note owner match brokenness

PATCH Applied Phil Oester 3 participants 6 messages Oct 1, 2004 – Oct 3, 2004 netfilter

Share & tools

Phil Oester

author

2004-10-01 20:44 UTC #0 lore raw

PATCH 1/1 note owner match brokenness

Someone recently complained in bugzilla that the note about owner match being broken on SMP took hours to find because it was in syslog instead of userspace. Hopefully the below patch will save others some time.

This closes bugzilla #244

Phil

extensions/libipt_owner.c +2 -0

diff -ru ipt-orig/extensions/libipt_owner.c ipt-new/extensions/libipt_owner.c
@@ -22,6 +22,7 @@
 "[!] --pid-owner processid  Match local pid\n"
 "[!] --sid-owner sessionid  Match local sid\n"
 "[!] --cmd-owner name       Match local command name\n"
+"NOTE: pid, sid and command matching are broken on SMP\n"
 "\n",
 IPTABLES_VERSION);
 #else

@@ -31,6 +32,7 @@
 "[!] --gid-owner groupid    Match local gid\n"
 "[!] --pid-owner processid  Match local pid\n"
 "[!] --sid-owner sessionid  Match local sid\n"
+"NOTE: pid and sid matching are broken on SMP\n"
 "\n",
 IPTABLES_VERSION);
 #endif /* IPT_OWNER_COMM */

Patrick McHardy

2004-10-01 21:09 UTC #1 lore raw

Quoted 7 lines · Phil Oester

Someone recently complained in bugzilla that the note about owner match being broken on SMP took hours to find because it was in syslog instead of userspace. Hopefully the below patch will save others some time.
This closes bugzilla #244

If we warn in userspace, we should warn when then options are used instead of in the helptext.

Regards
Patrick

Quoted 28 lines

Phil
------------------------------------------------------------------------
diff -ru ipt-orig/extensions/libipt_owner.c ipt-new/extensions/libipt_owner.c
extensions/libipt_owner.c +0 -0
@@ -22,6 +22,7 @@
"[!] --pid-owner processid  Match local pid\n"
"[!] --sid-owner sessionid  Match local sid\n"
"[!] --cmd-owner name       Match local command name\n"
+"NOTE: pid, sid and command matching are broken on SMP\n" "\n",
IPTABLES_VERSION);
#else
extensions/libipt_owner.c +0 -0
@@ -31,6 +32,7 @@
"[!] --gid-owner groupid    Match local gid\n"
"[!] --pid-owner processid  Match local pid\n"
"[!] --sid-owner sessionid  Match local sid\n"
+"NOTE: pid and sid matching are broken on SMP\n"
"\n",
IPTABLES_VERSION);
#endif /* IPT_OWNER_COMM */

Phil Oester

author

2004-10-01 21:12 UTC #2 lore raw

Quoted 11 lines · Patrick McHardy

Quoted 7 lines · Phil Oester
Someone recently complained in bugzilla that the note about owner match being broken on SMP took hours to find because it was in syslog instead of userspace. Hopefully the below patch will save others some time.
This closes bugzilla #244
If we warn in userspace, we should warn when then options are used instead of in the helptext.

Agreed, but do we want to:

1) warn on every single use of owner match?
2) have iptables determine if we are running on an SMP box, and only warn in that case?

I didn't think either of these were terribly appealing.

Phil

Patrick McHardy

2004-10-01 21:30 UTC #3 lore raw

Quoted 8 lines · Phil Oester

Quoted 4 lines · Patrick McHardy
If we warn in userspace, we should warn when then options are used instead of in the helptext.

Quoted 9 lines

Agreed, but do we want to:
1) warn on every single use of owner match?
2) have iptables determine if we are running on an SMP box, and only warn in that case?
I didn't think either of these were terribly appealing.

Agreed, I'm going to apply your patch. Thanks.

Regards
Patrick

Herve Eychenne

2004-10-03 19:43 UTC #4 lore raw

Quoted 16 lines · Patrick McHardy

Quoted 14 lines · Phil Oester
Quoted 4 lines · Patrick McHardy
If we warn in userspace, we should warn when then options are used instead of in the helptext.
Agreed, but do we want to:
1) warn on every single use of owner match?
2) have iptables determine if we are running on an SMP box, and only warn in that case?

Quoted 5 lines

Quoted 3 lines
I didn't think either of these were terribly appealing.
Agreed, I'm going to apply your patch. Thanks.

Please apply the same to the manpage!

Herve

Signature · 4 lines

 _
(°=  Hervé Eychenne
//)
v_/_ WallFire project:  http://www.wallfire.org/

Patrick McHardy

Applied

2004-10-03 20:36 UTC #5 lore raw

Quoted 10 lines · Herve Eychenne

Quoted 3 lines · Patrick McHardy
Agreed, I'm going to apply your patch. Thanks.
Please apply the same to the manpage!

I've applied this patch to the manpages.

Regards
Patrick

Index: extensions/libip6t_owner.man
===================================================================
RCS file: /cvsroot/iptables/extensions/libip6t_owner.man,v retrieving revision 1.1

libip6t_owner.man +2 -0

diff -u -r1.1 libip6t_owner.man
@@ -19,3 +19,5 @@
 .BI "--sid-owner " "sessionid"
 Matches if the packet was created by a process in the given session
 group.
+.TP
+.B NOTE: pid, sid and command matching are broken on SMP

Index: extensions/libipt_owner.man
===================================================================
RCS file: /cvsroot/iptables/extensions/libipt_owner.man,v retrieving revision 1.1

libipt_owner.man +2 -0

diff -u -r1.1 libipt_owner.man
@@ -24,3 +24,5 @@
 Matches if the packet was created by a process with the given command name.
 (this option is present only if iptables was compiled under a kernel
 supporting this feature)
+.TP
+.B NOTE: pid, sid and command matching are broken on SMP