to the list so others can answer too.

>>> I updated yesterday kernel + iptables on my router (into Internet)
>>> box. Kernel from kernel.org 2.6.25.6 + iptables 1.4.1-1 from fedora
>>> rawhide. I'm use kernel without modules on that box.
>>> 
>>> I found troubles with iprange:
>>> # iptables -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2 -j DROP
>>> # iptables-save |fgrep range -A INPUT -m iprange -j DROP
>>> 
>>> iptables -L -n show it as:
>>> DROP       all  --  0.0.0.0/0            0.0.0.0/0
>> 
>> And what does "iptables -nvL" say?
> 
>     0     0 DROP       all  --  *      *       0.0.0.0/0
>       0.0.0.0/0

Perhaps the -v would have shown the info you were looking for but in this
case I don't know, perhaps someone does.


Grts,
Rob

Re: iptables 1.4.1 + iprange fails for me

[Jan Engelhardt]

On Friday 2008-06-13 08:02, Maxim Britov wrote:

>I updated yesterday kernel + iptables on my router (into Internet) box.
>Kernel from kernel.org 2.6.25.6 + iptables 1.4.1-1 from fedora rawhide.
>I'm use kernel without modules on that box.
>
>I found troubles with iprange:
># iptables -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2 -j DROP
># iptables-save |fgrep range
>-A INPUT -m iprange -j DROP
>
>iptables -L -n show it as:
>DROP       all  --  0.0.0.0/0            0.0.0.0/0           
>

commit 5aba9d57d07b3f5474f3c0e71e9309a841e932ae
Author: Jan Engelhardt <jengelh@medozas.de>
Date:   Fri Jun 13 10:43:01 2008 +0200

iprange: kernel flags were not set
    
The --src-range and --dst-range parameters did not set the IPRANGE_*
flags in struct xt_iprange_mtinfo.
    
Reported-by: Maxim Britov <maxim.britov@gmail.com>
Signed-off-by: Jan Engelhardt <jengelh@medozas.de>
---
 extensions/libxt_iprange.c |    6 ++++++
 1 files changed, 6 insertions(+), 0 deletions(-)

diff --git a/extensions/libxt_iprange.c b/extensions/libxt_iprange.c
index 70fcc57..8c8521e 100644
--- a/extensions/libxt_iprange.c
+++ b/extensions/libxt_iprange.c
@@ -119,6 +119,9 @@ iprange_mt4_parse(int c, char **argv, int invert, unsigned int *flags,
 		if (ia == NULL)
 			param_act(P_BAD_VALUE, "iprange", "--src-ip", end + 1);
 		memcpy(&info->src_max.in, ia, sizeof(*ia));
+		info->flags |= IPRANGE_SRC;
+		if (invert)
+			info->flags |= IPRANGE_SRC_INV;
 		*flags |= F_SRCIP;
 		return true;
 
@@ -135,6 +138,9 @@ iprange_mt4_parse(int c, char **argv, int invert, unsigned int *flags,
 		if (ia == NULL)
 			param_act(P_BAD_VALUE, "iprange", "--dst-ip", end + 1);
 		memcpy(&info->dst_max.in, ia, sizeof(*ia));
+		info->flags |= IPRANGE_DST;
+		if (invert)
+			info->flags |= IPRANGE_DST_INV;
 		*flags |= F_DSTIP;
 		return true;
 	}

Re: iptables 1.4.1 + iprange fails for me

[Maxim Britov]

[-- Attachment #1: Type: text/plain, Size: 1054 bytes --]

On Fri, 13 Jun 2008 10:47:40 +0200 (CEST)
 Jan Engelhardt wrote:

> On Friday 2008-06-13 08:02, Maxim Britov wrote:
> 
> >I updated yesterday kernel + iptables on my router (into Internet) box.
> >Kernel from kernel.org 2.6.25.6 + iptables 1.4.1-1 from fedora rawhide.
> >I'm use kernel without modules on that box.
> >
> >I found troubles with iprange:
> ># iptables -A INPUT -m iprange --src-range 1.1.1.1-2.2.2.2 -j DROP
> ># iptables-save |fgrep range
> >-A INPUT -m iprange -j DROP
> >
> >iptables -L -n show it as:
> >DROP       all  --  0.0.0.0/0            0.0.0.0/0           
> >
> 
> commit 5aba9d57d07b3f5474f3c0e71e9309a841e932ae
> Author: Jan Engelhardt <jengelh@medozas.de>
> Date:   Fri Jun 13 10:43:01 2008 +0200

Thanks. Seems fixed for me.


-- 
Maxim Britov

GnuPG KeyID 0x4580A6D66F3DB1FB              xmpp:maxim@modum.by
Fingerprint:  4059 B5C5 8985 5A47 8F5A 8623 4580 A6D6 6F3D B1FB
GnuPG-ru Team (http://lists.gnupg.org/mailman/listinfo/gnupg-ru
               xmpp:gnupg-ru@conference.jabber.ru)

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 835 bytes --]

Re: iptables 1.4.1 + iprange fails for me

[Patrick McHardy]

Jan Engelhardt wrote:
> iprange: kernel flags were not set
>     
> The --src-range and --dst-range parameters did not set the IPRANGE_*
> flags in struct xt_iprange_mtinfo.
>     
> Reported-by: Maxim Britov <maxim.britov@gmail.com>
> Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

Applied, thanks Jan.