Skip to contentSkip to conversation

Unable to add rule on Chain with 28 characters.

DISCUSSION Rafael Dreher 4 participants 10 messages Jul 8, 2005 – Jul 11, 2005 netfilter

lore
Share & tools
lore

Rafael Dreher

author
#0 lore raw

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with 28 characters.

The chain have bee added without any problem, but when I add the rule, iptables says that it's unable do find the chain.

If I reduce the chain to 25 characters, it works. I'm trying to migrate a set of rules form iptables-1.2.11 to 1.3.1, and I don't want to rewrite the rules.

Someone can help me?

My iptables version: 1.3.1
My kernel version: 2.4.31

POM-Patches:

CLASSIFY
SAME
comment
NETMAP
iprange
quota
time
IPMARK
ROUTE
account
h323-conntrack-nat
ipp2p
l7-filter-pom-1.4
mms-conntrack-nat
msnp-conntrack-nat
pptp-conntrack-nat
quake3-conntrack-nat
string
mport

Thanks in advance.

Signature · 5 lines
Rafael Dreher

-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify
#1 lore raw
Quoted 4 lines · Rafael Dreher

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with 28 characters.

my guess is you're leaving out the '-t nat' as custom chains only exist in the table they're created in:

  # iptables -t nat -N GqKOJUpUAOboDEbYcaVUCDqprFy
  # iptables -t nat -A GqKOJUpUAOboDEbYcaVUCDqprFy -j ACCEPT
  # iptables -t nat -A PREROUTING -j GqKOJUpUAOboDEbYcaVUCDqprFy
  # iptables -t nat -vnxL
  Chain GqKOJUpUAOboDEbYcaVUCDqprFy (1 references)
      pkts      bytes target     prot opt in     out     source
  destination
         1       78 ACCEPT     all  --  *      *       0.0.0.0/0
  0.0.0.0/0

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source
destination
1 78 GqKOJUpUAOboDEbYcaVUCDqprFy all -- * *
0.0.0.0/0 0.0.0.0/0

<--- snip --->

  # iptables -V && uname -r
  iptables v1.3.1
  2.6.11.4-21.7-default

i also tested this on:

  # iptables -V && uname -r
  iptables v1.2.11
  2.4.27-2-386

alas--i have no 2.4 + 1.3.1 combo i can test on; so i cannot say there isn't some weird interaction between those two that causes your issue to crop up.

-j

--
"Brian: Whose leg do I have to hump to get a dry martini around here?"
--Family Guy

author
#2 lore raw
Quoted 8 lines
Quoted 3 lines

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with 28 characters.

my guess is you're leaving out the '-t nat' as custom chains only exist in the table they're created in:

Hi, again.

I guess no. :)

[root@ward] [16:55:58]
[~]#iptables -t nat -N ecommerce-internet@POSTROUTING

[root@ward] [16:56:01]
[~]#iptables -t nat -A POSTROUTING -j ecommerce-internet@POSTROUTING
iptables: No chain/target/match by that name

[root@ward] [16:56:19]
[~]#

Am I crazy? :)

This chain has 30 characters... the max.. if I reduce it to 28, it's added wihtout any problem.

Thank's

Signature · 5 lines
Rafael Dreher

-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify
#3 lore raw
Quoted 6 lines · Rafael Dreher
Quoted 6 lines
Quoted 4 lines

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with 28 characters.

Quoted 7 lines
Quoted 3 lines

my guess is you're leaving out the '-t nat' as custom chains only exist in the table they're created in:

Hi, again.

I guess no. :)

provide more info next time and i won't have to guess. :-D

Quoted 7 lines

[root@ward] [16:55:58]
[~]#iptables -t nat -N ecommerce-internet@POSTROUTING

[root@ward] [16:56:01]
[~]#iptables -t nat -A POSTROUTING -j ecommerce-internet@POSTROUTING
iptables: No chain/target/match by that name

Quoted 7 lines

[root@ward] [16:56:19]
[~]#

Am I crazy? :)

This chain has 30 characters... the max.. if I reduce it to 28, it's added wihtout any problem.

(note: your OP said the error was with the 28 char chain)

it looks like 29 characters is the max:

30 char chain name:

  # iptables -t nat -N PubABFZhrRJgwChbszxazNssqWKWB
  # iptables -t nat -A PREROUTING -j PubABFZhrRJgwChbszxazNssqWKWB
  iptables: No chain/target/match by that name

29 char chain name:

  # iptables -t nat -N PubABFZhrRJgwChbszxazNssqWKW
  # iptables -t nat -A PREROUTING -j PubABFZhrRJgwChbszxazNssqWKW
  #

-j

--
"Peter: This party couldn't be better if Jesus was here.
Jesus: For my next miracle, I will turn water... into FUNK."
--Family Guy

#4 lore raw
Quoted 8 lines · Jason Opperisano

it looks like 29 characters is the max:

30 char chain name:

  # iptables -t nat -N PubABFZhrRJgwChbszxazNssqWKWB
  # iptables -t nat -A PREROUTING -j PubABFZhrRJgwChbszxazNssqWKWB
  iptables: No chain/target/match by that name
Quoted 5 lines

29 char chain name:

  # iptables -t nat -N PubABFZhrRJgwChbszxazNssqWKW
  # iptables -t nat -A PREROUTING -j PubABFZhrRJgwChbszxazNssqWKW
  #

stupid off-by-one math. subtract 1 from everything i said...

