search for: ip_set

...enhancement Priority: P5 Component: default Assignee: netfilter-buglog at lists.netfilter.org Reporter: abora.readynetsolutions at gmail.com I am trying to compile the source code of ipset as iset.c, but I am getting these errors. anand at anand:~/Downloads/IP_SET/ipset-6.29/src$ gcc -I /home/anand/Downloads/IP_SET/ipset-6.29/include -L /home/anand/Downloads/IP_SET/ipset-6.29/lib -o ipset ipset.c -lipset /tmp/ccKT2Q7s.o: In function `help': ipset.c:(.text+0x27c): undefined reference to `ipset_envopts' ipset.c:(.text+0x29f): undefined reference to `ip...

...Platform: x86_64 OS/Version: Ubuntu Status: NEW Severity: major Priority: P5 Component: nft AssignedTo: pablo at netfilter.org ReportedBy: anandrm at gmail.com Estimated Hours: 0.0 I m trying to define a set in file define ip_set = {192.168.1.2, 192.168.2.3} add rule filter output ip daddr $ip_set counter nft -f files/set_anand Segmentation fault (core dumped) On looking into the core file , it appears to be a issue with symbol_bind() where both &sym->list, &scope->symbols to list_add_tail seem to point the...

...t iptables sets to work _after_ a reboot? My question on StackExchange http://unix.stackexchange.com/questions/149536/upon-bootup-all-iptables-are-lost-because-the-kernel-module-ip-set-is-not-loade Some of the things that need to be in place, otherwise iptables does not load: 1.) The kernel module ip_set needs to be loaded. 2.) The "sets" need to be created. 3.) Only after 1 and 2 succeed, dare start up iptables.

https://bugzilla.netfilter.org/show_bug.cgi?id=1139 Bug ID: 1139 Summary: The include guards on the include/libipset/linux_ip_set*.h are wrong Product: ipset Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: enhancement Priority: P5 Component: default Assignee: netfilter-buglog at lists.netfilter.org...

...----- > > -----CentOS 7 kernel-ml-4.14.5-1.el7.elrepo.x86_64 start here----- > [? 116.528885] ------------[ cut here ]------------ > [? 116.528894] WARNING: CPU: 3 PID: 38 at block/blk-mq.c:1144 > __blk_mq_run_hw_queue+0x89/0xa0 > [? 116.528898] Modules linked in: intel_cstate(-) ip_set_hash_ip ip_set > nfnetlink x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul > ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd > intel_rapl_perf pcspkr nfsd auth_rpcgss nfs_acl lockd grace sunrpc > ip_tables ext4 mbcache jbd2 xen_netfront xen_blkfront crc32...

I've just started experimenting with ipset under CentOS 6, and have found what appears to be a bug (or poor design) in the init scripts for ipset, /etc/rc.d/init.d/ipset In stop(), save() and status(), it does lsmod to check for the existence of the ip_set module. If the module is not found, it exits without performing any action. This doesn't take account of a kernel where the ip_set code is compiled in instead of being a loadable module. An example would be my CentOS 6 virtual machine at Linode. It has a Linode-compiled kernel 4.1.0 with no se...

...Version: 2.2.8 Platform: x86_64 OS/Version: RedHat Linux Status: NEW Severity: major Priority: P2 Component: default AssignedTo: kadlec@netfilter.org ReportedBy: bugzilla.netfilter@neufeind.net Using current versions: ip_set/ipt_set-parts from iptables-1.3.5 (backported - sorry) ip_set/ipt_set-parts from patch-o-matic-ng-20060508 (backported - sorry) ipset-2.2.9-20060508 Unfortunately I had to use ipset on a stock CentOS 4.3-kernel (which is 2.6.9-34.0.1.EL with iptables 1.2.1-somepatchlevel as of writing). So I did b...

