<html>
<head>
<base href="https://bugzilla.netfilter.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - using the internal lookup table vs. the local system's /etc/services (or so) generally prevents nft from working"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1269#c2">Comment # 2</a>
on <a class="bz_bug_link
bz_status_ASSIGNED "
title="ASSIGNED - using the internal lookup table vs. the local system's /etc/services (or so) generally prevents nft from working"
href="https://bugzilla.netfilter.org/show_bug.cgi?id=1269">bug 1269</a>
from <span class="vcard"><a class="email" href="mailto:d@zaitceff.me" title="D.Zaitceff <d@zaitceff.me>"> <span class="fn">D.Zaitceff</span></a>
</span></b>
<pre>(In reply to Pablo Neira Ayuso from <a href="show_bug.cgi?id=1269#c1">comment #1</a>)
<span class="quote">> Probably better use variables for what you want? eg.
>
> define imap = 143
>
> tcp dport $imap ip daddr X.X.X.X counter dnat Y.Y.Y.Y
>
> So definitions are self-contained?</span >
But it is not the correct side of the problem.
Nevertheless and by the way, look:
gentoo: grep imap /etc/services
imap 143/tcp imap2 # Internet Message Access
Protocol
imap 143/udp imap2
imap3 220/tcp # Interactive Mail Access
imap3 220/udp
imaps 993/tcp # imap4 protocol over TLS/SSL
imaps 993/udp
(Here I assume that Ubuntu is Debian-like)
debian: grep imap /etc/services
imap2 143/tcp imap # Interim Mail Access P 2 and 4
imaps 993/tcp # IMAP over SSL
So, IMAP is always here. But, in Gentoo it is the primary service name, while
in Debian IMAP2 is the primary one and IMAP is an alias. So, at first sight
the problem is the obviously incorrect implementation of the aforementioned
patch - alias names of the services are just forgotten. And so the IMAP name
is lost.
But this first sight is a short sight too. The real problem is not the
implementation, but the whole idea of the patch: to fake the system-level,
well-known and content-volatile database with a hard-coded snapshot of it. And
thus to lose the view of the reality - the actual list of the portnames -
forever...
It is like if one of the SHADOW project's authors decided to hardcode its
current /etc/passwd file into the sources... and just gave up using getpwent()
for the purpose.
/etc/services (or its NIS variant, or hesiod's one or whatever) is the
official, well known, stable, understood, simple, nice etc. database of
mappings between service names and port numbers. And _standard_ API is here.
To reinvent this weel is not just pointless, but also means to surely break the
way the system works.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are watching all bug changes.</li>
</ul>
</body>
</html>