parse_port undefined when using libipt_tcp.so directly

[wayne]

Binary package hint: iptables

When running ipac-ng and specifying the following rule

Outgoing|ipac~i|eth0|tcp|0/0|<ip address>||
I get the following error.
Couldn't load match `tcp':/lib/iptables/libipt_tcp.so: undefined symbol: parse_port

When changing the rule as follows the error doesn't exist.
Outgoing|ipac~i|eth0|all|0/0|<ip address>||

So its all about specifying the connection type.
This did not exist in 1.3.5.0debian1-1ubuntu2 but shows up in 1.3.6.0debian1-5ubuntu2.

I am calling this a security vulnerability because it breaks shorewall and then you
get people like me not noticing that they have no firewall for the weekend.

[Soren Hansen (soren)]

I took a quick peek at the code in Edgy and the current code, and from what I could see, it seems that the parse_port function was included in each of the dependent iptables modules in 1.3.5 (the version in Edgy), but was moved to iptables.c in 1.3.6 (the current version). So, when you're using iptables directly, everything is fine, but when using the libraries directly, parse_port is nohwere to be found. The easy fix is to add parse_port to ipac-ng, but I need to check with upstream to see why this was done.

[Soren Hansen (soren)]

I'm on it.

[wayne (wayne-flashmedia)]

K, stupid me. This doesn't affect shorewall. My startup script is as follows.
# start the firewall
shorewall_start () {
  echo -n "Starting \"Shorewall firewall\": "
  wait_for_pppd
  $SRWL start >> $INITLOG 2>&1 && echo "done." || echo_notdone
  /usr/sbin/fetchipac -S
  return 0
}
 and so I was getting the error on startup.

[Soren Hansen (soren)]

iptables does not export the parse_port symbol anymore, so ipac-ng should not try to use it.

[Clint Byrum (clint-fewbar)]

Thanks to everyone who reported/looked at this issue. ipac-ng is no longer included in any supported release of Ubuntu, so closing this as Won't Fix.