lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 10 Jan 2007 08:56:55 +0100 From: Patrick McHardy <kaber@...sh.net> To: Linus Torvalds <torvalds@...l.org> CC: Tomasz Kvarsin <kvarsin@...il.com>, "David S. Miller" <davem@...emloft.net>, bunk@...sta.de, Linux Kernel Mailing List <linux-kernel@...r.kernel.org>, netfilter@...ts.netfilter.org, netfilter-devel@...ts.netfilter.org Subject: Re: 2.6.20-rc4: regression: iptables failed to load rules Linus Torvalds wrote: > > On Tue, 9 Jan 2007, Tomasz Kvarsin wrote: > >>During boot into 2.6.20-rc4 iptables says >>iptables-restore: line 15 failed. >>And works fine with my default kernel: 2.6.18.x > > > I bet you enabled the new transport-agnostic netfilter, and didn't enable > some of the actual rules needed for your iptables setup (they have new > config names). > > I do think that the netfilter team has been very irritating in changing > the config names, even if it "is logical". > > Somebody should stop the madness, and tell people what config options they > need for a regular iptables setup like this. Rather than say "just compile > everything". There's about a million different filters, and they all > depend on one infrastructure or another. > > And then the networking people should F*NG STOP that config name changing > madness! The config names should match the _usage_, not some > implementation detail. And failing that, leave the config options named > something illogical, as long as people don't have to change their config > file all the time and answer millions of questions that they don't care > about! In the x_tables case it really caused a lot of unnecessary confusion, the recent connection tracking changes however needed new config options since we're keeping the old implementation around for a few more releases. Unfortunately when switching between the two implementations, Kconfig deselects all options depending on either one, even though the dependencies are still fulfilled (f.e. NETFILTER_XT_MATCH_CONNTRACK: depends on IP_NF_CONNTRACK || NF_CONNTRACK), which means you have to select all those options again. It probably won't be necessary anymore to make changes like this in the future, but in case it is I'll make sure to at least provide compatibility options for a few releases. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists