lkml.org 
[lkml]   [2005]   [Dec]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: Linux 2.6.14.5
    On Tue, Dec 27, 2005 at 04:42:00PM +1100, Grant Coady wrote:
    > On Tue, 27 Dec 2005 06:17:29 +0100, Willy Tarreau <willy@w.ods.org> wrote:
    >
    > >On Tue, Dec 27, 2005 at 02:06:03PM +1100, Grant Coady wrote:
    > >> On Mon, 26 Dec 2005 16:53:27 -0800, Greg KH <gregkh@suse.de> wrote:
    > >>
    > >> >We (the -stable team) are announcing the release of the 2.6.14.5 kernel.
    > >> >
    > >> >The diffstat and short summary of the fixes are below.
    > >> >
    > >> >I'll also be replying to this message with a copy of the patch between
    > >> >2.6.14.4 and 2.6.14.5, as it is small enough to do so.
    > >>
    > >> netfilter is broken compared to 2.6.15-rc7 (first 2.6 kernel tested
    > >> on this box) or 2.4.32 :( Same ruleset as used for months.
    > >>
    > >> Fails to recognise named chains with a useless error message:
    > >>
    > >> "iptables: No chain/target/match by that name"
    > >
    > >Grant, please put a "set -x" at the top of your script so that you
    > >can tell what rule causes this error.
    >
    > + iptables -A INPUT -p all --match state --state ESTABLISHED,RELATED -j ACCEPT
    > iptables: No chain/target/match by that name

    So it's not only the NEW state, it's every "--match state".

    > + iptables -A INPUT -p tcp --match state --state NEW --dport ftp --match limit --limit 3/min -j ACCEPT
    > iptables: No chain/target/match by that name
    > + iptables -A INPUT -p tcp --match state --state NEW --dport ftp -j DROP
    > iptables: No chain/target/match by that name
    > + iptables -A INPUT -p tcp --match state --state NEW --dport http --match limit --limit 12/min -j ACCEPT
    > iptables: No chain/target/match by that name
    > + iptables -A INPUT -p tcp --match state --state NEW --dport http -j DROP
    > iptables: No chain/target/match by that name
    > FORWARD + iptables -A FORWARD -p all --match state --state ESTABLISHED,RELATED -j ACCEPT
    > iptables: No chain/target/match by that name
    > + iptables -A egress -p tcp --match state --state NEW --match multiport --dports ftp,http,pop3,nntp,pop3s -j ACCEPT
    > iptables: No chain/target/match by that name
    > + iptables -A egress -p tcp --match state --state NEW --match multiport --dports https,rsync -j ACCEPT
    > iptables: No chain/target/match by that name
    > + iptables -A egress -p all --match state --state NEW --match limit --limit 12/min -j ACCEPT
    > iptables: No chain/target/match by that name

    Thanks,
    Willy

    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-12-27 06:48    [W:0.026 / U:1.180 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site