use conntrack instead of state

Bug #1065297 reported by Sławomir Nizio on 2012-10-10
This bug affects 3 people
Affects Status Importance Assigned to Milestone
Jamie Strandboge
Gentoo Linux
ufw (Debian)
Fix Released

Bug Description

iptables says:
WARNING: The state match is obsolete. Use conntrack instead.
when I use -m state. (I think this change was made in 1.4.16.)

I'm attaching a patch which fixes that. Please review it whenever you like.

For the record: tested on, it seems that when I type -m match --match ....., iptables -S gives output as if -m conntrack --ctmatch .... was used. This means that Ufw tests can fail on new enough iptables - even when this patch isn't used.

More about the tests: I've tried the standard tests (./run_tests.sh -s) on a Debian system with iptables v1.4.13 after applying my patch. They failed, and a naïve 's/-m state --state/-m conntrack --ctstate/' under 'tests' directory was enough to make them pass.

Related branches

Sławomir Nizio (snizio) wrote :

Same, but with corrected line wrapping for the manual page.

Fitzcarraldo (fitzcarraldo) wrote :

Confirmed: I am experiencing this bug in Gentoo Linux with ufw-0.33.

However, I downgraded back to ufw-0.31.1 and am still experiencing it, even though I used etc-update to downgrade the config files too.

Sławomir Nizio (snizio) wrote :

Thanks for the confirmation. The problem is not specific to version 0.33, but indeed happens also in 0.31.1, for example.

Sławomir Nizio (snizio) wrote :

Somehow I missed two occurrences. This one should be complete.

Fitzcarraldo (fitzcarraldo) wrote :

I'm still having a problem, even after installing the latest version:

# ufw enable
ERROR: problem running ufw-init
WARNING: The state match is obsolete. Use conntrack instead.
iptables-restore: line 54 failed
WARNING: The state match is obsolete. Use conntrack instead.
ip6tables-restore: line 40 failed

Problem running '/etc/ufw/user/user.rules'
Problem running '/etc/ufw/user/user6.rules'


I have ufw-0.33-r1 re-installed on 6 November 2012 from the Gentoo Portage repository, so it should have S. Nizio's latest patch:

# eix -I ufw
[I] kde-misc/kcm-ufw
     Available versions: (4) (~)0.4.3
        {{aqua debug LINGUAS="en es fr lt"}}
     Installed versions: 0.4.3(4)(09:13:18 22/09/12)(-aqua -debug LINGUAS="en -es -fr -lt")
     Homepage: http://kde-apps.org/content/show.php?content=137789
     Description: KCM module to control the Uncomplicated Firewall

[I] net-firewall/ufw
     Available versions: (~)0.30.1-r2^t[1] (~)0.31.1-r1^t (~)0.33-r1^t {{bash-completion examples ipv6}}
     Installed versions: 0.33-r1^t(17:38:15 06/11/12)(ipv6 -examples)
     Homepage: http://launchpad.net/ufw
     Description: A program used to manage a netfilter firewall

[I] net-firewall/ufw-frontends
     Available versions: (~)0.2.0^m[1] (~)0.3.2
     Installed versions: 0.3.2(09:13:35 22/09/12)
     Homepage: http://code.google.com/p/ufw-frontends/
     Description: Provides graphical frontend to ufw

[1] "local_overlay" /usr/local/portage

Found 3 matches.

Fitzcarraldo (fitzcarraldo) wrote :

Ignore my previous comment (Comment #6). I have just uninstalled the package, deleted all the related files I could find, and re-installed it again. This time it works.

Sławomir Nizio (snizio) wrote :

Yes, old rules (using state) were still there. Deleting all rules and re-adding them should be enough.

Debian bug: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=691135

Also, there is another, related but different change, this time in kernel (commit a9006892643a8f4e885b692de0708bcb35a7d530), that deprecates automatic helper assignment. Background information:
https://home.regit.org/netfilter-en/secure-use-of-helpers/ .

Changed in ufw:
status: New → Triaged
Changed in ufw:
status: Triaged → In Progress
importance: Undecided → Medium
assignee: nobody → Jamie Strandboge (jdstrand)
Jamie Strandboge (jdstrand) wrote :

The patch looks good overall, but get_netfilter_capabilities() needs to be updated and a ton of tests. I am working on that now.

Jamie Strandboge (jdstrand) wrote :

Fix committed to trunk. Thanks for the patch. :)

Changed in ufw:
status: In Progress → Fix Committed
Sławomir Nizio (snizio) wrote :

I'm happy to see that. :) However, please also remember about comment 8, for another change. I don't know if something/what needs to be fixed, but I sometimes get the "Use the iptables CT target to attach helpers instead" message in dmesg (with IPT_MODULES="nf_conntrack_ftp nf_nat_ftp nf_conntrack_netbios_ns").

Changed in ufw (Debian):
status: Unknown → New
Changed in ufw (Debian):
status: New → Fix Committed
Changed in ufw (Debian):
status: Fix Committed → Fix Released
Changed in ufw:
milestone: none → 0.34
Changed in ufw:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.