2.6.33.2-rt13 and iptables

BUG FC 2 participants 3 messages Apr 25, 2010 – Apr 27, 2010

Subsystems (2)

Networking netfilter

lore

Share & tools

lore

FC

author

2010-04-25 18:00 UTC #0 lore raw

- Updated Debian SID x86 32 bit
- kernel 2.6.33.2-rt13
- iptables v1.4.6

I've experimented some problems while displaying processed packets by iptables ( iptables -L -n -v ). The output displays a large number of processed packets with a very low network activity in my LAN ( max 1 hundred of packets delivered )

A sample output obtained after loading iptables rules and quite immediately running iptables -L -n -v

Chain bad_packets (1 references)
pkts bytes target prot opt in out source destination
8600M 15024815T LOG all -- * * 0.0.0.0/0 0.0.0.0/0
state INVALID LOG flags 0 level 4 prefix `fp=bad_packets:1 a=DROP '
15024815T 15066474T DROP all -- * * 0.0.0.0/0 0.0.0.0/0 state INVALID
13777492T 15024815T bad_tcp_packets tcp -- * * 0.0.0.0/0

       0.0.0.0/0

1337099T 7793M RETURN all -- * * 0.0.0.0/0 0.0.0.0/0

Chain bad_tcp_packets (1 references)

 pkts bytes target     prot opt in     out     source destination
4295M     0 LOG        tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 tcp flags:!0x17/0x02 state NEW LOG flags 0 level 4 prefix `fp=bad_tcp_packets:1 a=DROP '
41659T 288230T DROP       tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
    tcp flags:!0x17/0x02 state NEW
41659T 257832T LOG        tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
    tcp flags:0x3F/0x00 LOG flags 0 level 4 prefix 
`fp=bad_tcp_packets:2 a=DROP '
41659T 144115T DROP       tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
    tcp flags:0x3F/0x00
41659T 352428T LOG        tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
    tcp flags:0x3F/0x3F LOG flags 0 level 4 prefix 
`fp=bad_tcp_packets:3 a=DROP '
72059T 13835076T DROP       tcp  --  *      *       0.0.0.0/0  0.0.0.0/0 
          tcp flags:0x3F/0x3F
72059T 15024832T LOG        tcp  --  *      *       0.0.0.0/0  0.0.0.0/0 
          tcp flags:0x3F/0x29 LOG flags 0 level 4 prefix 
`fp=bad_tcp_packets:4 a=DROP '
113717T 72074T DROP       tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
    tcp flags:0x3F/0x29
72059T  155G LOG        tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:5 a=DROP '
3498M     0 DROP       tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 tcp flags:0x3F/0x37
    0   15T LOG        tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
tcp flags:0x06/0x06 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:6 a=DROP '
72059T 4305M DROP       tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 tcp flags:0x06/0x06
15024815T 8600M LOG        tcp  --  *      *       0.0.0.0/0 0.0.0.0/0 
       tcp flags:0x03/0x03 LOG flags 0 level 4 prefix

`fp=bad_tcp_packets:7 a=DROP '
15024815T 15024815T DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp flags:0x03/0x03
15066474T 15782 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0

The problem doesn't occur with other kernels ( vanilla 2.6.33.2 , 2.6.33-zen1 ) and the number of processed packets is displayed correctly.

Thomas Gleixner

2010-04-27 08:13 UTC #1 lore raw

Quoted 11 lines · FC

- Updated Debian SID x86 32 bit
- kernel 2.6.33.2-rt13
- iptables v1.4.6
I've experimented some problems while displaying processed packets by iptables ( iptables -L -n -v ). The output displays a large number of processed packets with a very low network activity in my LAN ( max 1 hundred of packets delivered )
A sample output obtained after loading iptables rules and quite immediately running iptables -L -n -v

Can you please test the patch below on top of -rt ?

