Re: Incorrect usage or bug in ebtables ?

Op do, 26-10-2006 te 15:01 +0200, schreef Francois-Xavier Le Bail:
> Hello,
> 
> Here is my setup :
> - Last ebtables userspace from CVS (at 20061026 date) - v2.0.8-rc2-CVS (March
> 2006)
> - Linux kernel 2.6.17
> 
> I use ebtables :
> - with --ulog to catch, with a daemeon, some frames in filter table, on INPUT
> and OUTPUT chains.
> - then the daemon create, based on analysis of the cached frames, rules like :
>   - ebtables -t filter -I OUTPUT 2 -d 1:2:3:4:5:6 --out-if eth0 -j ACCEPT
>   - ebtables -t filter -D OUTPUT -d 1:2:3:4:5:6 --out-if eth0 -j ACCEPT
>   - ebtables -t filter -I OUTPUT 2 -d 1:2:3:4:5:7 --out-if eth1 -j ACCEPT
>   - ebtables -t filter -D OUTPUT -d 1:2:3:4:5:7 --out-if eth1 -j ACCEPT
> 
> Sometimes the kernel print :
> kernel msg: ebtables bug: please report to author: Wrong nr. of counters
> requested
> kernel msg: ebtables bug: please report to author: Wrong nr of counters
> 
> Sometimes the rule is not inserted, sometimes the rule is not deleted, and then
> the automatic process fail.
> 
> Do I use ebtables incorrectly ? Is this a bug ?

It's not a bug, AFAICT this happens because 2 table updates are done
simultaneously and so only one succeeds gracefully. The workaround is to
do the add/delete again if it failed, or even better: linearize the
add/delete process in userspace so no two ebtables commands are executed
at the same time.
The ebtables table updating scheme assumes no two programs try to alter
the same table simultaneously. If they do, then one alteration might
fail or the rule counters might be wrong.
When updating a table, the userspace program first receives the current
table from the kernel, then updates that copy in userspace and finally
sends the result to the kernel. Between getting the copy from the kernel
and sending the result to the kernel, the kernel's table should not be
updated by another program.
These problems wouldn't exist if the kernel were responsible for
updating the table, instead of the userspace program (using a mutex
inside the kernel would be enough). But that's an old design decision
made for iptables and adopted for ebtables many years ago.
The printed message is misleading, though.

cheers,
Bart



-------------------------------------------------------------------------
Using Tomcat but need to do more? Need to support web services, security?
Get stuff done quickly with pre-integrated technology to make your job easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642