RHEL 5.2 iptable 添加ipp2p模块封迅雷等(未解决启用layer7后系统迅速死机)

*未完全解决！ 启用iptables -A FORWARD -m layer7 --l7proto qq 不到本分钟系统必定死机。

-----------RHEL5.2----------------
安装时没安装xen(否则安装xen后的uname -r是2.6.18-92.el5xen)，没安装gcc
------------
rpm-build-4.4.2-48.el5.i386.rpm
安装完rpm-build后/usr/src/才会生成一个文件夹redhat，否则没有且也不能使用rpmbuild命令
------------
安装gcc
cpp-4.1.2-42.el5.i386.rpm     
gcc-4.1.2-42.el5.i386.rpm     
libgcc-4.1.2-42.el5.i386.rpm
glibc-2.5-24.i386.rpm         
libgomp-4.1.2-42.el5.i386.rpm
glibc-common-2.5-24.i386.rpm  
glibc-devel-2.5-24.i386.rpm   
glibc-headers-2.5-24.i386.rpm 
-----------
redhat-rpm-config-8.0.45-24.el5.noarch.rpm
-------编译内核时用到------
ncurses-5.5-24.20060715.i386.rpm
ncurses-devel-5.5-24.20060715.i386.rpm
------------
开始安装----------
1.内核版本检查
[root@seker SRPMS]# uname -a
Linux seker 2.6.18-92.el5 #1 SMP Tue Jun 10 18:49:47 EDT 2008 i686 i686 i386 GNU/Linux
RPM 源码包下载 要选择和OS内核一致的. 地址
2.下载对应源码包
[root@seker SRPMS]# ls
kernel-2.6.18-92.el5.src.rpm
[root@seker SRPMS]# pwd
/usr/src/redhat/SRPMS
3.解开rpm源码包
[root@seker SRPMS]# useradd mockbuild
[root@seker SRPMS]# rpm -ivh kernel-2.6.18-92.el5.src.rpm
   1:kernel                 ################ [100%]
[root@seker SRPMS]#
[root@seker SPECS]# pwd
/usr/src/redhat/SPECS
[root@seker SPECS]# ls
kernel-2.6.spec
[root@seker SPECS]# rpmbuild -bp --target=$(uname -m) ./kernel-2.6.spec
Building target platforms: i686
Building for target i686
.....
+ exit 0
[root@seker kernel-2.6.18]# pwd
/usr/src/redhat/BUILD/kernel-2.6.18
[root@seker kernel-2.6.18]# ls
config  Config.mk  linux-2.6.18.i686  vanilla  xen
4.将内核源代码cp到 /usr/src目录
[root@seker kernel-2.6.18]#  cp -a linux-2.6.18.i686/ /usr/src/
[root@seker kernel-2.6.18]#  cd /usr/src/linux-2.6.18.i686
5.修改makefile头与OS上的内核相同
[root@seker linux-2.6.18.i686]# head -n4 Makefile
VERSION = 2
PATCHLEVEL = 6
SUBLEVEL = 18
EXTRAVERSION = -92.el5
[root@seker linux-2.6.18.i686]# uname -r
2.6.18-92.el5
6.下载各种软件
patch-o-matic-ng-20080918.tar.bz2
iptables-1.3.8.tar.bz2
l7-protocols-2008-04-23.tar.gz
ipp2p-0.99.15.tar.gz
netfilter-layer7-v2.9.tar.gz
7.解压软件包
[root@seker src]# tar jxvf patch-o-matic-ng-20080918.tar.bz2
[root@seker src]# tar jxvf iptables-1.3.8.tar.bz2
[root@seker src]# tar zxvf l7-protocols-2008-04-23.tar.gz
[root@seker src]# tar zxvf ipp2p-0.99.15.tar.gz
[root@seker src]# tar zxvf netfilter-layer7-v2.9.tar.gz
8.设置环境变量.下载补丁
[root@seker patch-o-matic-ng-20080918]# export KERNEL_DIR=/usr/src/linux-2.6.18.i686/
[root@seker patch-o-matic-ng-20080918]# export IPTABLES_DIR=/usr/src/iptables-1.3.8/
[root@seker patch-o-matic-ng-20080918]# export KERNEL_SRC=/usr/src/linux-2.6.18.i686/
[root@seker patch-o-matic-ng-20080918]# export IPTABLES_SRC=/usr/src/iptables-1.3.8/
[root@seker patch-o-matic-ng-20080918]#
[root@seker patch-o-matic-ng-20080918]# ./runme --download
.....
Successfully downloaded external patch connlimit
Successfully downloaded external patch ipp2p
Successfully downloaded external patch time
Excellent! Source trees are ready for compilation.
自带的IPP2P不要安装..我们用最新的.到这里下载.

[root@seker patch-o-matic-ng-20080918]# ./runme time
[root@seker patch-o-matic-ng-20080918]# ./runme connlimit
9.安装l7
[root@seker linux-2.6.18.i686]# patch -p1 < /usr/src/netfilter-layer7-v2.9/kernel-2.6.18-2.6.19-layer7-2.9.patch
[root@seker iptables-1.3.8]# patch -p1 < /usr/src/netfilter-layer7-v2.9/iptables-layer7-2.9.patch
[root@seker iptables-1.3.8]# chmod +x extensions/.layer7-test
10.编辑内核选上新添加的模块
#这里要注意gcc和ncurses了，如果没安装会报错。
#我是终端访问linux，记住把屏幕放大
#如果之前曾经编译过，需要先执行 make mrproper 。make oldconfig会自动对比之前的kernel config，根据之前版本的配置生成一个kernel config，这样方便我们在编译新核心的时候，无须在从头修改所有的核心设置）
[root@seker linux-2.6.18.i686]# make menuconfig
  Networking  --->  
    Networking options  --->
Network packet filtering (replaces ipchains)  --->
                IP: Netfilter Configuration  --->
                    Layer 7 match support (EXPERIMENTAL)
                    TIME match support
                    Connections/IP limit match support
[root@seker linux-2.6.18.i686]# make modules_prepare
11.备份原来的Makefile，里面包含了原始的编译信息，直接编译会无法通过
[root@seker linux-2.6.18.i686]# mv net/ipv4/netfilter/Makefile net/ipv4/netfilter/Makefile.bak
创建新的Makefile
[root@seker linux-2.6.18.i686]# vi net/ipv4/netfilter/Makefile
obj-m := ipt_connlimit.o
obj-m := ipt_time.o
obj-m := ipt_layer7.o
KDIR := /lib/modules/$(shell uname -r)/build
PWD   := $(shell pwd)
default:
    $(MAKE) -C $(KDIR) M=$(PWD) modules
然后编译该模块,如果不能一次全部编译,每次在net/ipv4/netfilter/Makefile中只加一个模块,一次次编
译得出 ipt_*.ko文件.
[root@seker linux-2.6.18.i686]# make M=net/ipv4/netfilter/
LD      net/ipv4/netfilter/built-in.o
CC [M] net/ipv4/netfilter/ipt_connlimit.o
CC      net/ipv4/netfilter/ipt_connlimit.mod.o
LD [M] net/ipv4/netfilter/ipt_connlimit.ko
  CC      net/ipv4/netfilter/ipt_time.mod.o
  LD [M]  net/ipv4/netfilter/ipt_time.ko
12.cp新编译的模块到老内核
[root@seker linux-2.6.18.i686]# cp net/ipv4/netfilter/ipt_time.ko /lib/modules/2.6.18-92.el5/kernel/net/ipv4/netfilter/
[root@seker linux-2.6.18.i686]# cp net/ipv4/netfilter/ipt_layer7.ko /lib/modules/2.6.18-92.el5/kernel/net/ipv4/netfilter/
[root@seker linux-2.6.18.i686]# cp net/ipv4/netfilter/ipt_connlimit.ko /lib/modules/2.6.18-92.el5/kernel/net/ipv4/netfilter/
[root@seker linux-2.6.18.i686]# chmod 755 /lib/modules/2.6.18-92.el5/kernel/net/ipv4/netfilter/*.ko
13.安装IPP2P
[root@seker ipp2p-0.99.15]#vi Makefile
更改KERNEL_SRC = /usr/src/linux-2.6.18.i686
更改IPTABLES_SRC = /usr/src/iptables-1.3.8
更改IPTABLES_VERSION = 1.3.8
否则，不能make 或使用iptables命令出现1.3.5信息
[root@seker ipp2p-0.99.15]# make
[root@seker ipp2p-0.99.15]# make install
cp ipt_ipp2p.ko /lib/modules/2.6.18-92.el5/kernel/net/ipv4/netfilter/
cp libipt_ipp2p.so /lib/iptables/
[root@seker ipp2p-0.99.15]# cd /lib/modules/2.6.18-92.el5/
[root@seker ipp2p-0.99.15]# depmod -a