Thanks,

tglx

---------->
Subject: net-fix-iptables-fallout.patch
From: Thomas Gleixner <[email protected]>
Date: Tue, 27 Apr 2010 10:05:28 +0200

Signed-off-by Thomas Gleixner <[email protected]>

---
 net/ipv4/netfilter/ip_tables.c  |    9 +++++----
 net/ipv6/netfilter/ip6_tables.c |   10 +++++-----
 2 files changed, 10 insertions(+), 9 deletions(-)

net/ipv4/netfilter/ip_tables.c +5 -4

Index: linux-2.6-tip/net/ipv4/netfilter/ip_tables.c
===================================================================
@@ -907,7 +907,7 @@ get_counters(const struct xt_table_info 
 {
 	unsigned int cpu;
 	unsigned int i;
-	unsigned int curcpu = NR_CPUS;
+	unsigned int curcpu;
 
 	/* Instead of clearing (by a previous call to memset())
 	 * the counters and using adds, we set the counters

@@ -917,16 +917,17 @@ get_counters(const struct xt_table_info 
 	 * if new softirq were to run and call ipt_do_table
 	 */
 	local_bh_disable();
-#ifndef CONFIG_PREEMPT_RT
-	curcpu = smp_processor_id();
+	curcpu = raw_smp_processor_id();
 
 	i = 0;
+	xt_info_wrlock(curcpu);
 	IPT_ENTRY_ITERATE(t->entries[curcpu],
 			  t->size,
 			  set_entry_to_counter,
 			  counters,
 			  &i);
-#endif
+	xt_info_wrunlock(curcpu);
+
 	for_each_possible_cpu(cpu) {
 		if (cpu == curcpu)
 			continue;

net/ipv6/netfilter/ip6_tables.c +1 -1

Index: linux-2.6-tip/net/ipv6/netfilter/ip6_tables.c
===================================================================
@@ -939,7 +939,7 @@ get_counters(const struct xt_table_info 
 {
 	unsigned int cpu;
 	unsigned int i;
-	unsigned int curcpu = NR_CPUS;
+	unsigned int curcpu;
 
 	/* Instead of clearing (by a previous call to memset())
 	 * the counters and using adds, we set the counters

@@ -949,17 +949,17 @@ get_counters(const struct xt_table_info 
 	 * if new softirq were to run and call ipt_do_table
 	 */
 	local_bh_disable();

FC

author

2010-04-27 17:03 UTC #2 lore raw

Quoted 11 lines · Thomas Gleixner

Quoted 9 lines · FC
- Updated Debian SID x86 32 bit
- kernel 2.6.33.2-rt13
- iptables v1.4.6
I've experimented some problems while displaying processed packets by iptables ( iptables -L -n -v ). The output displays a large number of processed packets with a very low network activity in my LAN ( max 1 hundred of packets delivered )

Quoted 9 lines

Quoted 2 lines
A sample output obtained after loading iptables rules and quite immediately running iptables -L -n -v
Can you please test the patch below on top of -rt ?
Thanks,
tglx

The problem doesn't occur with kernel 2.6.33.3-rt14 which includes your patch.

The same sample output displayed under the same conditions ( loading rules , typing iptables -L -n -v )

Chain bad_packets (1 references)
pkts bytes target prot opt in out source
destination

    0     0 LOG        all  --  *      *       0.0.0.0/0 
0.0.0.0/0           state INVALID LOG flags 0 level 4 prefix `fp=bad_packets:1 a=DROP '
    0     0 DROP       all  --  *      *       0.0.0.0/0

0.0.0.0/0 state INVALID
316 21488 bad_tcp_packets tcp -- * * 0.0.0.0/0
0.0.0.0/0
317 21635 RETURN all -- * * 0.0.0.0/0
0.0.0.0/0

Chain bad_tcp_packets (1 references)
pkts bytes target prot opt in out source
destination

    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:!0x17/0x02 state NEW LOG flags 0 level 4 prefix `fp=bad_tcp_packets:1 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:!0x17/0x02 state NEW
    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x00 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:2 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x00
    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x3F LOG flags 0 level 4 prefix `fp=bad_tcp_packets:3 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x3F
    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x29 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:4 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x29
    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x37 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:5 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x3F/0x37
    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x06/0x06 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:6 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x06/0x06
    0     0 LOG        tcp  --  *      *       0.0.0.0/0 
0.0.0.0/0           tcp flags:0x03/0x03 LOG flags 0 level 4 prefix `fp=bad_tcp_packets:7 a=DROP '
    0     0 DROP       tcp  --  *      *       0.0.0.0/0

0.0.0.0/0 tcp flags:0x03/0x03
316 21488 RETURN tcp -- * * 0.0.0.0/0
0.0.0.0/0