| Summary: | net-firewall/iptables-1.3.8 - iptables-restore couldn't load match `recent' | ||
|---|---|---|---|
| Product: | Gentoo Linux | Reporter: | Darren Dale <dsdale24> |
| Component: | Current packages | Assignee: | Gentoo's Team for Core System packages <base-system> |
| Status: | RESOLVED FIXED | ||
| Severity: | major | CC: | agm, jfmc2, toralf |
| Priority: | High | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Package list: | Runtime testing required: | --- | |
| Attachments: |
build log for iptables
kernel .config |
||
|
Description
Darren Dale
2007-08-14 18:12:27 UTC
Maybe it will work better if you enable CONFIG_IP_NF_MATCH_RECENT
Networking options --->
Network packet filtering framework (Netfilter) --->
IP: Netfilter Configuration --->
<M> IP tables support (required for filtering/masq/NAT)
<M> recent match support
(In reply to comment #1) > Maybe it will work better if you enable CONFIG_IP_NF_MATCH_RECENT > > Networking options ---> > Network packet filtering framework (Netfilter) ---> > IP: Netfilter Configuration ---> > <M> IP tables support (required for filtering/masq/NAT) > <M> recent match support > It was enabled as a module when I filed the bug. Recompile iptables and try again; if it still doesn't work, attach you kernel .config here. Created attachment 128157 [details]
build log for iptables
build log for iptables
Created attachment 128159 [details]
kernel .config
Reopening. I'll apologize in advance if I have done something stupid, but I have had iptables working on this machine in the past, with the same rules and the same config settings. I dont know when the problem began occuring, maybe when I upgraded to 2.6.22? should be fixed in 1.3.8-r2, thanks for the report ! *** Bug 190611 has been marked as a duplicate of this bug. *** What's about closing a bug report as "RESOLVED FIXED" not before the package is marked as stable ? generally bug reports reflect latest in the tree, not stable *** Bug 194038 has been marked as a duplicate of this bug. *** Maybe I'm missing something here, but 1.3.8-r2 doesn't work either. I saw this problem because I'm using shorewall. Shorewall has a nice command: shorewall show capabilities which shows precisely which parts of iptables are enabled. With 1.3.5-r4 this is shown: Shorewall has detected the following iptables/netfilter capabilities: NAT: Available Packet Mangling: Available Multi-port Match: Available Extended Multi-port Match: Available Connection Tracking Match: Available Packet Type Match: Available Policy Match: Available Physdev Match: Not available Packet length Match: Available IP range Match: Available Recent Match: Available Owner Match: Available Ipset Match: Not available CONNMARK Target: Available Extended CONNMARK Target: Available Connmark Match: Available Extended Connmark Match: Available Raw Table: Available IPP2P Match: Available CLASSIFY Target: Available Extended REJECT: Available Repeat match: Not available MARK Target: Available Extended MARK Target: Available Mangle FORWARD Chain: Available Comments: Available Address Type Match: Available TCPMSS Match: Available Hashlimit Match: Available With exactly the same config in everything else, just compiling 1.3.8-r2 (as well as r1) shows this: Shorewall has detected the following iptables/netfilter capabilities: NAT: Available Packet Mangling: Available Multi-port Match: Available Extended Multi-port Match: Available Connection Tracking Match: Available Packet Type Match: Available Policy Match: Available Physdev Match: Not available Packet length Match: Available IP range Match: Available Recent Match: Available Owner Match: Available Ipset Match: Not available CONNMARK Target: Available Extended CONNMARK Target: Available Connmark Match: Available Extended Connmark Match: Available Raw Table: Available IPP2P Match: Available CLASSIFY Target: Available Extended REJECT: Available Repeat match: Not available MARK Target: Available Extended MARK Target: Available Mangle FORWARD Chain: Available Comments: Available Address Type Match: Available TCPMSS Match: Available Hashlimit Match: Available As you can see, a lot of Not Available's that were available with 1.3.5-r4. I saw on bug 194038 that maybe the extensions use-flag would fix this, but it didn't. Same problem. Rolling back to 1.3.5-r4. My prognosis: >=1.3.8 doesn't load modules. I think a bug should be filed to unstabilize 1.3.8. Should I do it? Or can we use this bug? Thanks! I must be just asleep today or something. Pasted the same output of shorewall show capabilities twice... Sorry for that. The output of the command with 1.3.8-rX is: Shorewall has detected the following iptables/netfilter capabilities: NAT: Available Packet Mangling: Not available Multi-port Match: Available Extended Multi-port Match: Available Connection Tracking Match: Available Packet Type Match: Available Policy Match: Available Physdev Match: Not available Packet length Match: Available IP range Match: Available Recent Match: Available Owner Match: Available Ipset Match: Not available CONNMARK Target: Not available Connmark Match: Available Extended Connmark Match: Available Raw Table: Available IPP2P Match: Not available CLASSIFY Target: Not available Extended REJECT: Available Repeat match: Available MARK Target: Not available Mangle FORWARD Chain: Not available Comments: Available Address Type Match: Available TCPMSS Match: Available Hashlimit Match: Available *** Bug 196924 has been marked as a duplicate of this bug. *** |
