Re: tc-ipt v0.2: Extension does not know id 1504083504

Re: tc-ipt v0.2: Extension does not know id 1504083504

[Sergey K.]

> Funny, I just ran into this too and subscribed here to report it. The
> error occurs during parsing of any options to the jump target; if the
> target has no options, there is no error.
>
> The problem seems to be an outdated version of struct xtables_target in
> include/xtables.h. The version in iptables has an additional member
> "udata" that makes the offsets in the struct different for anything
> following.
>
> A quick fix for this particular problem is to copy include/xtables.h from:
> git://git.netfilter.org/iptables
> ...into include/ in the iproute2 source, then recompile after a 'make
> clean'.
>
> As for a comprehensive fix, I don't know--presumably other headers in
> include/ may be out of date, but I don't want to just blindly send a
> patch unless someone who knows the ramifications says it's ok. This
> seems like it would need maintainer oversight. If there's something I
> can do, though, let me know.
>
>-Corey

Hi Corey.

I did it on your recommendation, replaced xtables.h file from my
version of iptables 1.6.0, and replaced the file netfilter.h.

Now it's works, but new construction doesn't:

# tc filter add dev eth0 parent ffff: u32 match u32 0 0 action xt -j
SET --map-set WORLD_QoS dst
xt: unrecognized option '--map-set'
failed to find target (null)

bad action parsing
parse_action: bad value (6:xt)!
Illegal "action"

my ipset chain:
# ipset -L WORLD_QoS
Name: WORLD_QoS
Type: hash:ip
Revision: 4
Header: family inet hashsize 1024 maxelem 65536 skbinfo
Size in memory: 96
References: 1
Members:

------------------------------------------------

If I will try to execute:

# tc filter add dev eth0 parent ffff: u32 match u32 0 0 action xt -j SET

tc-ipt v0.2: You must specify either `--add-set' or `--del-set' or `--map-set'

it looks like it possible to use this construction.

Is it possible?

Re: tc-ipt v0.2: Extension does not know id 1504083504

[Corey Hickey]

On 2017-10-01 07:25, Sergey K. wrote:
> Hi Corey.
> 
> I did it on your recommendation, replaced xtables.h file from my
> version of iptables 1.6.0, and replaced the file netfilter.h.
> 
> Now it's works, but new construction doesn't:
> 
> # tc filter add dev eth0 parent ffff: u32 match u32 0 0 action xt -j
> SET --map-set WORLD_QoS dst
> xt: unrecognized option '--map-set'
> failed to find target (null)

I looked into this for a bit, and it seems to be due to the SET 
extension not supporting the x6-style options (I don't know the proper 
name for it).

 From the iptables source:

$ grep -c x6 extensions/libxt_MARK.c
9

$ grep -c x6 extensions/libxt_SET.c
0

I got lost in gdb for a while and didn't come up with an easy answer. 
The options in are in the struct, just not where tc is looking.

(gdb) print *m->extra_opts
$3 = {name = 0x7ffff6f1dad8 "add-set", has_arg = 1, flag = 0x0, val = 49}

(gdb) print *(m->extra_opts+4)
$7 = {name = 0x7ffff6f1db03 "map-set", has_arg = 1, flag = 0x0, val = 53}


I don't know if the problem is in iptables or in tc. Somebody familiar 
with the code and its history could probably answer it easily, but I'm 
not at all familiar with it. Sorry. Hopefully somebody else will jump in 
and help you out.

-Corey

Re: tc-ipt v0.2: Extension does not know id 1504083504

[Corey Hickey]

On 2017-09-29 23:34, Sergey K. wrote:
> Hello.
> 
> I have to apply this patch
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git/commit/?h=v4.10.0&id=97a02cabefb2e2dcfe27f89943709afa84be5525
> 
> to my version of iproute2.
> But now I have a new information message, when I'm using construction like this:
> 
> tc filter add dev eth0 parent ffff: u32 match u32 0 0 action xt -j
> MARK --set-mark 0
> 
> message text:
> tc-ipt v0.2: Extension does not know id 1504083504
> 
> 
> I'm using Debian Stretch, kernel 4.9.0-3-amd64, iptables 1.6.0 and
> patched iproute 4.9.0
> 
> How to solve?

Funny, I just ran into this too and subscribed here to report it. The 
error occurs during parsing of any options to the jump target; if the 
target has no options, there is no error.

The problem seems to be an outdated version of struct xtables_target in 
include/xtables.h. The version in iptables has an additional member 
"udata" that makes the offsets in the struct different for anything 
following.

A quick fix for this particular problem is to copy include/xtables.h from:
git://git.netfilter.org/iptables
...into include/ in the iproute2 source, then recompile after a 'make 
clean'.

As for a comprehensive fix, I don't know--presumably other headers in 
include/ may be out of date, but I don't want to just blindly send a 
patch unless someone who knows the ramifications says it's ok. This 
seems like it would need maintainer oversight. If there's something I 
can do, though, let me know.

-Corey

tc-ipt v0.2: Extension does not know id 1504083504

[Sergey K.]

Hello.

I have to apply this patch

https://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git/commit/?h=v4.10.0&id=97a02cabefb2e2dcfe27f89943709afa84be5525

to my version of iproute2.
But now I have a new information message, when I'm using construction like this:

tc filter add dev eth0 parent ffff: u32 match u32 0 0 action xt -j
MARK --set-mark 0

message text:
tc-ipt v0.2: Extension does not know id 1504083504


I'm using Debian Stretch, kernel 4.9.0-3-amd64, iptables 1.6.0 and
patched iproute 4.9.0

How to solve?