-j

--
"Peter: Hey, Brian. If cops are pigs, does that make you a Snausage?
Brian: Clever, Peter. Did you stay up all night writing that?
Peter: No, I got to bed around two, two-thirty."
--Family Guy

#5 lore raw
In reply to Jason Opperisano
Quoted 7 lines
Quoted 3 lines

This chain has 30 characters... the max.. if I reduce it to 28, it's added wihtout any problem.

(note: your OP said the error was with the 28 char chain)

it looks like 29 characters is the max:

It's documented:

--log-prefix prefix
Prefix log messages with the specified prefix; up to 29 letters long, and useful for distinguishing messages in the logs.

So I guess there's more places with the 30 limit (read: 1 for the '\0' char).

Jan Engelhardt

Signature · 1 line
| Alphagate Systems, http://alphagate.hopto.org/
#6 lore raw
In reply to Rafael Dreher

I have run into this problem as well. Learn to stick to 28 characters.

-r

Quoted 33 lines · Rafael Dreher
Quoted 6 lines
Quoted 3 lines

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with 28 characters.

my guess is you're leaving out the '-t nat' as custom chains only exist in the table they're created in:

Hi, again.

I guess no. :)

[root@ward] [16:55:58]
[~]#iptables -t nat -N ecommerce-internet@POSTROUTING

[root@ward] [16:56:01]
[~]#iptables -t nat -A POSTROUTING -j ecommerce-internet@POSTROUTING
iptables: No chain/target/match by that name

[root@ward] [16:56:19]
[~]#

Am I crazy? :)

This chain has 30 characters... the max.. if I reduce it to 28, it's added wihtout any problem.

Thank's

--
Rafael Dreher

-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify

author
#7 lore raw

So, that's a BUG.

Why iptbles let me add a chain with 30 characters, if I can't use this chain?

[root@ward] [10:07:54]
[~]#iptables -t nat -N 123456789012345678901234567890

[root@ward] [10:08:05]
[~]#iptables -t nat -A POSTROUTING -j 123456789012345678901234567890
iptables: No chain/target/match by that name

Hey, gurus, can anyone help me? :)

Thank's

Quoted 45 lines · Royce Kemp

I have run into this problem as well. Learn to stick to 28 characters.

-r

Quoted 35 lines · Rafael Dreher
Quoted 7 lines
Quoted 3 lines

Hi,

I'm trying do add a rule on a user-defined chain, on the NAT table, with 28 characters.

my guess is you're leaving out the '-t nat' as custom chains only exist in the table they're created in:

Hi, again.

I guess no. :)

[root@ward] [16:55:58]
[~]#iptables -t nat -N ecommerce-internet@POSTROUTING

[root@ward] [16:56:01]
[~]#iptables -t nat -A POSTROUTING -j ecommerce-internet@POSTROUTING
iptables: No chain/target/match by that name

[root@ward] [16:56:19]
[~]#

Am I crazy? :)

This chain has 30 characters... the max.. if I reduce it to 28, it's added wihtout any problem.

Thank's

Signature · 5 lines
Rafael Dreher

-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify
Signature · 7 lines
Rafael Dreher
-:: Interage Integradora ::-
-:: Pesquisa e Desenvolvimento ::-
-:: www.gatepro.com.br || www.interage.com.br ::-
-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify
#8 lore raw
Quoted 9 lines

So, that's a BUG.
Why iptbles let me add a chain with 30 characters, if I can't use this chain?

[root@ward] [10:07:54]
[~]#iptables -t nat -N 123456789012345678901234567890

[root@ward] [10:08:05]
[~]#iptables -t nat -A POSTROUTING -j 123456789012345678901234567890
iptables: No chain/target/match by that name

Try
iptables -t nat -N 123456789012345678901234567890
iptables -t nat -A POSTROUTING -j 1234567890123456789012345678

(Maybe add a '9' to the last.) If that's the case, then this is not really a bug, but some code silently truncates the -N request.

Jan Engelhardt

Signature · 1 line
| Alphagate Systems, http://alphagate.hopto.org/
author
#9 lore raw

No, that's not the case. I'm still thinking that's a bug.

[root@ward] [10:18:30]
[~]#iptables -t nat -N 123456789012345678901234567890

[root@ward] [10:18:38]
[~]#iptables -t nat -A POSTROUTING -j 1234567890123456789012345678
iptables v1.3.2: Couldn't load target `1234567890123456789012345678':/usr/local/lib/iptables/libipt_1234567890123456789012345678.so: cannot open shared object
file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

[root@ward] [10:18:41]
[~]#

Any idea?

Thank 's

Quoted 20 lines · Jan Engelhardt
Quoted 9 lines

So, that's a BUG.
Why iptbles let me add a chain with 30 characters, if I can't use this chain?

[root@ward] [10:07:54]
[~]#iptables -t nat -N 123456789012345678901234567890

[root@ward] [10:08:05]
[~]#iptables -t nat -A POSTROUTING -j 123456789012345678901234567890
iptables: No chain/target/match by that name

Try
iptables -t nat -N 123456789012345678901234567890
iptables -t nat -A POSTROUTING -j 1234567890123456789012345678

(Maybe add a '9' to the last.) If that's the case, then this is not really a bug, but some code silently truncates the -N request.

Jan Engelhardt

Signature · 5 lines
Rafael Dreher

-:: Red Hat Certified Engineer ::-
-:: Nr: 807303498507617 ::-
http://www.redhat.com/training/certification/verify