fix: add base field to xt_option_entry for libxtables >= 1.8.11 - #1
Open
zn-yonib98 wants to merge 1 commit into
Open
fix: add base field to xt_option_entry for libxtables >= 1.8.11#1zn-yonib98 wants to merge 1 commit into
zn-yonib98 wants to merge 1 commit into
Conversation
zn-yonib98
force-pushed
the
fix/xt_option_entry-base-libxtables-1811
branch
from
July 29, 2026 11:09
ece198c to
190104a
Compare
shaimill
reviewed
Jul 29, 2026
|
|
||
| __pkgname__ = "python-iptables" | ||
| __version__ = "1.2.0" | ||
| __version__ = "1.2.0.post1" |
shaimill
approved these changes
Jul 29, 2026
iptables 1.8.11 appended `base` to struct xt_option_entry (48 -> 56 bytes), so
the ctypes _option_lookup stride was 8 bytes short and misread options after the
first (e.g. multiport --dports). append ("base", ct.c_uint) to match, and bump
version to 1.2.0.1.
zn-yonib98
force-pushed
the
fix/xt_option_entry-base-libxtables-1811
branch
from
July 29, 2026 11:56
190104a to
e389c31
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
iptables 1.8.11 appended a field to
struct xt_option_entry(changelog: "Introduce struct xt_option_entry::base"):On 64-bit this grows
sizeof(struct xt_option_entry)from 48 to 56 bytes.iptc/xtables.pystill declares the pre-1.8.11 layout, so_option_lookup()walks each extension'sx6_optionstable with an 8-byte-short stride and reads every option after the first at the wrong offset. Setting--dportson amultiportmatch then fails withno such parameter.Note: the libxtables soname/libtool version was not bumped for this change (
libxtables.so.12.7.0is byte-identical on 1.8.9 and 1.8.11), so the layout change is only visible via the iptables release version.Fix
Append
("base", ct.c_uint)toxt_option_entryso the ctypes layout matches libxtables >= 1.8.11. Version bumped to1.2.0.1.Verification
Built for py2.7 and py3.11; tested on Debian trixie (real
iptables v1.8.11):