Skip to contentSkip to conversation

STRING module : Invalid argument

DISCUSSION Gáspár Lajos 3 participants 4 messages Oct 4, 2006 – Oct 5, 2006

lore
Share & tools
lore

Gáspár Lajos

author
#0 lore raw

Hi,

Is there a bug in 2.6.18 kernel?
I am using it with iptables v1.2.11 and the following command gives me error:

fw1:~# iptables -A INPUT -j DROP -p tcp -m string --string "test"
iptables: Invalid argument
fw1:~# iptables -v -A INPUT -j DROP -p tcp -m string --string "test"
DROP  tcp opt -- in * out *  0.0.0.0/0  -> 0.0.0.0/0  STRING match "test"
iptables: Invalid argument
fw1:~# uname -a
Linux fw1 2.6.18.06.275.16 #1 SMP Mon Oct 2 16:29:40 CEST 2006 i686 GNU/Linux
fw1:~# iptables -V
iptables v1.2.11

Any comments?

#1 lore raw
Quoted 22 lines · G�sp�r Lajos

Hi,

Is there a bug in 2.6.18 kernel?
I am using it with iptables v1.2.11 and the following command gives me error:

fw1:~# iptables -A INPUT -j DROP -p tcp -m string --string "test"
iptables: Invalid argument
fw1:~# iptables -v -A INPUT -j DROP -p tcp -m string --string "test"
DROP  tcp opt -- in * out *  0.0.0.0/0  -> 0.0.0.0/0  STRING match "test"
iptables: Invalid argument
fw1:~# uname -a
Linux fw1 2.6.18.06.275.16 #1 SMP Mon Oct 2 16:29:40 CEST 2006 i686
GNU/Linux
Quoted 4 lines
fw1:~# iptables -V
iptables v1.2.11

Any comments?

Yeah.
- You probably don't have the string module installed and/or loaded.
- Kernel 2.6.18 is rather new (sep-2006) and iptables 1.2.11 is rather old (june 2004). Upgrade to a new iptables version: 1.3.6 is just released.

Grts,
Rob

author
#2 lore raw

Rob Sterenborg írta:

Quoted 9 lines · G�sp�r Lajos
Quoted 8 lines

Hi,

fw1:~# iptables -v -A INPUT -j DROP -p tcp -m string --string "test"
DROP  tcp opt -- in * out *  0.0.0.0/0  -> 0.0.0.0/0  STRING match "test"
iptables: Invalid argument

Does it means that it fails at insertation of the rule into the chain, doesn't?

Quoted 5 lines

- You probably don't have the string module installed and/or loaded.
- Kernel 2.6.18 is rather new (sep-2006) and iptables 1.2.11 is rather old (june 2004). Upgrade to a new iptables version: 1.3.6 is just released.

I have already tried it with the Debian backport of iptables (v1.3.x) ... Same results.

Right now I am recompiling the kernel and iptables + pom-ng. Hope it helps... :)

Quoted 8 lines

Grts,
Rob

#3 lore raw
Quoted 5 lines · Gáspár Lajos

Rob Sterenborg írta:

Quoted 4 lines · G�sp�r Lajos
Quoted 3 lines

Hi,

Quoted 8 lines
Quoted 6 lines
Quoted 6 lines
fw1:~# iptables -v -A INPUT -j DROP -p tcp -m string --string "test"
DROP  tcp opt -- in * out *  0.0.0.0/0  -> 0.0.0.0/0  STRING match
"test"
iptables: Invalid argument

Does it means that it fails at insertation of the rule into the chain, doesn't?

Yes

Quoted 8 lines
Quoted 6 lines

- You probably don't have the string module installed and/or loaded.
- Kernel 2.6.18 is rather new (sep-2006) and iptables 1.2.11 is rather old
(june 2004). Upgrade to a new iptables version: 1.3.6 is just released.

I have already tried it with the Debian backport of iptables (v1.3.x) ... Same results.

Debian backport of iptables? What do mean?

Quoted 2 lines

Right now I am recompiling the kernel and iptables + pom-ng. Hope it helps... :)

The string match was introduced in kernel 2.6.16 if my mind serves well, the old version that was available in pom-ng was broken. You also need a recent iptables version to make it work as Rob pointed out.

Signature · 2 lines
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris