IPTCError: can't initialize filter: libiptc version error

[jawr]

Hi, I'm getting an intermittent error when repeatedly calling the following line of code:

chain_name = 'FORWARD'
chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), chain_name)

Here is the traceback:

Traceback (most recent call last):
File "/usr/share/pyshared/flask/app.py", line 1518, in call

File "/usr/share/pyshared/flask/app.py", line 1506, in wsgi_app

File "/usr/share/pyshared/flask/app.py", line 1504, in wsgi_app

File "/usr/share/pyshared/flask/app.py", line 1264, in full_dispatch_request

File "/usr/share/pyshared/flask/app.py", line 1262, in full_dispatch_request

File "/usr/share/pyshared/flask/app.py", line 1248, in dispatch_request

File "/srv/kontrolvm-node/main.py", line 58, in index

File "/srv/kontrolvm-node/tasks/iptables.py", line 29, in check_ip

File "/usr/local/lib/python2.7/dist-packages/iptc/ip4tc.py", line 1306, in init

File "/usr/local/lib/python2.7/dist-packages/iptc/ip4tc.py", line 1342, in refresh

IPTCError: can't initialize filter: libiptc version error

[ldx]

Can you tell me the version/git hash you use?

[jawr]

Hi there, thanks for the quick response! I'm on the latest (b88763c). Also, I'm using Debian 7.0.0 - 3.2.0-3-amd64 with iptables: v1.4.14

It seems that the handle might be going stale or something, as when I repeatedly refresh (call on the chain) it eventually stops updating and then throws the error.

The functions are here: https://github.com/jawr/kontrolvm-node/blob/master/tasks/iptables.py#L28

[ldx]

Can you isolate the code that triggers this problem? I tried this simplistic script:

#!/usr/bin/python

import iptc

while True:
    chain_name = 'FORWARD'
    chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), chain_name)
    print chain.name

but here it works without issues.

[ghost]

I think the problem found in the kernel's modules not enabled, as described in this link:
http://thelinuxtricks.blogspot.de/2013/05/python-iptables-libiptc-version-error.html

The modules are:

• ip_conntrack
• ipt_state

unfortunately in the new kernel the "ip_conntrack" is deprecated and "sudo modprobe ip_conntrack" don't work.

What do you think?

[ldx]

Hi @vinc3nt - the lack/depreciation of a kernel module should not cause any problems as long as the userspace and kernel parts of iptables are in sync. Let me know if you see a specific problem.

[ghost]

Hi @ldx, here is what happens if I try to launch your script:

-> % python2.7                                                    
Python 2.7.4 (default, Apr 19 2013, 18:28:01) 
[GCC 4.7.3] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import iptc
>>> while True:
...     chain_name = 'FORWARD'
...     chain = iptc.Chain(iptc.Table(iptc.Table.FILTER), chain_name)
...     print chain.name
... 
Traceback (most recent call last):
  File "<stdin>", line 3, in <module>
  File "/usr/local/lib/python2.7/dist-packages/iptc/ip4tc.py", line 1306, in __init__
    self.refresh()
  File "/usr/local/lib/python2.7/dist-packages/iptc/ip4tc.py", line 1342, in refresh
    self.strerror()))
iptc.ip4tc.IPTCError: can't initialize filter: libiptc version error
>>> 

I have installed with pip the last version of python-iptables

[ldx]

The error message suggests that you use an old version - can you remove your current install, clone from github, and use the current git HEAD? For me it's been stable for quite some time both on Ubuntu & Debian, and the test script works as expected as well.

[ldx]

No response for months - closing this ticket, feel free to reopen it if the problem still exists.