Bug 178962 - iptables failing in the ROUTE target (missing libipt_ROUTE.so)
iptables failing in the ROUTE target (missing libipt_ROUTE.so)
Status: CLOSED UPSTREAM
Product: Fedora
Classification: Fedora
Component: kernel (Show other bugs)
5
i686 Linux
medium Severity medium
: ---
: ---
Assigned To: Dave Jones
Brian Brock
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-01-25 14:41 EST by João Mauricio de O. Alves
Modified: 2015-01-04 17:24 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2006-10-21 02:47:12 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description João Mauricio de O. Alves 2006-01-25 14:41:36 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (X11; U; Linux i686; pt-BR; rv:1.7.12) Gecko/20050922 Fedora/1.0.7-1.1.fc4 Firefox/1.0.7

Description of problem:
   It is impossible to use the ROUTE target in the mangle table, with Fedora Core 4. The file /lib/iptables/libipt_ROUTE.so is missing.

   It seems a recurring problem since the new RPM file, iptables-1.3.4-2.1.i386.rpm, found at http://download.fedora.redhat.com/pub/fedora/linux/core/test/4.91/i386/os/Fedora/RPMS/ does not have the file either.

   The iptables sources found at netfilter site have the file. 
http://www.netfilter.org/projects/iptables/files/iptables-1.3.0.tar.bz2
http://www.netfilter.org/projects/iptables/files/iptables-1.3.4.tar.bz2

   Is this by design? I don't think so since the man pages contain information about the ROUTE target for mangle table.
<man>
ROUTE
    This is used to explicitly override the core network stack's routing decision.  mangle table.

       --oif ifname
              Route the packet through 'ifname' network interface

       --iif ifname
              Change the packet's incoming interface to 'ifname'

       --gw IP_address
              Route the packet via this gateway

       --continue
              Behave like a non-terminating target and continue traversing the rules.  Not valid in combination with '--iif' or '--tee'

       --tee  Make a copy of the packet, and route that copy to the given destination. For the original, uncopied packet, behave like a  non-
              terminating target and continue traversing the rules.  Not valid in combination with '--iif' or '--continue'
</man>


   However the iptables command aways returns an error if you try to use the --gw option, for instance.

Version-Release number of selected component (if applicable):
iptables-1.3.0-2

How reproducible:
Always

Steps to Reproduce:
1. install iptables
2. iptables -t mangle -A POSTROUTING -s 10.10.20.3 -j ROUTE --gw 10.10.20.1
  

Actual Results:  iptables v1.3.0: Unknown arg `--gw'
Try `iptables -h' or 'iptables --help' for more information.


Expected Results:  The iptables rule should be added

Additional info:

I tried to use other chains or options related to mangle table (--oif, --iif, etc)  and I found the same problem.

The file /lib/libipt_ROUTE.so is missing from the iptables RPM.
Comment 1 Thomas Woerner 2006-01-26 08:14:00 EST
There is no ipt_ROUTE support in the kernel and in glibc-kernheaders.

Assigning to kernel for now.

Please assign to glibc-kernheaders as soon as ipt_ROUTE made it into the kernel.
Comment 2 Bill Rugolsky, Jr. 2006-01-26 10:12:52 EST
Just a note to perhaps help the original poster work around the issue.

I've been patching ipt_ROUTE into iptables for a long time.  Unfortunately, at
least in the past, the iptables tarball did not include appropriate kernel
headers.  Some versions of the Fedora iptables SRPMs (e.g.,
iptables-1.3.2-1.src.rpm) have included the machinery necessary to bundle the
header files in the SRPMS, and use those instead of glibc-kernheaders.  By
replacing the headers, e.g., netfilter-2.4.20.tar.gz, with a new set of headers
such as netfilter-2.6.15.1.tar.gz generated from Patch-o-Matic, and,
incidentally, adding -D__user= to the compilation options (OPT), the package
should build.  [My iptables-1.3.3 + kernel 2.6.12 package required changing
u8,u16,u32 to their __u8,__u16,__u32 variants, but I recall seeing a patch go
upstream to fix this.]

Be sure to test the new package thoroughly, especially NAT and MANGLE behavior;
I've had several problems with mismatched iptables/kernel interfaces.
Comment 3 João Mauricio de O. Alves 2006-01-26 11:22:40 EST
As I can see now, this is not a minor issue.

