[libvirt] [PATCH] net: use newer iptables syntax

[Doug Goldstein]

On Wed, Mar 27, 2013 at 5:22 PM, Eric Blake <eblake at redhat.com> wrote:
> On 03/25/2013 09:24 PM, Hu Tao wrote:
>> On Mon, Mar 25, 2013 at 08:39:40PM +0100, Stefan Seyfried wrote:
>>> Hi all,
>>>
>>> iptables-1.4.18 removed the long deprecated "state" match.
>>> Use "conntrack" instead in forwarding rules.
>>> Fixes openSUSE bug https://bugzilla.novell.com/811251 #811251.
>>>
>>> real patch is attached as I'm pretty sure that thunderbird will mess it
>>> up otherwise :(
>>>
>>> Basically it's
>>>
>>>      s/--match state/--match conntrack/
>>>      s/--state /--ctstate/
>>
>> This is supported by old iptables. (tested with 1.4.14)
>
> The real question is RHEL 5, which shipped with iptables 1.3.5.  But
> there, I see this in the man page:

Reality is that this interface really relies on the nf-conntrack
module, which RHEL 5 doesn't have. The older variant that RHEL 5 does
have is xt_conntrack. I know from personal experience that its broken
on IPv6 on RHEL5. But what changed between the two I don't remember.
The backend providing the information was changed in the early 2.6.2x
series, which is what I believe the change is related to.

The reason why --state was removed from iptables 1.4.18 is that Linux
3.7 removed the corresponding kernel module. I'd hope that an older
iptables running on a newer kernel would report an error with trying
to use --state but with past experience with netfilter it a lot of
times features you ask for result in a no-op when the kernel doesn't
support it by the userland does.

This might require a bit more finesse with the detection and choosing
whether to use --conntrack or --state for RHEL 5 era systems.

-- 
Doug Goldstein