Patchwork iptables: state match incompatibilty across versions

login
register
mail settings
Submitter Phil Oester
Date Aug. 7, 2013, 11:44 p.m.
Message ID <20130807234449.GA22535@linuxace.com>
Download mbox | patch
Permalink /patch/265620/
State Accepted
Headers show

Comments

Phil Oester - Aug. 7, 2013, 11:44 p.m.
As reported in Debian bug #718810 [1], state match rules added in < 1.4.16
iptables versions are incorrectly displayed by >= 1.4.16 iptables versions.
Issue bisected to commit 0d701631 (libxt_state: replace as an alias to
xt_conntrack).

Fix this by adding the missing .print and .save functions for state match
aliases in the conntrack match.

Signed-off-by: Phil Oester <kernel@linuxace.com>

[1] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=718810
Pablo Neira - Aug. 8, 2013, 4:16 p.m.
On Wed, Aug 07, 2013 at 04:44:49PM -0700, Phil Oester wrote:
> As reported in Debian bug #718810 [1], state match rules added in < 1.4.16
> iptables versions are incorrectly displayed by >= 1.4.16 iptables versions.
> Issue bisected to commit 0d701631 (libxt_state: replace as an alias to
> xt_conntrack).
> 
> Fix this by adding the missing .print and .save functions for state match
> aliases in the conntrack match.

The problem seems to be related with xtables_mt_prefer, which ranks
the conntrack match higher than state match itself, as it treats state
as an alias. This is OK in the userspace to kernel path, where state
is internally transformed to conntrack, but not from kernel to
userspace, where the state match info is being interpreted by the
conntrack match.

We could fix this from libxtables, but adding some parameter to
xtables_find_match to indicate what path this function is called from.
But that requires a new ABI change to resolve it, which will break
Jamal's tc action again, I guess stephen will not be very happy with
it.

I'm going to take your patch, it's simple and it fixes this issue.

Thanks Phil.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/extensions/libxt_conntrack.c b/extensions/libxt_conntrack.c
index 9f7b5db..128bbd2 100644
--- a/extensions/libxt_conntrack.c
+++ b/extensions/libxt_conntrack.c
@@ -1272,6 +1272,8 @@  static struct xtables_match conntrack_mt_reg[] = {
 		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
 		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo1)),
 		.help          = state_help,
+		.print         = state_print,
+		.save          = state_save,
 		.x6_parse      = state_ct1_parse,
 		.x6_options    = state_opts,
 	},
@@ -1285,6 +1287,8 @@  static struct xtables_match conntrack_mt_reg[] = {
 		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
 		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo2)),
 		.help          = state_help,
+		.print         = state_print,
+		.save          = state_save,
 		.x6_parse      = state_ct23_parse,
 		.x6_options    = state_opts,
 	},
@@ -1298,6 +1302,8 @@  static struct xtables_match conntrack_mt_reg[] = {
 		.size          = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
 		.userspacesize = XT_ALIGN(sizeof(struct xt_conntrack_mtinfo3)),
 		.help          = state_help,
+		.print         = state_print,
+		.save          = state_save,
 		.x6_parse      = state_ct23_parse,
 		.x6_options    = state_opts,
 	},