Release of iptables 1.4.2-rc1

The netfilter coreteam presents:

    iptables version 1.4.2-rc1

The first release candidate for iptables 1.4.2.

The major change in this release are some scalability improvements from Jesper Dangaard Brouer that should greatly increase ruleset parsing performance with many chains. Besides that we have some minor bugfixes, manpage updates, case insensitive string match support (requires current -git kernel) and --goto support for ip6tables.

Version 1.4.2-rc1 can be obtained from (please note that the webpage hasn't been rebuilt yet, but will be sometime soon):

http://www.netfilter.org/projects/iptables/downloads.html
ftp://ftp.netfilter.org/pub/iptables/
git://git.netfilter.org/iptables.git

The plan is to have a final 1.4.2 release shortly before 2.6.27 is released.

On behalf of the Netfilter Core Team.
Happy testing!

Jan Engelhardt (6):
build: change equailty test for old bash
build: ip6.h is not required
libxt_TOS: make sure --set-tos value/mask is recognized
build: quote variables in release.sh
build: various changes to release.sh
manpages: various updates

Jesper Dangaard Brouer (2):
libiptc: minor bugfix
libiptc: fix scalability performance issue during initial ruleset parsing

Joonwoo Park (1):
xt_string: string extension case insensitive matching

Patrick McHardy (3):
Add simple release script
release.sh: fix changelog filename
v1.4.2-rc1

Thomas Jacob (1):

      ip6tables: add --goto support

Hi there,

No problems here, built and installed fine right out of the box with ./configure
make
make install

I'm curious about the ipset userspace tool - will it eventually find its way to the iptables tarball? Right now it seems that you get it kind of incidentally when you apply the kernel patch, which seems to me a little odd.

8<----------------------------------------------------------------------

[ged]$ gcc -v
Reading specs from /usr/lib/gcc-lib/i386-redhat-linux/3.2.2/specs Configured with: ../configure --prefix=/usr --mandir=/usr/share/man
--infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-checking --with-system-zlib --enable-__cxa_atexit --host=i386-redhat-linux
Thread model: posix
gcc version 3.2.2 20030222 (Red Hat Linux 3.2.2-5)

8<----------------------------------------------------------------------

[ged]$ /lib/libc.so.6
GNU C Library stable release version 2.3.2, by Roland McGrath et al. Copyright (C) 2003 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled by GNU CC version 3.2.2 20030222 (Red Hat Linux 3.2.2-5). Compiled on a Linux 2.4.20 system on 2003-03-13. Available extensions:
GNU libio by Per Bothner
crypt add-on version 2.1 by Michael Glad and others linuxthreads-0.10 by Xavier Leroy
BIND-8.2.3-T5B
libthread_db work sponsored by Alpha Processor Inc NIS(YP)/NIS+ NSS modules 0.19 by Thorsten Kukuk
Thread-local storage support included.
Report bugs using the `glibcbug' script to <[email protected]>.

8<----------------------------------------------------------------------

--

73,
Ged.

Thanks.

Jozsef should be able to answer that.

* "G.W. Haywood" <[email protected]>:

| > iptables version 1.4.2-rc1

| No problems here, built and installed fine right out of the box with
| ./configure
| make
| make install

Same on Linux 2.4.36.6 - glibc 2.3.6 - gcc 4.2.4

With the iptables source you already get the userspace part of the set match and target. The (new) ipset source tarball contains both the ipset userspace tool and the kernel modules, including the netfilter match and target. There's no need for patch-o-matic-ng for ipset anymore, so the life is easier to get the complete ipset functionality.

As I stated several times, I do not want to submit the kernel part of ipset for inclusion: there's no point to waste the resources of the maintainers as I have been working on a complete rewriting of ipset. By the next netfilter development workshop I want to release the first version of it, so it's not in the indefinite future anymore.

I'd not like the ipset userspace tool to be included into the iptables source either. That'd be an even stranger situation and then there'd come even bigger pressure to submit the kernel part of the present version of ipset.

Best regards,
Jozsef
-
E-mail : [email protected], [email protected] PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt
Address : KFKI Research Institute for Particle and Nuclear Physics

          H-1525 Budapest 114, POB. 49, Hungary

Hi Jozsef,

You're quite right, I've installed it on a couple of my mailservers and it is a lot easier than patching [sic] the patch-o-matic sources.

Thank you. Thank you all! very much for your efforts.

I understand. I was just curious. :)

--

73,
Ged.