iptables: Unknown error 4294967295

DISCUSSION Lindsay Haisley 4 participants 5 messages Sep 26, 2006 – Oct 31, 2006

lore

Share & tools

lore

Lindsay Haisley

author

2006-09-26 00:03 UTC #0 lore raw

When I execute the following:

iptables -t nat -I PREROUTING -s 10.8.0.1 -i tap0 -j SNAT --to-source 216.110.12.105

... I'm getting the error:

iptables: Unknown error 4294967295

(4294967295 = an unsigned representation of a signed long int of -1)

Running this under strace shows the following:

mmap2(NULL, 7648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0xb7fbb000
mmap2(0xb7fbc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fbc000
close(3) = 0
socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\1\0\0\0\335g\21\300\0\0\0\0\224\313F\300\1\0\0\0"..., [84]) = 0 getsockopt(3, SOL_IP, 0x41 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., [656]) = 0 setsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 876) = -1 EINVAL (Invalid argument) write(2, "iptables: Unknown error 42949672"..., 35iptables: Unknown error 4294967295
) = 35
exit_group(1) = ?
Process 10231 detached

Apprently the error is originating in a malformed socket option call. What's
happening here, and how can I fix it? I'm running kernel 2.6.17-gentoo-r4,
iptables v1.3.5.

I have about every possible kernel netfilter capability compiled as a module, or built into the kernel.

Signature · 5 lines

Lindsay Haisley       | "Fighting against human |     PGP public key
FMP Computer Services |    creativity is like   |      available at
512-259-1190          |    trying to eradicate  | <http://pubkeys.fmp.com>
http://www.fmp.com    |        dandelions"      |
                      |      (Pamela Jones)     |

Daniel De Graaf

2006-09-26 00:37 UTC #1 lore raw

Quoted 33 lines · Lindsay Haisley

When I execute the following:
iptables -t nat -I PREROUTING -s 10.8.0.1 -i tap0 -j SNAT --to-source 216.110.12.105
... I'm getting the error:
iptables: Unknown error 4294967295
(4294967295 = an unsigned representation of a signed long int of -1)
Running this under strace shows the following:
mmap2(NULL, 7648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0xb7fbb000
mmap2(0xb7fbc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fbc000
close(3) = 0
socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\1\0\0\0\335g\21\300\0\0\0\0\224\313F\300\1\0\0\0"..., [84]) = 0 getsockopt(3, SOL_IP, 0x41 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., [656]) = 0 setsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 876) = -1 EINVAL (Invalid argument) write(2, "iptables: Unknown error 42949672"..., 35iptables: Unknown error 4294967295
) = 35
exit_group(1) = ?
Process 10231 detached
Apprently the error is originating in a malformed socket option call. What's
happening here, and how can I fix it? I'm running kernel 2.6.17-gentoo-r4,
iptables v1.3.5.
I have about every possible kernel netfilter capability compiled as a module, or built into the kernel.

Quoted 8 lines

Lindsay Haisley       | "Fighting against human |     PGP public key
FMP Computer Services |    creativity is like   |      available at
512-259-1190          |    trying to eradicate  | <http://pubkeys.fmp.com>
http://www.fmp.com    |        dandelions"      |
                      |      (Pamela Jones)     |

The (unsigned)(-1) is a known bug (#460 in bugzilla), fixed in subversion versions of iptables.
However, it is only an invalid reporting of the error; the fixed version would output "iptables: Invalid Argument".

The error is because SNAT must be in POSTROUTING, not PREROUTING.

- Daniel De Graaf

Lindsay Haisley

author

2006-09-26 00:55 UTC #2 lore raw

Thus spake Daniel De Graaf on Mon, Sep 25, 2006 at 07:37:13PM CDT

Quoted 6 lines

The (unsigned)(-1) is a known bug (#460 in bugzilla), fixed in subversion versions of iptables.
However, it is only an invalid reporting of the error; the fixed version would output "iptables: Invalid Argument".
The error is because SNAT must be in POSTROUTING, not PREROUTING.

