iptables gives input/output error - iptables

Question

I am trying to have iptables-1.4.3.2 work with Linux-2.6.35.9 on our MIPS based platform. The command issued is
iptables -t mangle -A POSTROUTING -p udp -j <TC name> --map tos
iptables exits with input/output error (The same command was working on Linux-2.6.28.8). Then did a strace for the same on our target and seeing problem as below :
socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 3
getsockopt(3, SOL_IP, 0x40 /* IP_??? */, "mangle\0\0\0\0\0\34\200F\0\0\200\1\340 \244\200\1\340\244\200\7W\224\200\7W\f\0"..., [84]) = 0
getsockopt(3, SOL_IP, 0x41 /* IP_??? */, "mangle\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., [976]) = 0
setsockopt(3, SOL_IP, 0x40 /* IP_??? */, "mangle\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1240) = -1 EIO (Input/output error)
close(3) = 0
write(2, "iptables: "..., 10iptables: ) = 10
write(2, "Input/output error"..., 18Input/output error) = 18
write(2, ".\n"..., 2.
) = 2
munmap(0x2ab9b000, 75264) = 0
exit(1)
The above code is in libiptc.c ; Any suggestions to debug the error further would be helpful. Thanks.

Answer 1

EIO means that your custom "TC" target (or whatever it is you meant by it) module, i.e. xt_TC.c, does not adhere to the API. checkentry is not supposed to return values greater than zero (there is no meaning assigned to them) in 2.6.35 and up.

Answer 2

The issue seems to resolve by changing the following lines in linux-2.6.35/net/netfilter/x_tables.c
function xt_check_match:
changed following lines from :
if (par->match->checkentry != NULL) {
ret = par->match->checkentry(par);
if (ret < 0)
return ret;
else if (ret > 0)
{
/* Flag up potential errors. */
return -EIO;
}
}
to :
if (par->match->checkentry != NULL && !par->match->checkentry(par))
return -EINVAL;
Similarly in function xt_check_target : changed lines from:
if (par->target->checkentry != NULL) {
ret = par->target->checkentry(par);
if (ret < 0)
return ret;
else if (ret > 0)
{
/* Flag up potential errors. */
return -EIO;
}
}
to:
if (par->target->checkentry != NULL && !par->target->checkentry(par))
return -EINVAL;
These were the checks present in previous kernels. having the same checks solves the above issue. Thanks.