翻译
SourceForge logo
Home Browse Ethernet bridge tables Mailing Lists
Thread: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
Brought to you by: bdschuym
Summary
Files
Reviews
Support
Mailing Lists
Tickets ▾
Code
Mailing Lists Menu
▾
ebtables-user
[Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Bart De S. <bds...@pa...> - 2006-12-18 19:09:02
Hi all,
I've just uploade release candidate 3 of ebtables v2.0.8.
Changes:
* fixed a few reported bugs
* ebt_among --among-dst-file and --among-src-file: allow the list
to be given in a file (circumvents command line max. line
length)
* ebt_nat --snat-arp: if it's an arp packet, also change the
source address in the arp header
* ebt_mark --mark-or, --mark-xor, --mark-and
Cheers,
Bart
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Carl-Daniel H. <c-d...@gm...> - 2006-12-19 13:44:46
Hi Bart,
the -fPIC problem on x86_64 is still there:
# make
[...]
ld -shared -soname libebtc.so -o libebtc.so -lc getethertype.o communication.o libebtc.o useful_functions.o ebtables.o
ld: ebtables.o: relocation R_X86_64_32 against `a local symbol' can not be used when making a shared object; recompile with -fPIC
ebtables.o: could not read symbols: Bad value
make: *** [libebtc] Error 1
If you need more information about the problem, please take a look at
http://www.x86-64.org/lists/discuss/msg05760.html .
Besides that, I get these warnings:
ebtables.c: In function `list_em':
ebtables.c:324: warning: long long unsigned int format, uint64_t arg (arg 2)
ebtables.c:324: warning: long long unsigned int format, uint64_t arg (arg 3)
ebtables.c:326: warning: long long unsigned int format, uint64_t arg (arg 2)
ebtables.c:326: warning: long long unsigned int format, uint64_t arg (arg 3)
extensions/ebt_among.c: In function `parse':
extensions/ebt_among.c:348: warning: implicit declaration of function `close'
This patch fixes them:
--- ebtables-v2.0.8-rc3/ebtables.c 2006-12-17 22:27:17.000000000 +0100
+++ ebtables-v2.0.8-rc3-modified/ebtables.c 2006-12-19 13:24:41.000000000 +0100
@@ -321,9 +321,9 @@
uint64_t bcnt = hlp->cnt.bcnt;
if (replace->flags & LIST_X)
- printf("-c %llu %llu", pcnt, bcnt);
+ printf("-c %llu %llu", (unsigned long long)pcnt, (unsigned long long)bcnt);
else
- printf(", pcnt = %llu -- bcnt = %llu", pcnt, bcnt);
+ printf(", pcnt = %llu -- bcnt = %llu", (unsigned long long)pcnt, (unsigned long long)bcnt);
}
printf("\n");
hlp = hlp->next;
diff -urN ebtables-v2.0.8-rc3/extensions/ebt_among.c ebtables-v2.0.8-rc3-modified/extensions/ebt_among.c
--- ebtables-v2.0.8-rc3/extensions/ebt_among.c 2006-12-17 22:27:17.000000000 +0100
+++ ebtables-v2.0.8-rc3-modified/extensions/ebt_among.c 2006-12-19 13:08:15.000000000 +0100
@@ -7,6 +7,7 @@
*/
#include <stdio.h>
+#include <unistd.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
Explanation: uint64_t is unsigned long long on i386, but unsigned long
on x86_64.
The problems of creating rules on x86_64 is still there. However, it seems
that Al Viro has fixed something in this area:
http://www2.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bb2ef25c2c62444b8fdb0346a23658a419803df9
Regards,
Carl-Daniel
--
http://www.hailfinger.org/
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Bart De S. <bds...@pa...> - 2006-12-22 18:37:32
Op di, 19-12-2006 te 14:44 +0100, schreef Carl-Daniel Hailfinger:
> Hi Bart,
>
> the -fPIC problem on x86_64 is still there:
<snip>
> Explanation: uint64_t is unsigned long long on i386, but unsigned long
> on x86_64.
Should be fixed in CVS, thanks.
> The problems of creating rules on x86_64 is still there. However, it seems
> that Al Viro has fixed something in this area:
> http://www2.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bb2ef25c2c62444b8fdb0346a23658a419803df9
That's unrelated, it fixes the checking for maliciously constructed
ebtables tables.
cheers,
Bart
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Carl-Daniel H. <c-d...@gm...> - 2006-12-23 01:29:15
Bart De Schuymer wrote:
> Op di, 19-12-2006 te 14:44 +0100, schreef Carl-Daniel Hailfinger:
>> Hi Bart,
>>
>> the -fPIC problem on x86_64 is still there:
>
> <snip>
>> Explanation: uint64_t is unsigned long long on i386, but unsigned long
>> on x86_64.
>
> Should be fixed in CVS, thanks.
Thanks!
>> The problems of creating rules on x86_64 is still there. However, it seems
>> that Al Viro has fixed something in this area:
>> http://www2.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=bb2ef25c2c62444b8fdb0346a23658a419803df9
>
> That's unrelated, it fixes the checking for maliciously constructed
> ebtables tables.
Then normal ebtables userspace on x86_64 definitely counts as malicious.
I was referring to this part of the changelog:
> While we are at it, don't subtract unrelated pointers...
The problems with loading rules on x86_64 have disappeared after
applying the patch series from Al Viro.
