Release of iptables 1.4.0rc1

ANNOUNCE Pablo Neira Ayuso 5 participants 8 messages Oct 15, 2007 – Oct 17, 2007

Subsystems (2)

Kbuild netfilter

lore

Share & tools

lore

Pablo Neira Ayuso

author maintainer

2007-10-15 16:50 UTC #0 lore raw

Hi!

The netfilter coreteam proudly presents:

iptables version 1.4.0rc1

This is the first release candidate of the new iptables branch 1.4. This release candidate adds support for the generic xtables infrastructure that strongly improves IPv6 support. Also several accumulated bugfixed are included. Test it!

Version 1.4.0rc1 can be obtained from:

http://www.netfilter.org/projects/iptables/downloads.html
ftp://ftp.netfilter.org/pub/iptables/

On behalf of the Netfilter Core Team.
Happy testing!

Signature · 1 line

"Los honestos son inadaptados sociales" -- Les Luthiers

iptables v1.4.0rc1 Changelog
======================================================================
Changes from 1.3.8:

- Add support for generic xtables infrastructure (improved IPv6 support!) [ Yasuyuki Kozakai ]

- Deletes empty ->final_check() functions
[ Jan Engelhardt ]

- Fix sparse warnings: non-C99 array declaration, incorrect function prototypes [ Patrick McHardy ]

- Remove last vestiges of NFC
[ Peter Riley ]

- Make @msg argument a const char *, just like printf [ Jan Engelhardt ]

- Makes it possible to omit extra_opts of matches/targets if unnecessary [ Jan Engelhardt ]

- Fix "iptables getsockopt failed strangely" when querying revisions for non-existant matches and targets [ Patrick McHardy]

- Introduces DEST_IPT_LIBDIR in Makefile
[ Yasuyuki Kozakai ]

- Change default KERNEL_DIR location and add KBUILD_OUTPUT [ Sven Wegener ]

- Removes obsolete KERNEL_64_USERSPACE_32 definitions [ Yasuyuki Kozakai ]

- Fix unused function warning
[ Patrick McHardy ]

Petr Pisar

2007-10-15 19:18 UTC #1 lore raw

Quoted 5 lines · Pablo Neira Ayuso

The netfilter coreteam proudly presents:
iptables version 1.4.0rc1

Great to hear it. But it doesn't build ip6tables-{save,restore} as older versions either. The problem is that these two makefile targets are in *_EXP veriable.

It is bug or a feature?

PS: http://bugzilla.netfilter.org/ doesn't work.

-- Petr

Robby Workman

2007-10-15 21:35 UTC #2 lore raw

Quoted 10 lines · Petr Pisar

Quoted 4 lines · Pablo Neira Ayuso
The netfilter coreteam proudly presents:
iptables version 1.4.0rc1
Great to hear it. But it doesn't build ip6tables-{save,restore} as older versions either. The problem is that these two makefile targets are in *_EXP veriable.
It is bug or a feature?

If I remember correctly (and I may not), the iptables-{save,restore} were marked as experimental earlier, then at some point they were not. As of 1.3.8, iptables-{save,restore} are not experimental, while ip6tables-{save,restore} are. I would expect that they will have the same fate sooner or later. In the meantime, if you want them, just use make experimental and make install-experimental to get them...

-RW

Signature · 1 line

http://rlworkman.net

Patrick McHardy

2007-10-16 08:44 UTC #3 lore raw

In reply to Petr Pisar

Please CC netfilter-devel on bugreports.

Quoted 10 lines · Petr Pisar

Quoted 4 lines · Pablo Neira Ayuso
The netfilter coreteam proudly presents:
iptables version 1.4.0rc1
Great to hear it. But it doesn't build ip6tables-{save,restore} as older versions either. The problem is that these two makefile targets are in *_EXP veriable.
It is bug or a feature?

I would say its a bug. I've added this patch, please test if it works for you.

ip6tables-restore.c +5 -1

Index: ip6tables-restore.c
===================================================================
@@ -77,7 +77,11 @@
 
 static int parse_counters(char *string, struct ip6t_counters *ctr)
 {
-	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)&ctr->pcnt, (unsigned long long *)&ctr->bcnt) == 2);
+	u_int64_t *pcnt, *bcnt;
+
+	pcnt = &ctr->pcnt;
+	bcnt = &ctr->bcnt;
+	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)pcnt, (unsigned long long *)bcnt) == 2);
 }
 
 /* global new argv and argc */

Makefile +2 -2

Index: Makefile
===================================================================
@@ -61,8 +61,8 @@
 ifeq ($(DO_IPV6), 1)
 EXTRAS+=ip6tables ip6tables.o ip6tables.8
 EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables $(DESTDIR)$(MANDIR)/man8/ip6tables.8
-EXTRAS_EXP+=ip6tables-save ip6tables-restore
-EXTRA_INSTALLS_EXP+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore # $(DESTDIR)$(MANDIR)/man8/iptables-restore.8 $(DESTDIR)$(MANDIR)/man8/iptables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
+EXTRAS+=ip6tables-save ip6tables-restore
+EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore # $(DESTDIR)$(MANDIR)/man8/iptables-restore.8 $(DESTDIR)$(MANDIR)/man8/iptables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
 endif
 
 ifndef IPT_LIBDIR

Petr Pisar

2007-10-16 14:30 UTC #4 lore raw

Quoted 6 lines · Patrick McHardy

Quoted 5 lines · Petr Pisar
Quoted 4 lines · Pablo Neira Ayuso
The netfilter coreteam proudly presents:
iptables version 1.4.0rc1

Quoted 9 lines

Quoted 5 lines
Great to hear it. But it doesn't build ip6tables-{save,restore} as older versions either. The problem is that these two makefile targets are in *_EXP veriable.
It is bug or a feature?
I would say its a bug. I've added this patch, please test if it works for you.

