Re: iptables-1.8.11 review

On Thu, 2025-09-11 at 23:14 -0500, Randy McMurchy wrote:
> Hi all,
> 
> I was a bit surprised to see iptables still in the BLFS book. I tried to 
> look
> back in the -dev archives to see why nftables is not in the book, but I 
> really
> couldn't find anything other than 5 years ago Bruce could not get in 
> touch with
> DJ so nftables (and its dependencies) were archived. There's really nothing
> useful in the -dev archives since then that I could find.
> 
> But that's not what I'm writing about. I noticed there are many flaws in the
> iptables instructions. I will point them out, and if agreed that changes 
> need
> to be made to the instructions, I can submit a patch. This has nothing to do
> with configuring a firewall, my aim is pointing out mistakes in the install
> instructions only.
> 
> First, the Note at the beginning is not applicable any longer unless perhaps
> it is referring to the bpf-utils optional dependency which I did not install
> as it seems complicated and the package is unmaintained. Documentation
> on the
> netfilter.org web site and in the INSTALL file clearly states that using raw
> kernel headers is no longer required. Anything it needs now comes from
> /usr/include/linux.
> 
> Second, and this could be because I deviated from the book (yes, I know,
> that's why I'm writing in -support instead of -dev). The configure command
> I used is as follows:
> 
> ./configure --prefix=/usr --enable-libipq --enable-nfsynproxy  \
>              --enable-bpf-compiler --sysconfdir=/etc
> 
> Note the last sysconfdir entry. My installation installed 
> /etc/ethertypes and
> if you don't specify the sysconfdir, the file ends up in /usr/etc/. Note 
> that
> I also removed the --disable-nftables option.
> 
> Third, the package now ships a fairly intensive test suite. It must be
> run by
> root, and the /etc/ethertypes file needs to be installed before the 
> tests are
> run. The shipped ethertypes file is in the etc directory of the source tree.
> 
> Here is some output from the tests using the command:
> grep -Ev ': OK|[OK]|^make' test.log
> 
> =============================================================
> Making check in libiptc
> Making check in libxtables
> Making check in include
> Making check in libipq
> Making check in utils
> Making check in extensions
> Making check in iptables
> ./extensions/generic.txlate: Fail
> 
> ./extensions/generic.txlate: Fail
> 
> ./extensions/generic.txlate: Fail
> 
> ./extensions/generic.txlate: Fail
> 
> 85 test files, 450 tests, 446 tests passed, 0 tests failed, 4 errors
> FAIL: xlate-test.py
> legacy: 123 test files, 1693 unit tests, 1691 passed
> 
> nft: 144 test files, 2002 unit tests, 2000 passed
> total: 144 test files, 3695 unit tests, 3691 passed
> FAIL: iptables-test.py
> 
> W: [FAILED] 
> ././iptables/tests/shell/testcases/iptables/0008-unprivileged_0: 
> expected 0 but got 131
> W: [FAILED] 
> ././iptables/tests/shell/testcases/iptables/0008-unprivileged_0: 
> expected 0 but got 131
> FAIL: iptables/tests/shell/run-tests.sh
> ===================
> 3 of 3 tests failed
> ===================
> =============================================================
> 
> Fourth, it probably wouldn't hurt to expand just a bit the
> --disable-nftables "Command Explanation". Maybe say something like
> "Remove this switch if you have installed nftables and desire the
> compatibility layer."

I'll take a look at first and third.  For second IMO we can just say
something like "also add --sysconfdir=/etc if you use this switch" for -
-disable-nftables explanation.

I'm unsure if we should just replace iptables with nftables as I heard
from many resources that it's supposed to be a replacement.

-- 
Xi Ruoyao <[email protected]>

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-support
Unsubscribe: See the above information page