Bug 1037770 – Recent -rt kernels compiled without CONFIG_NETFILTER_XT_MATCH_ADDRTYPE

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1037770 - Recent -rt kernels compiled without CONFIG_NETFILTER_XT_MATCH_ADDRTYPE

Summary:	Recent -rt kernels compiled without CONFIG_NETFILTER_XT_MATCH_ADDRTYPE

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise MRG
Classification:	Red Hat
Component:	realtime-kernel (Show other bugs)
Sub Component:
Version:	2.4
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	2.4.3
Target Release:	---
Assigned To:	John Kacur
QA Contact:	MRG Quality Engineering
Docs Contact:

URL:
Whiteboard:
Keywords:

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2013-12-03 14:03 EST by Karl Hastings
Modified:	2014-01-28 12:41 EST (History)
CC List:	7 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	Cause: rt kernels compiled without CONFIG_NETFILTER_XT_MATCH_ADDRTYPE Consequence: Necessary module in order to add an iptables rule matching on an addrtype is not available Fix: CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m added to config files Result: ipt_addrtype is available and it is possible to create an iptables rule matching on addrtype
Story Points:	---
Clone Of:
Environment:
Last Closed:	2014-01-28 12:41:37 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2014:0100	normal	SHIPPED_LIVE	Important: kernel-rt security and bug fix update	2014-01-28 17:38:58 EST

Groups: None (edit)

Description Karl Hastings 2013-12-03 14:03:31 EST

Description of problem:
kernel-rt does not set CONFIG_NETFILTER_XT_MATCH_ADDRTYPE in kernel config, therefore the necessary module (ipt_addrtype) is missing from /lib/modules

Version-Release number of selected component (if applicable):


How reproducible:
100%

Steps to Reproduce:
1. Install and boot into recent kernel-rt
2. Attempt to add a iptables rule matching on addrtype:
     # iptables -t nat -N blah
     # iptables -t nat -A PREROUTING -m addrtype --dst-type LOCAL -j blah


Actual results:
iptables: No chain/target/match by that name."

Expected results:
iptable rule should be accepted.

Additional info:
[root@td-lss05:~]# egrep '(CONFIG_IP_NF_MATCH_ADDRTYPE|CONFIG_NETFILTER_XT_MATCH_ADDRTYPE)' /boot/config-*
/boot/config-2.6.32-358.el6.x86_64:CONFIG_IP_NF_MATCH_ADDRTYPE=m
/boot/config-2.6.32-431.el6.x86_64:CONFIG_IP_NF_MATCH_ADDRTYPE=m
/boot/config-3.0.36-rt57.66.el6rt.x86_64:# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set
/boot/config-3.8.13-rt14.20.el6rt.x86_64:# CONFIG_NETFILTER_XT_MATCH_ADDRTYPE is not set

Comment 2 Paul Morgan 2013-12-04 11:22:15 EST

please remove this bug from private group. it was marked private initially because it has a hostname in the additional info. i am the original submitter via red hat portal case 00990400. tia.

Comment 3 Karl Hastings 2013-12-05 10:40:30 EST

Removing from private group at customer request.

Comment 4 John Kacur 2013-12-05 17:38:34 EST

Fixed in 3.8.13.13-rt25.29 and above

Comment 9 errata-xmlrpc 2014-01-28 12:41:37 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHSA-2014-0100.html

Note You need to log in before you can comment on or make changes to this bug.