Hi Willem, On Wed, 26 Apr 2017, Willem de Bruijn wrote: > On Wed, Apr 26, 2017 at 5:15 PM, Willem de Bruijn > <willemdebruijn.kernel@xxxxxxxxx> wrote: > >>> The patch breaks backward/forward compatibility in a match/target. > >>> > >>> When the list of the revisions of a given match/target of iptables is not > >>> exactly the same as for the kernel counter part (when the kernel module > >>> supports less revisions than iptables), then in spite of the supported > >>> match/target, " [unsupported revision]" is printed instead of the > >>> arguments. See https://bugzilla.netfilter.org/show_bug.cgi?id=1147. > >> > >> Thanks for the report. > >> > >>> Please consider reverting the patch. Or we should not stop in > >>> xtables_find_match/xtables_find_target at revision checking when the > >>> revision does not match, until all possibilities is not exhausted. > >> > >> This seems like the better solution to me. The patch fixes a real issue > >> where garbage is printed by misinterpreting struct fields. Iptables should > >> try to lookup the matching revision for a match or target, instead of > >> returning the first one. I'll take a look. > > > > I have a draft patch, but am so far unable to reproduce the problem. > > > > It may be more subtle than what you describe. xtables_find_match > > can call xtables_fully_register_pending_match which calls > > compatible_match_revision to decide whether a match revision > > is supported and, if multiple revisions are supported, which to prefer. > > The case reported in bugzilla is for match 'set', which has not had a > new revision since v4 in 2014. Building the exact versions of iptables > and ipset reported there and disabling v4 support in the kernel correctly > reverts to using v3. Maybe the case can be reproduced with the following steps, but I'm guessing: - rules inserted - iptables binary downgraded/upgraded - rules listed Best regards, Jozsef - E-mail : kadlec@xxxxxxxxxxxxxxxxx, kadlecsik.jozsef@xxxxxxxxxxxxx PGP key : http://www.kfki.hu/~kadlec/pgp_public_key.txt Address : Wigner Research Centre for Physics, Hungarian Academy of Sciences H-1525 Budapest 114, POB. 49, Hungary -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
