Release of iptables 1.4.1-rc2

The netfilter coreteam proudly presents:

    iptables version 1.4.1-rc2

This release candidate fixes an incorrect assumption about /bin/sh in the new build system and allows to specify the REDIRECT --to-port symbolically.

Version 1.4.1-rc2 can be obtained from (please note that the webpage hasn't been rebuilt yet, but will be shortly):

http://www.netfilter.org/projects/iptables/downloads.html
ftp://ftp.netfilter.org/pub/iptables/
git://git.netfilter.org/iptables.git

If nothing bad happens, I'll release the final 1.4.1 by next week.

Please note: the iptables.git repository history has been cleaned up to remove the certificate mess from committer names and use correct author names. This unfortunately means that you have to reclone it completely. Sorry about this, in the future this shouldn't happen again.

On behalf of the Netfilter Core Team.
Happy testing!

Kristof Provost (1):
REDIRECT: Allow symbolic port in REDIRECT --to-port

Thomas Jacob (1):
Don't assume /bin/sh is bash

* Patrick McHardy <[email protected]>:

| iptables version 1.4.1-rc2

[kernel]
Linux gzp1 2.4.36.4-gzp1 #1 SMP Fri May 9 17:21:19 CEST 2008 i686 GNU/Linux

[glibc]
GNU C Library stable release version 2.3.6, by Roland McGrath et al. Compiled by GNU CC version 4.1.2.
Compiled on a Linux 2.4.34-gzp1 system on 2007-04-04.

[gcc]
gcc (GCC) 4.2.4

[binutils]
GNU ld (Linux/GNU Binutils) 2.18.50.0.7.20080502

CC libxt_connlimit.oo
In file included from /usr/include/linux/netfilter_ipv4.h:9,

                 from ../include/linux/netfilter_ipv4/ip_tables.h:18,
                 from ../include/libiptc/libiptc.h:7,
                 from ../include/iptables.h:5,
                 from libxt_connlimit.c:8:

../include/linux/netfilter.h:41: error: expected specifier-qualifier-list before '__be32' make[2]: *** [libxt_connlimit.oo] Error 1
make[2]: Leaving directory `/home/gzp/src/iptables-1.4.1-rc2/extensions' make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/gzp/src/iptables-1.4.1-rc2'
make: *** [all] Error 2

Thanks for the report. Does this patch fix it?

index 4196a51..6ea935f 100644
@@ -1,6 +1,7 @@
 #ifndef __LINUX_NETFILTER_H
 #define __LINUX_NETFILTER_H
 
+#include <linux/types.h>
 
 /* Responses from hook functions. */
 #define NF_DROP 0

index fc64b97..c42c73f 100644
@@ -15,6 +15,7 @@
 #ifndef _IPTABLES_H
 #define _IPTABLES_H
 
+#include <linux/types.h>
 #include <linux/netfilter_ipv4.h>
 
 #include <linux/netfilter/x_tables.h>

index 68b22fc..fb03b31 100644
@@ -15,6 +15,7 @@
 #ifndef _IP6_TABLES_H
 #define _IP6_TABLES_H
 
+#include <linux/types.h>
 #include <linux/netfilter_ipv6.h>
 
 #include <linux/netfilter/x_tables.h>

* Patrick McHardy <[email protected]>:

| Thanks for the report. Does this patch fix it?

Not really.

CC libxt_connlimit.oo
In file included from /usr/include/linux/netfilter_ipv4.h:9,

                 from ../include/linux/netfilter_ipv4/ip_tables.h:19,
                 from ../include/libiptc/libiptc.h:7,
                 from ../include/iptables.h:5,
                 from libxt_connlimit.c:8:

../include/linux/netfilter.h:42: error: expected specifier-qualifier-list before '__be32' make[2]: *** [libxt_connlimit.oo] Error 1
make[2]: Leaving directory `/home/gzp/src/iptables-1.4.1-rc2/extensions' make[1]: *** [all-recursive] Error 1

Your types.h doesn't seem to include the endian annotated types at all. Does this patch work?

index 4196a51..b64a513 100644
@@ -38,8 +38,8 @@ enum nf_inet_hooks {
 
 union nf_inet_addr {
 	__u32		all[4];
-	__be32		ip;
-	__be32		ip6[4];
+	__u32		ip;
+	__u32		ip6[4];
 	struct in_addr	in;
 	struct in6_addr	in6;
 };

* Patrick McHardy <[email protected]>:

| Your types.h doesn't seem to include the endian annotated | types at all. Does this patch work?

Yes. Next problem:

CC libxt_conntrack.oo
In file included from libxt_conntrack.c:21:
../include/linux/netfilter/xt_conntrack.h:38: error: expected specifier-qualifier-list before '__be32' ../include/linux/netfilter/xt_conntrack.h:45: error: expected specifier-qualifier-list before '__be32' libxt_conntrack.c: In function 'conntrack_parse': libxt_conntrack.c:321: error: 'struct <anonymous>' has no member named 'protonum' libxt_conntrack.c:323: error: 'struct <anonymous>' has no member named 'protonum'
libxt_conntrack.c:345: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c:365: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c:385: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c:405: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c: In function 'matchinfo_print': libxt_conntrack.c:812: error: 'struct <anonymous>' has no member named 'protonum' libxt_conntrack.c:821: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c:833: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c:845: error: 'struct <anonymous>' has no member named 'ip'
libxt_conntrack.c:857: error: 'struct <anonymous>' has no member named 'ip'
make[2]: *** [libxt_conntrack.oo] Error 1
make[2]: Leaving directory `/home/gzp/src/iptables-1.4.1-rc2/extensions'

Yes, I also noticed a bunch of other problems with old kernel headers. I'll resync the headers and fix it up, but it might take until tommorrow since I'm not sure whether I'll get near an internet connection again today.

Took me a bit longer. I've resynced all headers and added a recent linux/types.h. Does this patch (on top of 1.4.1-rc2) fix compilation?

commit e0bba47e550420e371c97425cc6d39909a6e059b

Author: Patrick McHardy <[email protected]>
Date:   Thu Jun 5 16:18:41 2008 +0200

Resync header files with kernel

Resync headers and add types.h file for endian annotated types, which are not available with old headers.

index b64a513..4196a51 100644
@@ -38,8 +38,8 @@ enum nf_inet_hooks {
 
 union nf_inet_addr {
 	__u32		all[4];
-	__u32		ip;
-	__u32		ip6[4];
+	__be32		ip;
+	__be32		ip6[4];
 	struct in_addr	in;
 	struct in6_addr	in6;
 };

index 3b452a6..b887a99 100644
@@ -125,6 +125,18 @@ enum ip_conntrack_events
 	/* Counter highest bit has been set */
 	IPCT_COUNTER_FILLING_BIT = 11,
 	IPCT_COUNTER_FILLING = (1 << IPCT_COUNTER_FILLING_BIT),
+
+	/* Mark is set */
+	IPCT_MARK_BIT = 12,
+	IPCT_MARK = (1 << IPCT_MARK_BIT),
+
+	/* NAT sequence adjustment */
+	IPCT_NATSEQADJ_BIT = 13,
+	IPCT_NATSEQADJ = (1 << IPCT_NATSEQADJ_BIT),
+
+	/* Secmark is set */
+	IPCT_SECMARK_BIT = 14,
+	IPCT_SECMARK = (1 << IPCT_SECMARK_BIT),
 };
 
 enum ip_conntrack_expect_events {

@@ -132,4 +144,5 @@ enum ip_conntrack_expect_events {
 	IPEXP_NEW = (1 << IPEXP_NEW_BIT),
 };
 
+
 #endif /* _NF_CONNTRACK_COMMON_H */

index ed9665f..f79e313 100644
@@ -3,8 +3,10 @@
 
 struct xt_rateest_target_info {
 	char			name[IFNAMSIZ];
-	signed char		interval;
-	unsigned char		ewma_log;
+	int8_t			interval;
+	u_int8_t		ewma_log;
+
+	/* Used internally by the kernel */
 	struct xt_rateest	*est __attribute__((aligned(8)));
 };
 

index 9e35ccd..f3fd83e 100644
@@ -74,8 +74,8 @@ struct xt_conntrack_mtinfo1 {
 	union nf_inet_addr repldst_addr, repldst_mask;
 	u_int32_t expires_min, expires_max;
 	u_int16_t l4proto;
-	u_int16_t origsrc_port, origdst_port;
-	u_int16_t replsrc_port, repldst_port;
+	__be16 origsrc_port, origdst_port;
+	__be16 replsrc_port, repldst_port;
 	u_int16_t match_flags, invert_flags;
 	u_int8_t state_mask, status_mask;
 };

