Skip to contentSkip to conversation

Release of iptables 1.3.8

ANNOUNCE Pablo Neira Ayuso 4 participants 8 messages Jun 25, 2007 – Jun 28, 2007 2 messages not in the archive netfilter

lore
Share & tools
lore

Pablo Neira Ayuso

author maintainer
#0 lore raw

Hi!

The netfilter coreteam proudly presents:

iptables version 1.3.8

This release contains lots of accumulated bugfixes, manpage updates, and support for IPv6-MH, TCPMSS and port randomization for NAT. The ChangeLog is attached to this mail. Upgrade is recommended.

Version 1.3.8 can be obtained from:

http://www.netfilter.org/projects/iptables/downloads.html
ftp://ftp.netfilter.org/pub/iptables/

Happy firewall,
Pablo (on behalf of the Netfilter Core Team)

Signature · 3 lines
"Países en desarrollo es el nombre con que los expertos designan a los
países arrollados por el desarrollo ajeno" -- Patas Arriba. La Escuela
del Mundo al Revés -- E. Galeano

- Fix build error of conntrack match
[Yasuyuki Kozakai]

- Remove whitespace in ip6tables.c
[Yasuyuki Kozakai]

- -p all' and -p 0' should be allowed in ip6tables [Yasuyuki Kozakai]

- hashlimit doc update
[Jan Engelhardt]

- add --random option to DNAT and REDIRECT
[Patrick McHardy]

- Makefile uses POSIX conform directory check
[Roy Marples]

- Fix missing newlines in iptables-save/restore output [Pavol Rusnak]

- Update quota manpage for SMP
[Phil Oester]

- Output for unspecified proto is all' instead of 0' [Phil Oester]

- Fix iptables-save with --random option
[Patrick McHardy]

- Remove unnecessary IP_NAT_RANGE_PROTO_RANDOM ifdefs [Patrick McHardy]

- Remove libnsl from LDLIBS
[Patrick McHardy]

- Fix problem with iptables-restore and quotes
[Pablo Neira Ayuso]

- Remove unnecessary includes
[Patrick McHardy]

- Fix --modprobe parameter
[Maurice van der Pot]

- ip6tables-restore should output error of modprobe after failed to load [Yasuyuki Kozakai]

- Add random option to SNAT
[Eric Leblond]

- Fix missing space in error message
[Patrick McHardy]

- Fixes for manpages of tcp, udp, and icmp{,6}
[Yasuyuki Kozakai]

- Add ip6tables mh extension
[Masahide Nakamura]

- Fix tcpmss manpage
[Patrick McHardy]

- Add ip6tables TCPMSS extension
[Arnaud Ebalard]

- Add UDPLITE multiport support
[Patrick McHardy]

- Fix missing space in ruleset listing
[Patrick McHardy]

- Remove extensions for unmaintained/obsolete patchlets [Patrick McHardy]

- Fix greedy debug grep
[Patrick McHardy]

- Fix type in manpage
[Thomas Aktaia]

- Fix compile/install error for iptables-xml with DO_MULTI=1 [Lutz Jaenicke]

#1 lore raw

http://bugs.gentoo.org/show_bug.cgi?id=166201

bug quote>

Quoted 11 lines

I got this error after upgrading to sys-kernel/gentoo-sources-2.6.20(with net-firewall/iptables-1.3.7).

# iptables --table mangle --append OUTPUT --jump MARK --set-mark 2
iptables: Invalid argument

dmesg says:
ip_tables: MARK target: invalid size 16 != 24

similar error occurs when using CONNMARK target, mark match and connmark match.

Quoted 7 lines

I found an entry on the netfilter mailing list saying:
The latest -git kernel includes compatibility functions for 32 bit userspace. You need to compile your iptables without the KERNEL_64_USERSPACE_32 thing though (edit main Makefile).

I did so and removed -DKERNEL_64_USERSPACE_32 from the Makefile and it worked.

Any comments from netfilter team on this?

Thank you,
-david

#2 lore raw
Quoted 22 lines · David Ford

http://bugs.gentoo.org/show_bug.cgi?id=166201

bug quote>

Quoted 17 lines

I got this error after upgrading to sys-kernel/gentoo-sources-2.6.20(with net-firewall/iptables-1.3.7).

# iptables --table mangle --append OUTPUT --jump MARK --set-mark 2
iptables: Invalid argument

dmesg says:
ip_tables: MARK target: invalid size 16 != 24

similar error occurs when using CONNMARK target, mark match and connmark match.