Yes, it works.

Probably you forgot on manual pages:

Makefile renamed from Makefile.old +1 -1

@@ -62,7 +62,7 @@
 EXTRAS+=ip6tables ip6tables.o ip6tables.8
 EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables $(DESTDIR)$(MANDIR)/man8/ip6tables.8
 EXTRAS+=ip6tables-save ip6tables-restore
-EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore # $(DESTDIR)$(MANDIR)/man8/iptables-restore.8 $(DESTDIR)$(MANDIR)/man8/iptables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
+EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
 endif
 
 ifndef IPT_LIBDIR

Patrick McHardy

2007-10-17 08:48 UTC #5 lore raw

Makefile line 66

Quoted 11 lines · Petr Pisar

Probably you forgot on manual pages:

Makefile renamed from Makefile.old +1 -1

@@ -62,7 +62,7 @@
 EXTRAS+=ip6tables ip6tables.o ip6tables.8
 EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables $(DESTDIR)$(MANDIR)/man8/ip6tables.8
 EXTRAS+=ip6tables-save ip6tables-restore
-EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore # $(DESTDIR)$(MANDIR)/man8/iptables-restore.8 $(DESTDIR)$(MANDIR)/man8/iptables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
+EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
 endif

Fixed, thanks.

Jan Engelhardt

2007-10-16 15:01 UTC #6 lore raw

In reply to Patrick McHardy

Quoted 24 lines · Patrick McHardy

Please CC netfilter-devel on bugreports.
Quoted 10 lines · Petr Pisar
Quoted 4 lines · Pablo Neira Ayuso
The netfilter coreteam proudly presents:
iptables version 1.4.0rc1
Great to hear it. But it doesn't build ip6tables-{save,restore} as older versions either. The problem is that these two makefile targets are in *_EXP veriable.
It is bug or a feature?
I would say its a bug. I've added this patch, please test if it works for you.
Index: ip6tables-restore.c
===================================================================

ip6tables-restore.c line 85

Quoted 10 lines

ip6tables-restore.c +5 -1

@@ -77,7 +77,11 @@
 
 static int parse_counters(char *string, struct ip6t_counters *ctr)
 {
-	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)&ctr->pcnt, (unsigned long long *)&ctr->bcnt) == 2);
+	u_int64_t *pcnt, *bcnt;
+
+	pcnt = &ctr->pcnt;
+	bcnt = &ctr->bcnt;
+	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)pcnt, (unsigned long long *)bcnt) == 2);
 }

This is also wrong (even though it may work in practice), since unsigned long long does not necessarily need to be 64 bit (it may be larger, and if so, you'll smash the stack).
What you want is:

static int parse_counters(const char *string, struct ip6t_counter *ctr)

{
	unsigned long long pcnt, bcnt;
	int ret;

	ret = sscanf(string, "[%llu:%llu]", &pcnt, &bcnt);
	ctr->pcnt = pcnt;
	ctr->bcnt = bcnt;
	return ret;
}

Quoted 18 lines

ip6tables-restore.c +0 -0

 /* global new argv and argc */

Index: Makefile
===================================================================

Makefile +0 -0

@@ -61,8 +61,8 @@
 ifeq ($(DO_IPV6), 1)

EXTRAS+=ip6tables ip6tables.o ip6tables.8 EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables $(DESTDIR)$(MANDIR)/man8/ip6tables.8

Makefile +2 -2

-EXTRAS_EXP+=ip6tables-save ip6tables-restore
-EXTRA_INSTALLS_EXP+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore # $(DESTDIR)$(MANDIR)/man8/iptables-restore.8 $(DESTDIR)$(MANDIR)/man8/iptables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8
+EXTRAS+=ip6tables-save ip6tables-restore
+EXTRA_INSTALLS+=$(DESTDIR)$(BINDIR)/ip6tables-save $(DESTDIR)$(BINDIR)/ip6tables-restore # $(DESTDIR)$(MANDIR)/man8/iptables-restore.8 $(DESTDIR)$(MANDIR)/man8/iptables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-save.8 $(DESTDIR)$(MANDIR)/man8/ip6tables-restore.8

endif

ifndef IPT_LIBDIR

Patrick McHardy

2007-10-17 08:38 UTC #7 lore raw

Quoted 16 lines · Jan Engelhardt

Quoted 10 lines · Patrick McHardy
static int parse_counters(char *string, struct ip6t_counters *ctr) {
ip6tables-restore.c +5 -1
-	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)&ctr->pcnt, (unsigned long long *)&ctr->bcnt) == 2);
+	u_int64_t *pcnt, *bcnt;
+
+	pcnt = &ctr->pcnt;
+	bcnt = &ctr->bcnt;
+	return (sscanf(string, "[%llu:%llu]", (unsigned long long *)pcnt, (unsigned long long *)bcnt) == 2);
}
This is also wrong (even though it may work in practice), since unsigned long long does not necessarily need to be 64 bit (it may be larger, and if so, you'll smash the stack).
What you want is:

Indeed, that is obviously wrong. I'll fix that and the other occurences.