index c0aa6d9..b3ce653 100644
@@ -12,10 +12,10 @@ struct xt_rateinfo {
 
 	/* Used internally by the kernel */
 	unsigned long prev;
-	/* Ugly, ugly fucker. */
-	struct xt_rateinfo *master;
-
 	u_int32_t credit;
 	u_int32_t credit_cap, cost;
+
+	/* Ugly, ugly fucker. */
+	struct xt_rateinfo *master;
 };
 #endif /*_XT_RATE_H*/

index 25a7a18..9d33619 100644
@@ -1,9 +1,6 @@
 #ifndef _XT_PHYSDEV_H
 #define _XT_PHYSDEV_H
 
-#ifdef __KERNEL__
-#include <linux/if.h>
-#endif
 
 #define XT_PHYSDEV_OP_IN		0x01
 #define XT_PHYSDEV_OP_OUT		0x02

index e4e0653..2010cb7 100644
@@ -2,12 +2,12 @@
 #define _XT_RATEEST_MATCH_H
 
 enum xt_rateest_match_flags {
-	XT_RATEEST_MATCH_INVERT	= 0x01,
-	XT_RATEEST_MATCH_ABS	= 0x02,
-	XT_RATEEST_MATCH_REL	= 0x04,
-	XT_RATEEST_MATCH_DELTA	= 0x08,
-	XT_RATEEST_MATCH_BPS	= 0x10,
-	XT_RATEEST_MATCH_PPS	= 0x20,
+	XT_RATEEST_MATCH_INVERT	= 1<<0,
+	XT_RATEEST_MATCH_ABS	= 1<<1,
+	XT_RATEEST_MATCH_REL	= 1<<2,
+	XT_RATEEST_MATCH_DELTA	= 1<<3,
+	XT_RATEEST_MATCH_BPS	= 1<<4,
+	XT_RATEEST_MATCH_PPS	= 1<<5,
 };
 
 enum xt_rateest_match_mode {

@@ -26,6 +26,8 @@ struct xt_rateest_match_info {
 	u_int32_t		pps1;
 	u_int32_t		bps2;
 	u_int32_t		pps2;
+
+	/* Used internally by the kernel */
 	struct xt_rateest	*est1 __attribute__((aligned(8)));
 	struct xt_rateest	*est2 __attribute__((aligned(8)));
 };

new file mode 100644
index 0000000..220e872
@@ -0,0 +1,10 @@
+#ifndef _XT_REALM_H
+#define _XT_REALM_H
+
+struct xt_realm_info {
+	u_int32_t id;
+	u_int32_t mask;
+	u_int8_t invert;
+};
+
+#endif /* _XT_REALM_H */

index c344e99..3d38bc9 100644
@@ -23,6 +23,7 @@ struct xt_statistic_info {
 		struct {
 			u_int32_t	every;
 			u_int32_t	packet;
+			/* Used internally by the kernel */
 			u_int32_t	count;
 		} nth;
 	} u;

index 3b3419f..bb21dd1 100644
@@ -12,6 +12,8 @@ struct xt_string_info
 	char 	  pattern[XT_STRING_MAX_PATTERN_SIZE];
 	u_int8_t  patlen;
 	u_int8_t  invert;
+
+	/* Used internally by the kernel */
 	struct ts_config __attribute__((aligned(8))) *config;
 };
 

index daf50be..e5a3687 100644
@@ -27,6 +27,7 @@ struct ipt_clusterip_tgt_info {
 	u_int32_t hash_mode;
 	u_int32_t hash_initval;
 
+	/* Used internally by the kernel */
 	struct clusterip_config *config;
 };
 

index a711cd1..94e0d98 100644
@@ -4,7 +4,7 @@
  *
  * This software is distributed under GNU GPL v2, 1991
  * 
- * Id: ipt_ECN.h,v 1.3 2002/05/29 12:17:40 laforge Exp
+ * ipt_ECN.h,v 1.3 2002/05/29 12:17:40 laforge Exp
 */
 #ifndef _IPT_ECN_TARGET_H
 #define _IPT_ECN_TARGET_H

index f669b8c..ee6611e 100644
@@ -1,5 +1,5 @@
 /* TTL modification module for IP tables
- * (C) 2000 by Harald Welte <[email protected]> */
+ * (C) 2000 by Harald Welte <[email protected]> */
 