I managed to workaround the problem with iproute2. I am still testing the
general solution found at:
http://lartc.org/howto/lartc.rpdb.html
http://lartc.org/howto/lartc.rpdb.multiple-links.html

But it seems to work and we have support for it in Fedora Core 4.

As a suggestion, you could just put a note in the iptables man pages, informing
the users the ROUTE target does not work. I spent some time to figure out that
it was not related to some mistake I did, but some missing feature in the kernel.

We can find many examples on the Internet, using the ROUTE target as a possible
solution. But it is very hard to find a place informing that it is not available
in the RedHat OSes (RHEL, FC).

Thanks for the immediate response.
Comment 4 Dave Jones 2006-02-03 02:07:51 EST
This is a mass-update to all currently open kernel bugs.

A new kernel update has been released (Version: 2.6.15-1.1830_FC4)
based upon a new upstream kernel release.

Please retest against this new kernel, as a large number of patches
go into each upstream release, possibly including changes that
may address this problem.

This bug has been placed in NEEDINFO_REPORTER state.
Due to the large volume of inactive bugs in bugzilla, if this bug is
still in this state in two weeks time, it will be closed.

Should this bug still be relevant after this period, the reporter
can reopen the bug at any time. Any other users on the Cc: list
of this bug can request that the bug be reopened by adding a
comment to the bug.

If this bug is a problem preventing you from installing the
release this version is filed against, please see bug 169613.

Thank you.
Comment 5 João Mauricio de O. Alves 2006-02-03 15:00:25 EST
The bug is still active, using the new kernel:

uname -r
2.6.15-1.1830_FC4smp

# iptables -t mangle -A POSTROUTING -s 10.10.20.3 -j ROUTE --gw 10.10.20.1
iptables v1.3.0: Unknown arg `--gw'
Try `iptables -h' or 'iptables --help' for more information.
============================
However, we can workaround the problem using the following solution:
http://lartc.org/howto/lartc.rpdb.html
http://lartc.org/howto/lartc.rpdb.multiple-links.html
http://lists.netfilter.org/pipermail/netfilter/2000-November/006089.html

Comment 6 Dave Jones 2006-09-16 22:44:54 EDT
[This comment added as part of a mass-update to all open FC4 kernel bugs]

FC4 has now transitioned to the Fedora legacy project, which will continue to
release security related updates for the kernel.  As this bug is not security
related, it is unlikely to be fixed in an update for FC4, and has been migrated
to FC5.

Please retest with Fedora Core 5.

Thank you.
Comment 7 João Mauricio de O. Alves 2006-09-20 09:13:57 EDT
The problem is still active:

# uname -r
2.6.17-1.2187_FC5smp

# iptables -t mangle -A POSTROUTING -s 10.10.20.3 -j ROUTE --gw 10.10.20.1
iptables v1.3.5: Unknown arg `--gw'
Try `iptables -h' or 'iptables --help' for more information.

# rpm -qa | grep iptables
iptables-1.3.5-1.2
Comment 8 Dave Jones 2006-10-16 17:43:21 EDT
A new kernel update has been released (Version: 2.6.18-1.2200.fc5)
based upon a new upstream kernel release.

Please retest against this new kernel, as a large number of patches
go into each upstream release, possibly including changes that
may address this problem.

This bug has been placed in NEEDINFO state.
Due to the large volume of inactive bugs in bugzilla, if this bug is
still in this state in two weeks time, it will be closed.

Should this bug still be relevant after this period, the reporter
can reopen the bug at any time. Any other users on the Cc: list
of this bug can request that the bug be reopened by adding a
comment to the bug.

In the last few updates, some users upgrading from FC4->FC5
have reported that installing a kernel update has left their
systems unbootable. If you have been affected by this problem
please check you only have one version of device-mapper & lvm2
installed.  See bug 207474 for further details.

If this bug is a problem preventing you from installing the
release this version is filed against, please see bug 169613.

If this bug has been fixed, but you are now experiencing a different
problem, please file a separate bug for the new problem.

Thank you.
Comment 9 Dave Jones 2006-10-21 02:47:12 EDT
This needs to get upstream first.

Note You need to log in before you can comment on or make changes to this bug.