exception fault in garbage collection

[f34rdotcom]

I have not built a new version of the helper library if that has changed let me know.

Simple test script to reproduce

!/usr/bin/python

import pprint
import iptc

for chain in iptc.Table(iptc.Table.NAT).chains:
print vars(chain)

table = iptc.Table(iptc.Table.NAT)
inp = iptc.Chain(table, "eth1_masq")

for r in inp.rules:
print "S:", r.src, "-> D:", r.dst

---- iptables in place to test

Generated by iptables-save v1.4.13 on Fri Apr 12 09:32:29 2013

*raw
:PREROUTING ACCEPT [57:5024]
:OUTPUT ACCEPT [42:5188]
COMMIT

Completed on Fri Apr 12 09:32:29 2013

Generated by iptables-save v1.4.13 on Fri Apr 12 09:32:29 2013

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
:Drop - [0:0]
:Reject - [0:0]
:all2all - [0:0]
:dmz12all - [0:0]
:dropBcast - [0:0]
:dropInvalid - [0:0]
:dropNotSyn - [0:0]
:dynamic - [0:0]
:eth0_fwd - [0:0]
:eth0_in - [0:0]
:eth0_out - [0:0]
:eth1_fwd - [0:0]
:eth1_in - [0:0]
:eth1_out - [0:0]
:fw2dmz1 - [0:0]
:fw2loc1 - [0:0]
:loc12dmz1 - [0:0]
:loc12fw - [0:0]
:logdrop - [0:0]
:logreject - [0:0]
:net12dmz2 - [0:0]
:reject - [0:0]
:shorewall - [0:0]
:smurfs - [0:0]
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -j eth0_in
-A INPUT -i eth1 -j eth1_in
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j Reject
-A INPUT -j LOG --log-prefix "Shorewall:INPUT:REJECT:" --log-level 6
-A INPUT -j reject
-A FORWARD -i eth0 -j eth0_fwd
-A FORWARD -i eth1 -j eth1_fwd
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -j Reject
-A FORWARD -j LOG --log-prefix "Shorewall:FORWARD:REJECT:" --log-level 6
-A FORWARD -j reject
-A OUTPUT -o lo -j ACCEPT
-A OUTPUT -o eth0 -j eth0_out
-A OUTPUT -o eth1 -j eth1_out
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -j Reject
-A OUTPUT -j LOG --log-prefix "Shorewall:OUTPUT:REJECT:" --log-level 6
-A OUTPUT -j reject
-A Drop -p tcp -m tcp --dport 113 -j reject
-A Drop -j dropBcast
-A Drop -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A Drop -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A Drop -j dropInvalid
-A Drop -p udp -m multiport --dports 135,445 -j DROP
-A Drop -p udp -m udp --dport 137:139 -j DROP
-A Drop -p udp -m udp --sport 137 --dport 1024:65535 -j DROP
-A Drop -p tcp -m multiport --dports 135,139,445 -j DROP
-A Drop -p udp -m udp --dport 1900 -j DROP
-A Drop -p tcp -j dropNotSyn
-A Drop -p udp -m udp --sport 53 -j DROP
-A Reject -p tcp -m tcp --dport 113 -j reject
-A Reject -j dropBcast
-A Reject -p icmp -m icmp --icmp-type 3/4 -j ACCEPT
-A Reject -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A Reject -j dropInvalid
-A Reject -p udp -m multiport --dports 135,445 -j reject
-A Reject -p udp -m udp --dport 137:139 -j reject
-A Reject -p udp -m udp --sport 137 --dport 1024:65535 -j reject
-A Reject -p tcp -m multiport --dports 135,139,445 -j reject
-A Reject -p udp -m udp --dport 1900 -j DROP
-A Reject -p tcp -j dropNotSyn
-A Reject -p udp -m udp --sport 53 -j DROP
-A all2all -m state --state RELATED,ESTABLISHED -j ACCEPT
-A all2all -j Reject
-A all2all -j LOG --log-prefix "Shorewall:all2all:REJECT:" --log-level 6
-A all2all -j reject
-A dmz12all -m state --state RELATED,ESTABLISHED -j ACCEPT
-A dmz12all -j Drop
-A dmz12all -j LOG --log-prefix "Shorewall:dmz12all:DROP:" --log-level 6
-A dmz12all -j DROP
-A dropBcast -d 255.255.255.255/32 -j DROP
-A dropBcast -d 224.0.0.0/4 -j DROP
-A dropInvalid -m state --state INVALID -j DROP
-A dropNotSyn -p tcp -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A eth0_fwd -m state --state INVALID,NEW -j dynamic
-A eth0_fwd -o eth0 -j ACCEPT
-A eth0_fwd -o eth1 -j all2all
-A eth0_in -m state --state INVALID,NEW -j dynamic
-A eth0_in -j all2all
-A eth0_out -j all2all
-A eth1_fwd -m state --state INVALID,NEW -j dynamic
-A eth1_fwd -o eth0 -j net12dmz2
-A eth1_fwd -o eth1 -j ACCEPT
-A eth1_in -m state --state INVALID,NEW -j dynamic
-A eth1_in -j all2all
-A eth1_out -j all2all
-A fw2dmz1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fw2dmz1 -j ACCEPT
-A fw2loc1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A fw2loc1 -j ACCEPT
-A loc12dmz1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc12dmz1 -j ACCEPT
-A loc12fw -m state --state RELATED,ESTABLISHED -j ACCEPT
-A loc12fw -j ACCEPT
-A logdrop -j LOG --log-prefix "Shorewall:logdrop:DROP:" --log-level 6
-A logdrop -j DROP
-A logreject -j LOG --log-prefix "Shorewall:logreject:REJECT:" --log-level 6
-A logreject -j reject
-A net12dmz2 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A net12dmz2 -d 1.1.1.1/32 -p tcp -m tcp --dport 53 -j ACCEPT
-A net12dmz2 -p tcp -m tcp --dport 25 -j ACCEPT
-A net12dmz2 -p tcp -m tcp --dport 80 -j ACCEPT
-A net12dmz2 -j all2all
-A reject -d 255.255.255.255/32 -j DROP
-A reject -d 224.0.0.0/4 -j DROP
-A reject -s 255.255.255.255/32 -j DROP
-A reject -s 224.0.0.0/4 -j DROP
-A reject -p igmp -j DROP
-A reject -p tcp -j REJECT --reject-with tcp-reset
-A reject -p udp -j REJECT --reject-with icmp-port-unreachable
-A reject -p icmp -j REJECT --reject-with icmp-host-unreachable
-A reject -j REJECT --reject-with icmp-host-prohibited
-A smurfs -s 255.255.255.255/32 -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6
-A smurfs -s 255.255.255.255/32 -j DROP
-A smurfs -s 224.0.0.0/4 -j LOG --log-prefix "Shorewall:smurfs:DROP:" --log-level 6
-A smurfs -s 224.0.0.0/4 -j DROP
COMMIT

Completed on Fri Apr 12 09:32:29 2013

Generated by iptables-save v1.4.13 on Fri Apr 12 09:32:29 2013

*mangle
:PREROUTING ACCEPT [95:7000]
:INPUT ACCEPT [87:4968]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [81:12832]
:POSTROUTING ACCEPT [79:12712]
:tcfor - [0:0]
:tcout - [0:0]
:tcpost - [0:0]
:tcpre - [0:0]
-A PREROUTING -j tcpre
-A FORWARD -j tcfor
-A OUTPUT -j tcout
-A POSTROUTING -j tcpost
COMMIT

Completed on Fri Apr 12 09:32:29 2013

Generated by iptables-save v1.4.13 on Fri Apr 12 09:32:29 2013

*nat
:PREROUTING ACCEPT [8:2032]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [1:60]
:POSTROUTING ACCEPT [1:40]
:eth1_masq - [0:0]
:net1_dnat - [0:0]
-A PREROUTING -i eth1 -j net1_dnat
-A POSTROUTING -o eth1 -j eth1_masq
-A eth1_masq -s 10.10.0.0/16 -j SNAT --to-source 1.2.3.4
-A eth1_masq -s 10.10.0.1/32 -j SNAT --to-source 1.2.3.4
-A net1_dnat -p tcp -m tcp --dport 53 -j DNAT --to-destination 1.1.1.1
COMMIT

Completed on Fri Apr 12 09:32:29 2013

---

gdb results

Starting program: /usr/bin/python test2.py
{'table': <iptc.ip4tc.Table object at 0x7ffff3d50810>, 'name': 'PREROUTING'}
{'table': <iptc.ip4tc.Table object at 0x7ffff3d50810>, 'name': 'INPUT'}
{'table': <iptc.ip4tc.Table object at 0x7ffff3d50810>, 'name': 'OUTPUT'}
{'table': <iptc.ip4tc.Table object at 0x7ffff3d50810>, 'name': 'POSTROUTING'}
{'table': <iptc.ip4tc.Table object at 0x7ffff3d50810>, 'name': 'eth1_masq'}
{'table': <iptc.ip4tc.Table object at 0x7ffff3d50810>, 'name': 'net1_dnat'}
S: 10.10.0.0/255.255.0.0 -> D: 0.0.0.0/0.0.0.0
S: 10.10.0.1/255.255.255.255 -> D: 0.0.0.0/0.0.0.0

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff6e96d08 in ?? () from /lib/libc.so.6
(gdb) bt
#0 0x00007ffff6e96d08 in ?? () from /lib/libc.so.6
#1 0x00007ffff6e9a38c in free () from /lib/libc.so.6
#2 0x00007ffff7aadb6b in ?? () from /usr/lib/libpython2.7.so.1.0
#3 0x00007ffff7acc774 in ?? () from /usr/lib/libpython2.7.so.1.0
#4 0x00007ffff7aaf37b in PyDict_Clear () from /usr/lib/libpython2.7.so.1.0
#5 0x00007ffff7aaf4d9 in ?? () from /usr/lib/libpython2.7.so.1.0
#6 0x00007ffff7b4aa77 in ?? () from /usr/lib/libpython2.7.so.1.0
#7 0x00007ffff7b4b414 in PyGC_Collect () from /usr/lib/libpython2.7.so.1.0
#8 0x00007ffff7b3be26 in Py_Finalize () from /usr/lib/libpython2.7.so.1.0
#9 0x00007ffff7b4971a in Py_Main () from /usr/lib/libpython2.7.so.1.0
#10 0x00007ffff6e4401d in __libc_start_main () from /lib/libc.so.6
#11 0x0000000000400621 in _start ()

(gdb)

[ldx]

The helper library has also changed a few days ago - can you pull and rebuild?

[ldx]

Closing as there has been no feedback for >month. Please test with the latest version and reopen if the problem still persists.