However, the "among" match still reports problems:
# ebtables -t nat -A ebtables-experiment --among-dst 2:3:4:5:6:7=192.168.0.1,2:3:4:5:6:8=192.168.0.3,2:3:4:5:6:9=192.168.0.2 -j ACCEPT
old_size=56,new_size=1124, sizeof(ebt_entry_match)=40, msize=1084
wh_dst_ofs=16
The kernel doesn't support a certain ebtables extension, consider recompiling your kernel or insmod the extension.
dmesg says (debugging added by me):
ebtables: among: wrong size: 1084 against expected 1080, rounded to 1080, sizeof(ebt_among_info)=12, wh_size(dst)=1068, wh_size(src)=0, sizeof(ebt_entry_match)=40
kernel msg: ebtables bug: please report to author: match->check failed
The source of the problem is easy to spot:
In userspace, wh_dst_ofs==16 (because (**match).match_size==16 at
line 357 in extensions/ebt_among.c), but in kernelspace we check
wh_dst_ofs against sizeof(struct ebt_among_info)==12.
That is obviously going to fail. Always.
Regards,
Carl-Daniel
--
http://www.hailfinger.org/
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Bart De S. <bds...@pa...> - 2006-12-23 17:22:31
Op za, 23-12-2006 te 02:29 +0100, schreef Carl-Daniel Hailfinger:
> The problems with loading rules on x86_64 have disappeared after
> applying the patch series from Al Viro.
Well, I'll be damned :)
> However, the "among" match still reports problems:
> The source of the problem is easy to spot:
> In userspace, wh_dst_ofs==16 (because (**match).match_size==16 at
> line 357 in extensions/ebt_among.c), but in kernelspace we check
> wh_dst_ofs against sizeof(struct ebt_among_info)==12.
Are you saying sizeof(struct ebt_among_info) differs between userspace
and the kernel? Please double check this...
cheers,
Bart
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Carl-Daniel H. <c-d...@gm...> - 2006-12-23 19:37:56
Bart De Schuymer wrote:
> Op za, 23-12-2006 te 02:29 +0100, schreef Carl-Daniel Hailfinger:
>> However, the "among" match still reports problems:
>> The source of the problem is easy to spot:
>> In userspace, wh_dst_ofs==16 (because (**match).match_size==16 at
>> line 357 in extensions/ebt_among.c), but in kernelspace we check
>> wh_dst_ofs against sizeof(struct ebt_among_info)==12.
>
> Are you saying sizeof(struct ebt_among_info) differs between userspace
> and the kernel? Please double check this...
No, I wanted to say that match_size is set in userspace to something
which is != sizeof(struct ebt_among_info).
More diagnostics:
on x86-64:
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 8 aligned from 6
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 56 aligned from 52
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 32 aligned from 28
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 8 aligned from 8
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 24 aligned from 24
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 8 aligned from 2
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 72 aligned from 72
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 16 aligned from 12 (among)
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 32 aligned from 32
on i386:
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 8 aligned from 6
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 52 aligned from 52
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 28 aligned from 28
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 8 aligned from 8
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 12 aligned from 12
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 4 aligned from 2
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 72 aligned from 72
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 12 aligned from 12 (among)
libebtc.c:1175 in ebt_register_match: m->m->match_size set to 24 aligned from 24
Userspace sets wh_dst_ofs=EBT_ALIGN(sizeof(struct ebt_among_info)), but the
kernel expects wh_dst_ofs=sizeof(struct ebt_among_info). On i386, the EBT_ALIGN
macro has no effect for the among match, but on x86_64 it does. That explains
why the bug was never noticed on i386.
So we either change the kernel or userspace. Changing the kernel would mean
that suddenly all existing userspace works.
Regards,
Carl-Daniel
--
http://www.hailfinger.org/
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Bart De S. <bds...@pa...> - 2007-01-10 19:08:19
Attachments: patch_among.diff
Op za, 23-12-2006 te 20:37 +0100, schreef Carl-Daniel Hailfinger:
> Userspace sets wh_dst_ofs=EBT_ALIGN(sizeof(struct ebt_among_info)), but the
>
> kernel expects wh_dst_ofs=sizeof(struct ebt_among_info). On i386, the EBT_ALIGN
> macro has no effect for the among match, but on x86_64 it does. That explains
> why the bug was never noticed on i386.
>
> So we either change the kernel or userspace. Changing the kernel would mean
> that suddenly all existing userspace works.
It's best not to force people into using a specific kernel, so adjusting
userspace is the thing to do.
Please test the attached userspace patch.
Cheers,
Bart
Re: [Ebtables-user] [RELEASE] ebtables version 2.0.8-rc3
From: Carl-Daniel H. <c-d...@gm...> - 2008-01-28 17:13:26
On 10.01.2007 20:08, Bart De Schuymer wrote:
> Op za, 23-12-2006 te 20:37 +0100, schreef Carl-Daniel Hailfinger:
>
>
>> Userspace sets wh_dst_ofs=EBT_ALIGN(sizeof(struct ebt_among_info)), but the
>> kernel expects wh_dst_ofs=sizeof(struct ebt_among_info). On i386, the EBT_ALIGN
>> macro has no effect for the among match, but on x86_64 it does. That explains
>> why the bug was never noticed on i386.
>>
>> So we either change the kernel or userspace. Changing the kernel would mean
>> that suddenly all existing userspace works.
>>
>
> It's best not to force people into using a specific kernel, so adjusting
> userspace is the thing to do.
>
> Please test the attached userspace patch.
>
I'm very sorry, but I have been unable to take the machine in question
out of production to test the patch.
I found a commit in OpenVZ which touches the code in question and will
probably be upstreamed sometime.
http://git.openvz.org/?p=linux-2.6.24-openvz;a=commit;h=a3d28217a51b57b2980f5fc1203cf7b402ca9bb7
Regards,
Carl-Daniel