Bug 207961 – net-firewall/iptables-1.3.8-r2 fails to recognize the connlimit extension enabled in the kernel

• Product: Gentoo Linux
• Status: RESOLVED DUPLICATE

[Description Nicky 2008-01-28 20:50:21 UTC]

I have the "connlimit" extension enabled as a module (CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m) in my kernel, however when emerging iptables (even with the "extensions" USE flags) the compile script fails to recognize the "connlimit" extension and thus does not builds the relevant iptables module.

Reproducible: Always

Steps to Reproduce:
1.set CONFIG_NETFILTER_XT_MATCH_CONNLIMIT=m in the kernel .config
2.issue - make && make modules_install and boot the new kernel - or issue make prepare
3.USE="extensions" emerge iptables
Actual Results:  
issuing iptables -A INPUT -p tcp -m connlimit --connlimit-above 1 -j DROP results in the following error message:
iptables v1.3.8: Couldn't load match `connlimit':/lib/iptables/libipt_connlimit.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

Expected Results:  
the connlimit module should have been built according to the kernel config.

Portage 2.1.3.19 (hardened/x86/2.6, gcc-3.4.6, glibc-2.6.1-r0, 2.6.23-hardened-r4 i686)
=================================================================
System uname: 2.6.23-hardened-r4 i686 Pentium III (Coppermine)
Timestamp of tree: Fri, 25 Jan 2008 18:00:06 +0000
ccache version 2.4 [enabled]
app-shells/bash:     3.2_p17-r1
dev-lang/python:     2.4.4-r6
dev-python/pycrypto: 2.0.1-r6
dev-util/ccache:     2.4-r7
sys-apps/baselayout: 1.12.10-r5
sys-apps/sandbox:    1.2.18.1-r2
sys-devel/autoconf:  2.13, 2.61-r1
sys-devel/automake:  1.4_p6, 1.6.3, 1.7.9-r1, 1.9.6-r2, 1.10
sys-devel/binutils:  2.18-r1
sys-devel/gcc-config: 1.4.0-r4
sys-devel/libtool:   1.5.24
virtual/os-headers:  2.6.23-r3
ACCEPT_KEYWORDS="x86"
CBUILD="i686-pc-linux-gnu"
CFLAGS="-mtune=i686 -O2 -pipe -fforce-addr -march=pentium3 -fomit-frame-pointer"
CHOST="i686-pc-linux-gnu"
CONFIG_PROTECT="/etc"
CONFIG_PROTECT_MASK="/etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/revdep-rebuild /etc/terminfo /etc/udev/rules.d"
CXXFLAGS="-mtune=i686 -O2 -pipe -fforce-addr -march=pentium3 -fomit-frame-pointer"
DISTDIR="/usr/portage/distfiles"
FEATURES="ccache distlocks metadata-transfer parallel-fetch sandbox sfperms strict unmerge-orphans userfetch"
GENTOO_MIRRORS="http://adelie.polymtl.ca/ http://ftp.jaist.ac.jp/pub/Linux/Gentoo/ ftp://ftp.ecc.u-tokyo.ac.jp/GENTOO"
MAKEOPTS="-j2"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress --force --whole-file --delete --delete-after --stats --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --filter=H_**/files/digest-*"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="X bash-completion berkdb cracklib crypt dri hal hardened midi mmx nptl nptlonly pam pic readline sdl sse ssl tcpd unicode urandom x86 xorg zlib" ALSA_CARDS="intel8x0" ALSA_PCM_PLUGINS="adpcm alaw asym copy dmix dshare dsnoop empty extplug file hooks iec958 ioplug ladspa lfloat linear meter mulaw multi null plug rate route share shm softvol" APACHE2_MODULES="actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" ELIBC="glibc" INPUT_DEVICES="keyboard mouse" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" USERLAND="GNU" VIDEO_CARDS="i810"
Unset:  CPPFLAGS, CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS, LINGUAS, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

[Comment 1 Nicky 2008-01-28 20:50:48 UTC]

Created attachment 142049 [details]
the kernel configuration

[Comment 2 Nicky 2008-01-28 20:51:38 UTC]

Created attachment 142051 [details]
emerge log while emerging iptables

[Comment 3 Nicky 2008-01-28 20:53:50 UTC]

Created attachment 142053 [details]
the tarball of the directory /var/db/pkg/net-firewall/iptables-1.3.8-r2 if that helps

[Comment 4 Jakub Moc (RETIRED) 2008-01-28 21:04:17 UTC]

Please do *not* attach tarballs unless the plaintext attachment size doesn't fit the bugzilla limit.

[Comment 5 Peter Volkov (RETIRED) 2008-01-29 08:27:55 UTC]

Thank you for report, Nicky. That was upstream decision to remove this connlimit together with other extensions from iptables. While I'm looking for better solution you are welcome to use patch-o-matic manually.

*** This bug has been marked as a duplicate of bug 206038 ***

[Comment 6 Peter Volkov (RETIRED) 2008-01-29 09:53:03 UTC]

BTW, Seems that later connlimit was added to iptables:

------------------------------------------------------------------------
r6903 | /C=EU/ST=EU/CN=Patrick McHardy/emailAddress=[e-mail] | 2007-07-09 20:50:17 +0400 (Пнд, 09 Июл 2007) | 4 lines

PATCH: Add connlimit to iptables.

Signed-off-by: Jan Engelhardt <[e-mail]>
------------------------------------------------------------------------

So iptables-1.4.0 has this patch inside.

[Comment 7 Nicky 2008-01-29 19:14:57 UTC]

Thanks a lot for the prompt action everybody. I'm sorry for the tarball attachments as I was not aware of the stated policies here... I've just finished with iptables/patch-o-matic manually from the source. Thank you for your time and pointing me in the right direction.

Regards,
nix