 #ifndef _IPT_TTL_H
 #define _IPT_TTL_H

@@ -16,4 +16,6 @@ struct ipt_TTL_info {
 	u_int8_t	mode;
 	u_int8_t	ttl;
 };
+
+
 #endif

index 326c0c0..1f0d9a4 100644
@@ -4,7 +4,7 @@
  *
  * This software is distributed under GNU GPL v2, 1991
  * 
- * Id: ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
+ * ipt_ecn.h,v 1.4 2002/08/05 19:39:00 laforge Exp
 */
 #ifndef _IPT_ECN_H
 #define _IPT_ECN_H

index 2357731..b3996ea 100644
@@ -1,9 +1,7 @@
 #ifndef _IPT_REALM_H
 #define _IPT_REALM_H
 
-struct ipt_realm_info {
-	u_int32_t id;
-	u_int32_t mask;
-	u_int8_t invert;
-};
-#endif /*_IPT_REALM_H*/
+#include <linux/netfilter/xt_realm.h>
+#define ipt_realm_info xt_realm_info
+
+#endif /* _IPT_REALM_H */

* Patrick McHardy <[email protected]>:

| Took me a bit longer. I've resynced all headers and added
| a recent linux/types.h. Does this patch (on top of 1.4.1-rc2)
| fix compilation?

patching file include/linux/netfilter.h
Reversed (or previously applied) patch detected! Assume -R? [n] Apply anyway? [n]
Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file include/linux/netfilter.h.rej

make all-recursive
make[1]: Entering directory `/home/gzp/src/iptables-1.4.1-rc2' Making all in extensions
make[2]: Entering directory `/home/gzp/src/iptables-1.4.1-rc2/extensions'

[...]

CC libxt_dccp.oo
libxt_dccp.c:16:24: warning: linux/dccp.h: No such file or directory

[...]

make[2]: *** [libxt_dccp.oo] Error 1
make[2]: Leaving directory `/home/gzp/src/iptables-1.4.1-rc2/extensions' make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/home/gzp/src/iptables-1.4.1-rc2'
make: *** [all] Error 2

Mhh .. I don't really want to add that file to iptables. Jan, I'm not familiar with auto*, could you send a patch to make compilation of libxt_dccp dependand on the presence of linux/dccp.h? Thanks.

Is dccp.h too ugly? Either way, please pull from
git://dev.medozas.de/xtables master
to get
commit 1ebc55e29f220082814a97e541427be7746400e0
parent 324651944e03072cde144d41896b2e207672d0f2

Author: Jan Engelhardt <[email protected]>
Date:   Thu Jun 5 19:48:31 2008 +0200

build: check for missing feature files

linux/dccp.h is unlikely to be installed before 2.6.18 (which was when headers_install was introduced), and does not exist at all before 2.6.14. Add a compile-time check to skip compilation of libxt_dccp in case this was detected.

commit 1ebc55e29f220082814a97e541427be7746400e0

Author: Jan Engelhardt <[email protected]>
Date:   Thu Jun 5 19:48:31 2008 +0200

build: check for missing feature files

linux/dccp.h is unlikely to be installed before 2.6.18 (which was when headers_install was introduced), and does not exist at all before 2.6.14. Add a compile-time check to skip compilation of libxt_dccp in case this was detected.

---
 configure.ac              |    8 ++++++++
 extensions/GNUmakefile.in |    3 +++
 2 files changed, 11 insertions(+), 0 deletions(-)

index e718eff..d063605 100644
@@ -39,6 +39,14 @@ AC_ARG_ENABLE([libipq],
 	AS_HELP_STRING([--enable-libipq], [Build and install libipq]))
 
