Bug 232838 - iptstate doesn't work on kernel 2.6.20-1.2925.fc6
iptstate doesn't work on kernel 2.6.20-1.2925.fc6
Product: Fedora
Classification: Fedora
Component: iptstate (Show other bugs)
All Linux
medium Severity urgent
: ---
: ---
Assigned To: Thomas Woerner
Depends On: 210324
  Show dependency treegraph
Reported: 2007-03-18 13:42 EDT by Eric Hopper
Modified: 2008-01-08 08:36 EST (History)
3 users (show)

See Also:
Fixed In Version: iptstate-2.2.1-1.fc7
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-01-08 08:36:25 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Compatibility mode extension (4.81 KB, patch)
2007-03-22 12:49 EDT, Tomas Hoger
no flags Details | Diff

  None (edit)
Description Eric Hopper 2007-03-18 13:42:52 EDT
Description of problem:
This program no longer displays any information at all.

Version-Release number of selected component (if applicable):

How reproducible:
Every time

Steps to Reproduce:
1.Try to use it while having connection tracking loaded
Actual results:
Nothing shows up

Expected results:
A list of the tracked connections

Additional info:
This program is going for /proc/net/ip_conntrack and in kernel 2.6.20-1.2925.fc6
(and possibly earlier) this file does not exist.  Instead the file
/proc/net/nf_conntrack is used.

Also, in kernel 2.6.20-1.2925.fc6 /proc/net/nf_conntrack may contain IPv6
information, and I do not know if iptstat yet has the code to handle this at
all, much less display the IPv6 information.
Comment 1 Eric Hopper 2007-03-18 13:51:46 EDT
It's urgent for this package anyway, as it won't work at all with newer kernels
until it's fixed.
Comment 2 Eric Hopper 2007-03-18 23:25:53 EDT
Version 2.2.0 was just released today.  It fixes this problem (and several
others) completely, though it still doesn't show IPv6 states.  It likely will in
a future version though.
Comment 3 Tomas Hoger 2007-03-19 05:46:47 EDT
Latest verions of iptstate seems to prefer using libnetfilter_conntrack to
direct access to /proc files.  However:

- libnetfilter_conntrack is in Extras
- iptstate requires libnetfilter_conntrack version 0.0.50 or later (FC6 extras
contain 0.0.31)
Comment 4 Tomas Hoger 2007-03-20 03:54:23 EDT
libnetfilter_conntrack was updated to 0.0.50 in FC6 extras.  Thanks to Paul P.
Komkoff Jr.
Comment 5 Eric Hopper 2007-03-20 08:59:15 EDT
You mentioned this, but it seems to me that it bears more explicit mention...

libnetfilter_conntrack needs to be moved into core, or iptstate needs to move
into extras.  The situation where iptstate is in Core in a library it depends on
is in Extras isn't OK.
Comment 6 Tomas Hoger 2007-03-20 15:39:21 EDT
Core vs. Extras should no longer be an issue for FC7.

For FC6 and older, it may be possible to compile ipstate with deprecated
"backwards compatability proc mode", but it won't solve ip_conntrack vs.
nf_conntrack issue, as file path is hardcoded (#define-d) in source.
Comment 7 Tomas Hoger 2007-03-22 12:49:13 EDT
Created attachment 150674 [details]
Compatibility mode extension

Attached patch extends iptstate compatibility mode in following ways:

- adds simple runtime detection of ip_conntrack vs. nf_conntrack
- fixes parsing of nf_conntrack file

Works for me, testers are welcome of course ;).
Comment 8 Will Woods 2007-05-16 12:12:53 EDT
Core+Extras have merged for F7, so F7 will get iptables-2.2.x as an update
shortly after release. 

iptables 2.1 has been built for FC6 - you can get test packages here:

Please give those a try and see if they fix your problem.
Comment 9 Warren Togami 2007-05-16 14:07:07 EDT
wwoods and I talked on IRC after this message.  We have subsequently decided
that iptstate can be updated prior to F7, but you need to get working build done
within the next 12 hours or so.
Comment 10 Tomas Hoger 2007-05-18 05:19:16 EDT
New version for FC6 seems to work with latest kernels, but it does *not* provide
solution to the original problem.  That problem was resolved by newer kernels,
which again provide /proc/net/ip_conntrack file besides /proc/net/nf_conntrack.

As a result, on latest FC6 kernels (tested with 2.6.20-1.2948.fc6), both old
(iptstate-1.4- and new (iptstate-2.1-1) versions of iptstate work.  On
kernels with nf_conntrack only (e.g. kernel-2.6.20-1.2933.fc6), both versions fail.

If ip_conntrack is back to stay, I guess there's no urgent need to push new
iptstate to FC6.  And if ip_conntrack is going to disappear again soon, new
version will not help.
Comment 11 Till Maas 2008-01-08 08:36:25 EST
iptstate works on Fedora 7 and older releases are not supported anymore,
therefore I close this bug.

Note You need to log in before you can comment on or make changes to this bug.