...ct_police cls_basic cls_flow cls_fw cls_u32 sch_tbf sch_prio sch_htb sch_hfsc sch_ingress sch_sfq xt_CHECKSUM ipt_rpfilter xt_statistic xt_CT xt_LOG xt_time xt_connlimit xt_realm xt_addrtype xt_comment xt_recent xt_policy xt_nat ipt_ULOG ipt_REJECT ipt_MASQUERADE ipt_ECN ipt_CLUSTERIP ipt_ah xt_set ip_set nf_nat _tftp nf_nat_snmp_basic nf_conntrack_snmp nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp nf_conntrack_tftp nf_conntrack_sip nf_conntrack_proto_udplite nf_conntrack_proto_sctp nf_conntrack_pptp nf_ conntrack_proto_gre nf_conntrack_netlink nf_conntrack_netbios_ns nf_...

...-1.el6.elrepo.x86_64 end here----- -----CentOS 7 kernel-ml-4.14.5-1.el7.elrepo.x86_64 start here----- [ 116.528885] ------------[ cut here ]------------ [ 116.528894] WARNING: CPU: 3 PID: 38 at block/blk-mq.c:1144 __blk_mq_run_hw_queue+0x89/0xa0 [ 116.528898] Modules linked in: intel_cstate(-) ip_set_hash_ip ip_set nfnetlink x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd intel_rapl_perf pcspkr nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables ext4 mbcache jbd2 xen_netfront xen_blkfront crc32c_intel [ 116.5...

...a ubuntu vm but in that case just after the fault the guest reboots itself. What could be the problem here? Any help is very appreciated. Thanks, Daniel [ 77.538312] general protection fault: 0000 [#1] SMP [ 77.539235] Modules linked in: ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink vboxpci(OE) vboxnetadp(OE) vboxnetflt(OE) ebtable_broute bridge stp llc ebtable_filter ebtable_nat ebtables ip6table_mangle ip6table_security ip6table_raw ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_filter ip6_tables iptable_mangle iptable_security iptable_raw iptab...

...-----CentOS 7 kernel-ml-4.14.5-1.el7.elrepo.x86_64 start here----- >> [? 116.528885] ------------[ cut here ]------------ >> [? 116.528894] WARNING: CPU: 3 PID: 38 at block/blk-mq.c:1144 >> __blk_mq_run_hw_queue+0x89/0xa0 >> [? 116.528898] Modules linked in: intel_cstate(-) ip_set_hash_ip ip_set >> nfnetlink x86_pkg_temp_thermal coretemp crct10dif_pclmul crc32_pclmul >> ghash_clmulni_intel pcbc aesni_intel crypto_simd glue_helper cryptd >> intel_rapl_perf pcspkr nfsd auth_rpcgss nfs_acl lockd grace sunrpc >> ip_tables ext4 mbcache jbd2 xen_netfront xe...

...cls_flow cls_fw cls_u32 sch_tbf sch_prio sch_htb sch_hfsc sch_ingress sch_sfq bridge stp llc xt_statistic xt_time xt_connlimit xt_realm iptable_raw xt_comment xt_recent xt_policy ipt_ULOG ipt_REJECT ipt_REDIRECT ipt_NETMAP ipt_MASQUERADE ipt_ECN ipt_ecn ipt_CLUSTERIP ipt_ah ipt_addrtype xt_set ip_set nf_nat_tftp nf_nat_snmp_basic nf_conntrack_snmp nf_nat_sip nf_nat_pptp nf_nat_proto_gre nf_nat_irc nf_nat_h323 nf_nat_ftp nf_nat_amanda ts_kmp nf_conntrack_amanda nf_conntrack_sane nf_conntrack_tftp nf_conntrack_sip nf_conntrack_proto_udplite nf_conntrack_proto_sctp nf_conntrack_pptp nf_conntra...

...6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nf_tables_set nft_chain_nat_ipv6 nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 nft_chain_route_ipv6 nft_chain_nat_ipv4 nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack nft_chain_route_ipv4 ip6_tables nft_compat ip_set nf_tables nfnetlink sunrpc bochs_drm drm_vram_helper ttm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops drm i2c_piix4 pcspkr crct10dif_pclmul crc32_pclmul joydev ghash_clmulni_intel ip_tables xfs libcrc32c sd_mod sg ata_generic ata_piix virtio_net libata crc32c_intel net_failover fail...

