iptables problem upgrading kernel from 3.18.8 to 3.19.1
Subsystems (3)
I've just had an exception to my "uneventful kernel upgrade" monotony.
My boot scripts failed when setting up the firewall due to this :-
xt_recent: hitcount (1) is larger than packets to be remembered (1)
for table xxxx
This is a completely straightforward
iptables -A yyyy -j REJECT -p tcp --reject-with tcp-reset -m recent
--set --name xxxx --rsource
Looking at the history for xt_recent.c it looks like this was introduced in abc86d0f99242b7f142b7cb8f90e30081dd3c256 but maybe corrected in cef9ed86ed62eeffcd017882278bbece32001f86 ?
Whatever, 3.19.1 is still affected, it can be worked around by setting ip_pkt_list_tot in the module parameters.
Cheers
David
David R <[email protected]> wrote:
[ CC Pablo & stable@ ]
Quoted 7 lines
I've just had an exception to my "uneventful kernel upgrade" monotony.
My boot scripts failed when setting up the firewall due to this :-
xt_recent: hitcount (1) is larger than packets to be remembered (1)
for table xxxx
Quoted 8 lines
This is a completely straightforward
iptables -A yyyy -j REJECT -p tcp --reject-with tcp-reset -m recent--set --name xxxx --rsource
Looking at the history for
xt_recent.cit looks like this was introduced inabc86d0f99242b7f142b7cb8f90e30081dd3c256but maybe corrected incef9ed86ed62eeffcd017882278bbece32001f86?
Right. I would recommend to revert abc86d0f99242b7f142b7cb8f90e30081dd3c256 in 3.19.y series rather than applying cef9ed86ed62, though.
Sorry,
Florian
From: Florian Westphal <[email protected]>
Date: Sun, 8 Mar 2015 18:55:53 +0100
Quoted 16 lines
David R <[email protected]> wrote:
[ CC Pablo & stable@ ]
Quoted 12 lines
I've just had an exception to my "uneventful kernel upgrade" monotony.
My boot scripts failed when setting up the firewall due to this :-
xt_recent: hitcount (1) is larger than packets to be remembered (1)
for table xxxxThis is a completely straightforward
iptables -A yyyy -j REJECT -p tcp --reject-with tcp-reset -m recent--set --name xxxx --rsource
Quoted 6 lines
Quoted 3 lines
Looking at the history for
xt_recent.cit looks like this was introduced inabc86d0f99242b7f142b7cb8f90e30081dd3c256but maybe corrected incef9ed86ed62eeffcd017882278bbece32001f86?Right. I would recommend to revert
abc86d0f99242b7f142b7cb8f90e30081dd3c256in 3.19.y series rather than applyingcef9ed86ed62, though.
Greg, please queue up a revert of abc86d0f99242b7f142b7cb8f90e30081dd3c256 for 3.19.x -stable, if you haven't done so already.
Thanks.
Greg KH
maintainerQuoted 23 lines · David Miller
From: Florian Westphal <[email protected]>
Date: Sun, 8 Mar 2015 18:55:53 +0100Quoted 20 lines
David R <[email protected]> wrote:
[ CC Pablo & stable@ ]
Quoted 15 lines
I've just had an exception to my "uneventful kernel upgrade" monotony.
My boot scripts failed when setting up the firewall due to this :-
xt_recent: hitcount (1) is larger than packets to be remembered (1)
for table xxxxThis is a completely straightforward
iptables -A yyyy -j REJECT -p tcp --reject-with tcp-reset -m recent--set --name xxxx --rsource
Looking at the history for
xt_recent.cit looks like this was introduced inabc86d0f99242b7f142b7cb8f90e30081dd3c256but maybe corrected incef9ed86ed62eeffcd017882278bbece32001f86?
Quoted 5 lines
Quoted 2 lines
Right. I would recommend to revert
abc86d0f99242b7f142b7cb8f90e30081dd3c256in 3.19.y series rather than applyingcef9ed86ed62, though.Greg, please queue up a revert of
abc86d0f99242b7f142b7cb8f90e30081dd3c256for 3.19.x -stable, if you haven't done so already.
Now done, thanks.
greg k-h