 AC_CHECK_HEADER([netinet/ip6.h], [], [AC_MSG_ERROR(but we need that for IPv6)])
+AC_CHECK_HEADER([linux/dccp.h])
+
+blacklist_modules="";
+if test "$ac_cv_header_linux_dccp_h" != "yes"; then
+	blacklist_modules="$blacklist_modules dccp";
+fi;
+AC_SUBST([blacklist_modules])
+
 AM_CONDITIONAL([ENABLE_STATIC], [test "$enable_static" == "yes"])
 AM_CONDITIONAL([ENABLE_SHARED], [test "$enable_shared" == "yes"])
 AM_CONDITIONAL([ENABLE_DEVEL], [test "$enable_devel" == "yes"])

index 9419574..8d44e4e 100644
@@ -37,6 +37,9 @@ endif
 pfx_build_mod := $(patsubst ${srcdir}/libxt_%.c,%,$(wildcard ${srcdir}/libxt_*.c))
 pf4_build_mod := $(patsubst ${srcdir}/libipt_%.c,%,$(wildcard ${srcdir}/libipt_*.c))
 pf6_build_mod := $(patsubst ${srcdir}/libip6t_%.c,%,$(wildcard ${srcdir}/libip6t_*.c))
+pfx_build_mod := $(filter-out @blacklist_modules@,${pfx_build_mod})
+pf4_build_mod := $(filter-out @blacklist_modules@,${pf4_build_mod})
+pf6_build_mod := $(filter-out @blacklist_modules@,${pf6_build_mod})
 pfx_objs      := $(patsubst %,libxt_%.o,${pfx_build_mod})
 pf4_objs      := $(patsubst %,libipt_%.o,${pf4_build_mod})
 pf6_objs      := $(patsubst %,libip6t_%.o,${pf6_build_mod})

* Jan Engelhardt <[email protected]>:

| commit 1ebc55e29f220082814a97e541427be7746400e0

ok, iptables 1.4.1-rc2 with the patches now compiled fine on:

[kernel]
Linux gzp1 2.4.36.5-gzp1 #1 SMP Mon Jun 2 19:36:14 CEST 2008 i686 GNU/Linux

[glibc]
GNU C Library stable release version 2.3.6, by Roland McGrath et al. Compiled by GNU CC version 4.1.2.
Compiled on a Linux 2.4.34-gzp1 system on 2007-04-04.

[gcc]
gcc (GCC) 4.2.4

[binutils]
GNU ld (Linux/GNU Binutils) 2.18.50.0.7.20080502

[autoconf]
autoconf (GNU Autoconf) 2.62

[automake]
automake (GNU automake) 1.10.1

[libtool]
ltmain.sh (GNU libtool) 1.5.26 (1.1220.2.492 2008/01/30 06:40:56)

The question is, how usable on this system. ;-)

So you saw the light - upgrade to 2.6!

Thanks a lot!

Everything supported by that kernel should work fine.

I'd prefer to limit the included files to netfilter-related ones.

Done, thanks.

Gabor, could you try again using the latest git version?

Hello Patrick,

I just compiled the new version and noticed a minor error message during the build of the manpages:

GEN matches4.man
grep: invalid option -- o
Usage: grep [OPTION]... PATTERN [FILE]...
Try `grep --help' for more information.

Looks like my grep version is too old. Should ./configure detect that or is it even possible to transform the grep call into something else?

Cheers,
Thomas

Revision 1.72 - (view) (download) (as text) (annotate) - [select for diffs] Mon Nov 19 13:23:29 2001 UTC (6 years, 6 months ago) by bero
Branch: MAIN
Changes since 1.71: +34 -1 lines
Diff to previous 1.71

Add -o option

I think it is ok to assume -o is always there. Nov 2001, that's linux 2.4.14 timeframe, and most of the now-ancient distros have gone at least up to 2.4.20s, which should imply that they also updated their greps.

I assume people would not be amused if we start requiring perl. But you can use it as a workaround...

	perl -ne 'print$&if/\b[A-Z0-9]+\b/'

Hi Jan,

Well, I run kernel 2.6.24 and never had a need to upgrade grep until now. But I'm fine with the new version, just wanted to report it.

That's true, though I guess there is a "sed" wizard out there that can easily rewrite the call into a sed command, which should be available on most (ancient) systems ;-)

Thomas

What exactly is that grep supposed to do? How about sed or awk?

It should grep all uppercase-only names from the module name list. grep seems more lightweight, I would not bother with awk.

Well, working properly takes precendence in my opinion. I don't want to mess with this myself, but I'd apply a patch to either use awk as fallback or unconditionally if that works better.