use conntrack instead of state
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
ufw |
Fix Released
|
Medium
|
Jamie Strandboge | ||
Gentoo Linux |
New
|
Undecided
|
Unassigned | ||
ufw (Debian) |
Fix Released
|
Unknown
|
Bug Description
iptables 1.4.16.2 says:
WARNING: The state match is obsolete. Use conntrack instead.
when I use -m state. (I think this change was made in 1.4.16.)
I'm attaching a patch which fixes that. Please review it whenever you like.
For the record: tested on 1.4.16.2, it seems that when I type -m match --match ....., iptables -S gives output as if -m conntrack --ctmatch .... was used. This means that Ufw tests can fail on new enough iptables - even when this patch isn't used.
More about the tests: I've tried the standard tests (./run_tests.sh -s) on a Debian system with iptables v1.4.13 after applying my patch. They failed, and a naïve 's/-m state --state/-m conntrack --ctstate/' under 'tests' directory was enough to make them pass.
Related branches
Changed in ufw: | |
status: | New → Triaged |
Changed in ufw: | |
status: | Triaged → In Progress |
importance: | Undecided → Medium |
assignee: | nobody → Jamie Strandboge (jdstrand) |
Changed in ufw (Debian): | |
status: | Unknown → New |
Changed in ufw (Debian): | |
status: | New → Fix Committed |
Changed in ufw (Debian): | |
status: | Fix Committed → Fix Released |
Changed in ufw: | |
milestone: | none → 0.34 |
Changed in ufw: | |
status: | Fix Committed → Fix Released |
Same, but with corrected line wrapping for the manual page.