When running a 64-bit kernel with a 32-bit iptables binary, the size of the xt_nfacct_match_info struct diverges. kernel: sizeof(struct xt_nfacct_match_info) : 40 iptables: sizeof(struct xt_nfacct_match_info)) : 36 Trying to append nfacct related rules results in an unhelpful message. Although it is suggested to look for more information in dmesg, nothing can be found there. # iptables -A <chain> -m nfacct --nfacct-name <acct-object> iptables: Invalid argument. Run `dmesg' for more information. This patch fixes the memory misalignment by enforcing 8-byte alignment within the struct's first revision. This solution is often used in many other uapi netfilter headers.
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -11,4 +11,9 @@ struct xt_nfacct_match_info { · 10 unmodified lines | ||
| 11 | 11 | struct nf_acct *nfacct; |
| 12 | 12 | }; |
| 13 | 13 | |
| 14 | +struct xt_nfacct_match_info_v1 { | |
| 15 | + char name[NFACCT_NAME_MAX]; | |
| 16 | + struct nf_acct *nfacct __attribute__((aligned(8))); | |
| 17 | +}; | |
| 18 | + | |
| 14 | 19 | #endif /* _XT_NFACCT_MATCH_H */ |