Thanks. I had just discovered this. I'm trying to wrangle a VPN into shape and feeling my way. Sorry for the noise!

Signature · 5 lines

Lindsay Haisley       | "Fighting against human |     PGP public key
FMP Computer Services |    creativity is like   |      available at
512-259-1190          |    trying to eradicate  | <http://pubkeys.fmp.com>
http://www.fmp.com    |        dandelions"      |
                      |      (Pamela Jones)     |

Yasuyuki KOZAKAI

2006-09-26 00:41 UTC #3 lore raw

In reply to Lindsay Haisley

Hello,

From: Lindsay Haisley <[email protected]>
Date: Mon, 25 Sep 2006 19:03:01 -0500

Quoted 26 lines

When I execute the following:
iptables -t nat -I PREROUTING -s 10.8.0.1 -i tap0 -j SNAT --to-source 216.110.12.105
... I'm getting the error:
iptables: Unknown error 4294967295
(4294967295 = an unsigned representation of a signed long int of -1)
Running this under strace shows the following:
mmap2(NULL, 7648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) =
0xb7fbb000
mmap2(0xb7fbc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fbc000
close(3) = 0
socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\1\0\0\0\335g\21\300\0\0\0\0\224\313F\300\1\0\0\0"..., [84]) = 0 getsockopt(3, SOL_IP, 0x41 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., [656]) = 0 setsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 876) = -1 EINVAL (Invalid argument) write(2, "iptables: Unknown error 42949672"..., 35iptables: Unknown error 4294967295
) = 35
exit_group(1) = ?
Process 10231 detached

Quoted 6 lines

Apprently the error is originating in a malformed socket option call. What's
happening here, and how can I fix it? I'm running kernel 2.6.17-gentoo-r4,
iptables v1.3.5.
I have about every possible kernel netfilter capability compiled as a module, or built into the kernel.

Is your iptables 32bit binary and do you run it on 64bit kernel ? And did syslog output anything ?

-- Yasuyuki Kozakai

Alan Ezust

2006-10-31 22:38 UTC #4 lore raw

I was getting this too, and my problem was related to the fact that my kernel was configued with CONFIG_NETFILTER_NETLINK=m. I changed that to a "y" and my UNKNOWN ERROR went away. And yes, I was loading the module at the right time in my /etc/modules, but that didn't seem to make a difference to netfilter.

Quoted 47 lines · Yasuyuki KOZAKAI

Hello,
From: Lindsay Haisley <[email protected]>
Date: Mon, 25 Sep 2006 19:03:01 -0500
Quoted 31 lines
When I execute the following:
iptables -t nat -I PREROUTING -s 10.8.0.1 -i tap0 -j SNAT --to-source 216.110.12.105
... I'm getting the error:
iptables: Unknown error 4294967295
(4294967295 = an unsigned representation of a signed long int of -1)
Running this under strace shows the following:
mmap2(NULL, 7648, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0xb7fbb000
mmap2(0xb7fbc000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0) = 0xb7fbc000 close(3)
                      = 0
socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\1\0\0\0\335g\21\300\0\0\0\0\224\313F\300\1\0\0\0"..., [84]) = 0 getsockopt(3, SOL_IP, 0x41 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., [656]) = 0 setsockopt(3, SOL_IP, 0x40 /* IP_??? */, "nat\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 876) = -1 EINVAL (Invalid argument) write(2, "iptables: Unknown error 42949672"..., 35iptables: Unknown error 4294967295 ) = 35
exit_group(1) = ?
Process 10231 detached
Quoted 6 lines
Apprently the error is originating in a malformed socket option call.
What's happening here, and how can I fix it? I'm running kernel
2.6.17-gentoo-r4, iptables v1.3.5.
I have about every possible kernel netfilter capability compiled as a module, or built into the kernel.
Is your iptables 32bit binary and do you run it on 64bit kernel ? And did syslog output anything ?
-- Yasuyuki Kozakai

Signature · 3 lines

Alan Ezust            www.presinet.com
Presinet, inc         [email protected]
           Victoria, BC,Canada