iptables l7模块安装问题

yxinjian

内核2.6.26
iptables 版本为1.4.1.1
l7 版本为 2.20
内核编译已经成功，但是编译iptables 的时候通不过，报错如下：

libipt_layer7.c: In function `help':
libipt_layer7.c:41: error: `IPTABLES_VERSION' undeclared (first use in this function)
libipt_layer7.c:41: error: (Each undeclared identifier is reported only once
libipt_layer7.c:41: error: for each function it appears in.)
libipt_layer7.c: At top level:
libipt_layer7.c:53: warning: no previous prototype for 'parse_protocol_file'
libipt_layer7.c: In function `parse_protocol_file':
libipt_layer7.c:55: warning: declaration of 'line' shadows a global declaration
../include/iptables.h:15: warning: shadowed declaration is here
libipt_layer7.c: In function `pre_process':
libipt_layer7.c:152: warning: declaration of 'rindex' shadows a global declaration
/usr/include/string.h:308: warning: shadowed declaration is here
libipt_layer7.c: At top level:
libipt_layer7.c:206: warning: no previous prototype for 'readl7dir'
libipt_layer7.c:377: error: variable `layer7' has initializer but incomplete type
libipt_layer7.c:378: error: unknown field `name' specified in initializer
libipt_layer7.c:378: warning: excess elements in struct initializer
libipt_layer7.c:378: warning: (near initialization for `layer7')
libipt_layer7.c:379: error: unknown field `version' specified in initializer
libipt_layer7.c:379: error: `IPTABLES_VERSION' undeclared here (not in a function)
libipt_layer7.c:379: warning: excess elements in struct initializer
libipt_layer7.c:379: warning: (near initialization for `layer7')
libipt_layer7.c:380: error: unknown field `size' specified in initializer
libipt_layer7.c:380: warning: excess elements in struct initializer
libipt_layer7.c:380: warning: (near initialization for `layer7')
libipt_layer7.c:381: error: unknown field `userspacesize' specified in initializer
libipt_layer7.c:381: warning: excess elements in struct initializer
libipt_layer7.c:381: warning: (near initialization for `layer7')
libipt_layer7.c:382: error: unknown field `help' specified in initializer
libipt_layer7.c:382: warning: excess elements in struct initializer
libipt_layer7.c:382: warning: (near initialization for `layer7')
libipt_layer7.c:383: error: unknown field `parse' specified in initializer
libipt_layer7.c:383: warning: excess elements in struct initializer
libipt_layer7.c:383: warning: (near initialization for `layer7')
libipt_layer7.c:384: error: unknown field `final_check' specified in initializer
libipt_layer7.c:384: warning: excess elements in struct initializer
libipt_layer7.c:384: warning: (near initialization for `layer7')
libipt_layer7.c:385: error: unknown field `print' specified in initializer
libipt_layer7.c:385: warning: excess elements in struct initializer
libipt_layer7.c:385: warning: (near initialization for `layer7')
libipt_layer7.c:386: error: unknown field `save' specified in initializer
libipt_layer7.c:386: warning: excess elements in struct initializer
libipt_layer7.c:386: warning: (near initialization for `layer7')
libipt_layer7.c:387: error: unknown field `extra_opts' specified in initializer
libipt_layer7.c:388: warning: excess elements in struct initializer
libipt_layer7.c:388: warning: (near initialization for `layer7')
libipt_layer7.c: In function `libipt_layer7_init':
libipt_layer7.c:392: warning: implicit declaration of function `register_match'
libipt_layer7.c: At top level:
libipt_layer7.c:377: error: storage size of `layer7' isn't known
make[2]: *** [libipt_layer7.oo] Error 1
make[2]: Leaving directory `/usr/src/iptables-1.4.1.1/extensions'
make[1]: *** [all-recursive] Error 1
make[1]: Leaving directory `/usr/src/iptables-1.4.1.1'
make: *** [all] Error 2

已经打了l7 专门针对iptables-1.4.1.1 的补丁，还是报同样的错误！

ssffzz1

内核头文件和IPTABLES源代码文件都对吗？

从现象看是IPTABLES源代码文件没有找到。

yxinjian

应该是对的，补丁都应用成功了！

最开始是找不到 xt_layer7.h
后面我在内核源代码下找到该文件复制到 iptables源目录下
再次编译就报上面的错误

[ 本帖最后由 yxinjian 于 2008-8-29 12:46 编辑 ]

ssffzz1

1、你的操作系统版本？
2、内核头文件在不？
3、IPTABLES源代码在不？，源代码应该是MARK过的。
4、说说你的编译过程，以及各个代码的路径。

yxinjian

原帖由 ssffzz1 于 2008-8-29 13:02 发表
1、你的操作系统版本？
2、内核头文件在不？
3、IPTABLES源代码在不？，源代码应该是MARK过的。
4、说说你的编译过程，以及各个代码的路径。

操作系统是redhat as4 up5
内核和iptables都是刚在网上下载编译的
你说的源代码应该是MARK过的，是什么意思？

编译过程是这样的

先应用内核源代码补丁，编译内核加入l7支持，编译好后用新内核启动成功。
再编译iptables，解压iptables后应用l7 iptables补订，
chmod +x ./extensions/.layer7-test

./configure
make KERNEL_DIR=/usr/src/linux

[ 本帖最后由 yxinjian 于 2008-8-29 14:52 编辑 ]

ssffzz1

换个IPTABLES版本试试。

yxinjian

换成1.3.8 的又报这样的错误


Extensions found: IPv4:CLUSTERIP IPv4:connbytes IPv4:dccp IPv4:layer7 IPv4:NFLOG IPv4:quota IPv4:recent IPv4:statistic IPv4:string IPv6:ah IPv6:esp IPv6:frag IPv6:hashlimit IPv6:ipv6header IPv6:mh IPv6:NFLOG IPv6:REJECT IPv6:rt IPv6:sctp
cc -O2 -Wall -Wunused -I/usr/src/linux-2.6.26.3/include -Iinclude/ -DIPTABLES_VERSION=\"1.3.8\"  -DIPT_MIN_ALIGN=8 -DKERNEL_64_USERSPACE_32 -fPIC -o extensions/libip6t_sctp_sh.o -c extensions/libip6t_sctp.c
In file included from extensions/libip6t_sctp.c:24:
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:68: error: syntax error before "__sctp_chunkmap_is_clear"
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:69: warning: return type defaults to `int'
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h: In function `__sctp_chunkmap_is_clear':
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:73: error: `false' undeclared (first use in this function)
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:73: error: (Each undeclared identifier is reported only once
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:73: error: for each function it appears in.)
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:74: error: `true' undeclared (first use in this function)
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h: At top level:
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:80: error: syntax error before "__sctp_chunkmap_is_all_set"
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:81: warning: return type defaults to `int'
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h: In function `__sctp_chunkmap_is_all_set':
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:85: error: `false' undeclared (first use in this function)
/usr/src/linux-2.6.26.3/include/linux/netfilter/xt_sctp.h:86: error: `true' undeclared (first use in this function)
make: *** [extensions/libip6t_sctp_sh.o] Error 1

ssffzz1

你找和AS4U5 系统自带的那个IPTABLES的版本试试。这个再出问题的话，就不是IPTABLES的原因了。

yxinjian

把l7的模块程序删除就可以正常编译。。。
不知道是哪个地方出了问题，好郁闷！

ssffzz1

L7要和IPTABLES配套的。看看L7的发行文档。是否和IPTABLES配套。