...e backtrace is as follows: [ 32.304666] ------------[ cut here ]------------ [ 32.304679] kernel BUG at arch/x86/kernel/paravirt.c:252! [ 32.304683] invalid opcode: 0000 [#1] SMP [ 32.304687] Modules linked in: ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtabl...

...ble_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ip_tables rfcomm snd_usb_audio snd_usbmidi_lib snd_rawmidi ccm libcrc32c ip_set nfnetlink cmac bnep sunrpc vfat fat wacom hid_multitouch dell_rbtn iTCO_wdt iTCO_vendor_support sof_pci_dev snd_sof_intel_hda_common snd_sof_intel_hda snd_sof_intel_byt snd_sof_intel_ipc snd_sof snd_sof_xtensa_dsp snd_soc_skl x86_pkg_temp_thermal intel_powerclamp snd_soc_hdac_hda coretemp snd_hda_e...

...pt from our latest: Xen: 4.1.4 (xenbits @ 23432) Dom0: 3.7.1-x86_64 BUG: unable to handle kernel NULL pointer dereference at 000000000000001c IP: [<ffffffff8141a301>] evtchn_from_irq+0x11/0x40 PGD 0 Oops: 0000 [#1] SMP Modules linked in: ebt_comment ebt_arp ebt_set ebt_limit ebt_ip6 ebt_ip ip_set_hash_net ip_set ebtable_nat xen_gntdev bonding ebtable_filter igb CPU 0 Pid: 1636, comm: netback/0 Not tainted 3.7.1-x86_64 #1 Supermicro X9DRi-LN4+/X9DR3-LN4+/X9DRi-LN4+/X9DR3-LN4+ RIP: e030:[<ffffffff8141a301>] [<ffffffff8141a301>] evtchn_from_irq+0x11/0x40 RSP: e02b:ffff88004334fc...

...tun bridge stp llc xt_tcpudp ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ip6table_nat nf_nat_ipv6 ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat_ipv4 nf_nat iptable_mangle iptable_raw iptable_security nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 ip_set nfnetlink ip6table_filter ip6_tables iptable_filter dm_service_time rpcrdma sunrpc rdma_ucm rdma_cm configfs iw_cm ib_cm mlx4_ib ib_uverbs ib_core pkey ghash_s390 prng aes_s390 des_s390 des_generic sha512_s390 sha1_s390 zcrypt_cex4 zcrypt rng_core eadm_sch sch_fq_codel ip_tables x_tables mlx4_en ml...

...omponent: nft AssignedTo: pablo at netfilter.org ReportedBy: devkid at devkid.net Estimated Hours: 0.0 Created attachment 436 --> https://bugzilla.netfilter.org/attachment.cgi?id=436 Example nft rules that make nft crash with SIGSEGV Using more than 253 IPs in a: define ip_set = { <IP1>, <IP2>, ... } causes a SIGSEGV in nft. Attached is an example that causes the crash. (random 254 IP addresses) -- Configure bugmail: https://bugzilla.netfilter.org/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are watching all bug changes.

...ll) [ 377.521746] IP: [<ffffffff813510a7>] asn1_ber_decoder+0x327/0xd30 [ 377.525865] PGD 9c6ea067 PUD 66831067 PMD 0 [ 377.529043] Oops: 0000 [#1] SMP [ 377.531454] Modules linked in: ext4 mbcache jbd2 loop ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set nfnetlink ebtable_nat ebtable_broute bridge stp llc ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack iptable_mangle iptable_security iptable_raw ebtable_filter ebtabl...

http://bugzilla.netfilter.org/show_bug.cgi?id=773 Summary: iptables performance limits on # of rules using ipset Product: ipset Version: unspecified Platform: All OS/Version: All Status: NEW Severity: enhancement Priority: P5 Component: default AssignedTo: netfilter-buglog at lists.netfilter.org