I found an entry on the netfilter mailing list saying:
The latest -git kernel includes compatibility functions for 32 bit userspace. You need to compile your iptables without the KERNEL_64_USERSPACE_32 thing though (edit main Makefile).

Quoted 4 lines
Quoted 1 line

I did so and removed -DKERNEL_64_USERSPACE_32 from the Makefile and it worked.

Any comments from netfilter team on this?

Indeed, thanks for the reminder. The KERNEL_64_USERSPACE_32 stuff needs to go.

Patches for that are welcome.

#3 lore raw

From: Patrick McHardy <[email protected]>
Date: Tue, 26 Jun 2007 11:21:58 +0200

Quoted 10 lines
Quoted 4 lines
Quoted 1 line

I did so and removed -DKERNEL_64_USERSPACE_32 from the Makefile and it worked.

Any comments from netfilter team on this?

Indeed, thanks for the reminder. The KERNEL_64_USERSPACE_32 stuff needs to go.

Patches for that are welcome.

How state on this is ? If anyone doesn't do it until I come from dinner, I'll take it. It conflicts some of xtasble patches I've updated.

-- Yasuyuki Kozakai

A message that is not in the archive (sent off-list or not yet received): [email protected]

#5 lore raw
Quoted 10 lines · Yasuyuki KOZAKAI

From: Patrick McHardy <[email protected]>
Date: Tue, 26 Jun 2007 11:21:58 +0200

Quoted 5 lines

Indeed, thanks for the reminder. The KERNEL_64_USERSPACE_32 stuff needs to go.

Patches for that are welcome.

How state on this is ? If anyone doesn't do it until I come from dinner, I'll take it. It conflicts some of xtasble patches I've updated.

I don't think anyone is working on it so far.

#6 lore raw

From: Patrick McHardy <[email protected]>
Date: Thu, 28 Jun 2007 13:52:55 +0200

Quoted 6 lines
Quoted 5 lines · Yasuyuki KOZAKAI

From: Patrick McHardy <[email protected]>
Date: Tue, 26 Jun 2007 11:21:58 +0200

Quoted 3 lines

Indeed, thanks for the reminder. The KERNEL_64_USERSPACE_32 stuff needs to go.

Quoted 7 lines
Quoted 5 lines
Quoted 2 lines

Patches for that are welcome.

How state on this is ? If anyone doesn't do it until I come from dinner, I'll take it. It conflicts some of xtasble patches I've updated.

I don't think anyone is working on it so far.

Done to commit. But I didn't kill KERNEL_64_USERSPACE_32 from Makefile, SAME, and CLUSTERIP. They doesn't have compat layer in kernel in the current.

-- Yasuyuki Kozakai

A message that is not in the archive (sent off-list or not yet received): [email protected]

#8 lore raw
Quoted 18 lines · Yasuyuki KOZAKAI

From: Patrick McHardy <[email protected]>
Date: Thu, 28 Jun 2007 13:52:55 +0200

Quoted 14 lines
Quoted 12 lines · Yasuyuki KOZAKAI

From: Patrick McHardy <[email protected]>
Date: Tue, 26 Jun 2007 11:21:58 +0200

Quoted 6 lines

Indeed, thanks for the reminder. The KERNEL_64_USERSPACE_32 stuff needs to go.

Patches for that are welcome.

How state on this is ? If anyone doesn't do it until I come from dinner, I'll take it. It conflicts some of xtasble patches I've updated.

Quoted 7 lines
Quoted 2 lines

I don't think anyone is working on it so far.

Done to commit. But I didn't kill KERNEL_64_USERSPACE_32 from Makefile, SAME, and CLUSTERIP. They doesn't have compat layer in kernel in the current.

Thanks. I can fix CLUSTERIP. SANE is not too important since its deprecated and unfixable broken wrt. 64 bit cleanness. At some point we should remove it, I'll add it to feature-removal-schedule.

#9 lore raw
Quoted 12 lines · Patrick McHardy
Quoted 5 lines

Done to commit. But I didn't kill KERNEL_64_USERSPACE_32 from Makefile, SAME, and CLUSTERIP. They doesn't have compat layer in kernel in the current.

Thanks. I can fix CLUSTERIP. SANE is not too important since its deprecated and unfixable broken wrt. 64 bit cleanness. At some point we should remove it, I'll add it to feature-removal-schedule.

BTW, I would suggest to remove it entirely, it just doesn't work properly. Most people won't use it anyways because I guess no sane distributor compiles 32 bit packages on a 64 bit kernel exactly because this kind of crap. For people that actually use it it will break once we add proper support to the kernel.

I'll fix CLUSTERIP now ..