Home » Mailing list archives » linux-netdev » 2009 » March » 24

Re: netfilter spurious ELOOP

Previous thread: Siemens Award Notification by Siemens News Center on Tuesday, March 24, 2009 - 4:08 pm. (1 message)

Next thread: [PATCH 15/61] net: struct device - replace bus_id with dev_name(), dev_set_name() by Greg Kroah-Hartman on Tuesday, March 24, 2009 - 5:26 pm. (5 messages)
[view original message]
From: David Miller
Subject: Re: netfilter spurious ELOOP
Date: Tuesday, March 24, 2009 - 4:28 pm

From: Francis Dupont <Francis.Dupont@fdupont.fr>
Date: Wed, 25 Mar 2009 00:02:05 +0100

--


[ message continues ]
[view original message]
From: Patrick McHardy
Subject: Re: netfilter spurious ELOOP
Date: Wednesday, March 25, 2009 - 10:07 am

Just to clarify: does the problem happens when you have the MARK rule
above in a user-defined chain that has more then one jump leading to
it or does it also happen in other cases?
--


[ message continues ]
[view original message]
From: Francis Dupont
Subject: Re: netfilter spurious ELOOP
Date: Wednesday, March 25, 2009 - 10:37 am

=> I triggered the bug with a real world example:
 - first add a rule with a MARK target using a set mark with the first/sign
  bit set to one. This target is coded with this mark put at the same
  place than the verdict field of standard targets. (note this should
  be triggered by a lot of targets but I got it with MARK)
 - try to add another rule (with -A or -I but this works too with restore,
  the idea is to get a replace ioctl with an illegal value in a verdict
  position).
 - if you are (un?)lucky you get the ELOOP error.

If you read my proposed fix the problem is pretty easy to understand.
I asked diff to give enough context for human (i.e., more than needed
to apply it as a patch).

Thanks

Francis_Dupont@isc.org

PS: I really need a bug-ticket-etc number because some business is implied
(BTW IMHO you prefer to get the report once and by the most direct path,
don't you?)
PPS: here I've cut & paste the config I used to track the bug:

-------------------------------- save file --------------------------------
# Generated by iptables-save v1.4.2 on Tue Mar 24 18:54:43 2009
COMMIT
# Completed on Tue Mar 24 18:54:43 2009
# Generated by iptables-save v1.4.2 on Tue Mar 24 18:54:43 2009
-A PREROUTING -d 10.0.200.2/32 -p tcp -m tcp --dport 5001 -j MARKOUT1 
-A MARKOUT1 -j MARK --set-xmark 0x80000001/0xffffffff 
-A MARKOUT1 -j CONNMARK --save-mark --nfmask 0x3fffffff --ctmask 0x3fffffff 
-A MARKOUT1 -j ACCEPT 
COMMIT
# Completed on Tue Mar 24 18:54:43 2009
-------------------------------- cut here  --------------------------------

I got the bug with the UDP counterpart:

iptables -t mangle -A PREROUTING -d 10.0.200.2/32 -p udp --dport 5001 \
-j MARKOUT1
--


[ message continues ]
[view original message]
From: Patrick McHardy
Subject: Re: netfilter spurious ELOOP
Date: Wednesday, March 25, 2009 - 11:12 am

I'm not a service center, sorry :) Feel free to create an entry in
the netfilter bugzilla, I'll mark it resolved once the patch is

Thanks, that answers my question. I'll apply your patch and send it to
-stable once its in the mainline kernel.
--


[ message continues ]
[view original message]
From: Patrick McHardy
Subject: Re: netfilter spurious ELOOP
Date: Wednesday, March 25, 2009 - 11:38 am

The same bug was also present in ip6_tables and arp_tables.
This is the patch I've committed:



[ message continues ]
Previous thread: Siemens Award Notification by Siemens News Center on Tuesday, March 24, 2009 - 4:08 pm. (1 message)

Next thread: [PATCH 15/61] net: struct device - replace bus_id with dev_name(), dev_set_name() by Greg Kroah-Hartman on Tuesday, March 24, 2009 - 5:26 pm. (5 messages)