[root@seker ipp2p-0.99.15]# cd -
14.安装新的IPTABLE
[root@seker iptables-1.3.8]# make BINDIR=/sbin LIBDIR=/lib MANDIR=/usr/share/man install
这步成功会有 cp *.so 的日志..
[root@seker iptables-1.3.8]# make BINDIR=/sbin LIBDIR=/lib MANDIR=/usr/share/man install
....
cp extensions/libipt_limit.so /lib/iptables/libipt_limit.so
....
cp extensions/libipt_layer7.so /lib/iptables/libipt_layer7.so
....
cp extensions/libipt_time.so /lib/iptables/libipt_time.so
....
rm libiptc/libip6tc.o libipq/libipq.o libiptc/libip4tc.o
[root@seker iptables-1.3.8]#
======================
15加载模块.
使用下面的命令
modprobe ipt_connlimit
modprobe ipt_time
modprobe ipt_ipp2p
modprobe ipt_layer7
modprobe xt_tcpudp
modprobe ip_tables
[root@rhel152 ipp2p-0.99.15]# lsmod |grep x_tables
x_tables               17349  8 ip_tables,xt_tcpudp,ipt_iprange,ipt_layer7,ipt_ipp2p,ipt_time,ipt_connlimit,ip6_tables
测试！
[root@rhel152 iptables-1.3.8]# iptables -m ipp2p
iptables v1.3.8:
ipp2p-parameter problem: for ipp2p usage type: iptables -m ipp2p --help
Try `iptables -h' or 'iptables --help' for more information.
测试通过！
安装L7协议文件
[root@rhel152 iptables-1.3.8]# cd ..
[root@rhel152 src]# cd l7-protocols-2008-04-23
[root@rhel152 l7-protocols-2008-04-23]# make install
mkdir -p /etc/l7-protocols
cp -R * /etc/l7-protocols
[root@rhel152 l7-protocols-2008-04-23]# cd
[root@rhel152 ~]#
测试
[root@demo ~]#iptables -A FORWARD -m layer7 --l7proto qq  -m time --timestart 8:00 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri -m iprange --src-range 192.168.1.5-192.168.1.239 -m ipp2p --ipp2p -m ipp2p --xunlei -j DROP
[root@demo ~]#iptables -A FORWARD -m layer7 --l7proto qq  -m time --timestart 8:00 --timestop 17:30 --days Mon,Tue,Wed,Thu,Fri -m iprange --src-range 192.168.1.5-192.168.1.239 -m ipp2p --ipp2p -m ipp2p --xunlei -j DROP
[root@demo ~]#iptables -I FORWARD -s 192.168.1.15 -p tcp --syn --dport 80 -m connlimit --connlimit-above 3 --connlimit-mask 24 -j DROP
OK！
[root@rhel152 ~]# iptables -xnL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination        
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination        
DROP       tcp  --  192.168.1.15         0.0.0.0/0           tcp dpt:80 flags:0x17/0x02 #conn/24 > 3
DROP       all  --  0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto qq TIME from 8:0 to 17:30 on Mon,Tue,Wed,Thu,Fri source IP range 192.168.1.5-192.168.1.239 ipp2p v0.99.15 --ipp2p ipp2p v0.99.15 --xunlei
DROP       all  --  0.0.0.0/0            0.0.0.0/0           LAYER7 l7proto qq TIME from 8:0 to 17:30 on Mon,Tue,Wed,Thu,Fri source IP range 192.168.1.5-192.168.1.239 ipp2p v0.99.15 --ipp2p ipp2p v0.99.15 --xunlei
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination        

 

原文