Re: [libvirt] [PATCH] net: use newer iptables syntax
On Wed, Mar 27, 2013 at 5:22 PM, Eric Blake <eblake(a)redhat.com> wrote:
On 03/25/2013 09:24 PM, Hu Tao wrote:
> On Mon, Mar 25, 2013 at 08:39:40PM +0100, Stefan Seyfried wrote:
>> Hi all,
>>
>> iptables-1.4.18 removed the long deprecated "state" match.
>> Use "conntrack" instead in forwarding rules.
>> Fixes openSUSE bug https://bugzilla.novell.com/811251 #811251.
>>
>> real patch is attached as I'm pretty sure that thunderbird will mess it
>> up otherwise :(
>>
>> Basically it's
>>
>> s/--match state/--match conntrack/
>> s/--state /--ctstate/
>
> This is supported by old iptables. (tested with 1.4.14)
The real question is RHEL 5, which shipped with iptables 1.3.5. But
there, I see this in the man page:
Reality is that this interface really relies on the nf-conntrack
module, which RHEL 5 doesn't have. The older variant that RHEL 5 does
have is xt_conntrack. I know from personal experience that its broken
on IPv6 on RHEL5. But what changed between the two I don't remember.
The backend providing the information was changed in the early 2.6.2x
series, which is what I believe the change is related to.
The reason why --state was removed from iptables 1.4.18 is that Linux
3.7 removed the corresponding kernel module. I'd hope that an older
iptables running on a newer kernel would report an error with trying
to use --state but with past experience with netfilter it a lot of
times features you ask for result in a no-op when the kernel doesn't
support it by the userland does.
This might require a bit more finesse with the detection and choosing
whether to use --conntrack or --state for RHEL 5 era systems.
--
Doug Goldstein