Problem with IP-Pools

Problem with IP-Pools

[Markus Schaber]

Hi,

I'm using the IP Pools extension form Patch-O-matic, and now have the
problem that it tends to kill the machine on SMP. (I just killed our
backup firewall two times this day...)

The symptoms are that a "ippools -n blah" with an already existing pool
blah sometimes hangs, eating up more and more processor time, and
the process cannot be killed even with SIGKILL. "shutdown -r" and
"reboot" also refuse to work (they shut down most services, but don't
actually reboot the machine). The machine gets more and more sloppy, and
after about 2 or 3 minutes, it doesn't respond on network and local
serial console.

I suspect there's a race condition on SMP.

I mailed Patrick Schaaf (the creator of the iptables patch), and he said
that he never tested it on SMP, and currently doesn't have time to look
into it.

He pointed me to this list and told me that Joackim Axelsson has a
modified version, but didn't publish it yet.

Can anyone help or reproduce this problem? Is Joackim here?

Thanks,
Markus
-- 
Markus Schaber - http://www.schabi.de/

Schabi's Flohmarkt unter http://schabi.de/flohmarkt

Re: Problem with IP-Pools

[Harald Welte]

[-- Attachment #1: Type: text/plain, Size: 793 bytes --]

On Thu, Nov 28, 2002 at 04:29:21PM +0100, Markus Schaber wrote:
> Hi,
> 
> I'm using the IP Pools extension form Patch-O-matic, and now have the
> problem that it tends to kill the machine on SMP. (I just killed our
> backup firewall two times this day...)

I think the pool stuff is pretty much unmaintained as of now, sorry.
It was a contribution to the project, and the original author (Gerd
Knorr, IIRC) has abandoned it.

> Thanks,
> Markus

-- 
Live long and prosper
- Harald Welte / laforge@sunbeam.franken.de    http://www.sunbeam.franken.de
============================================================================
GCS/E/IT d- s-: a-- C+++ UL++++$ P+++ L++++$ E--- W- N++ o? K- w--- O- M- 
V-- PS+ PE-- Y+ PGP++ t++ 5-- !X !R tv-- b+++ DI? !D G+ e* h+ r% y+(*)

[-- Attachment #2: Type: application/pgp-signature, Size: 232 bytes --]

Re: Problem with IP-Pools

[Markus Schaber]

[-- Attachment #1: Type: text/plain, Size: 1657 bytes --]

Hi,

Harald Welte wrote:

> > I'm using the IP Pools extension form Patch-O-matic, and now have
> > the problem that it tends to kill the machine on SMP. (I just killed
> > our backup firewall two times this day...)
> 
> I think the pool stuff is pretty much unmaintained as of now, sorry.
> It was a contribution to the project, and the original author (Gerd
> Knorr, IIRC) has abandoned it.

Thanks for your information.

That's rather sad, because we have several groups of hosts in our subnet
that have different rules each, and pools are just the most efficient
way to match those groups we found.

You see, we're doing Gigabit ethernet here (about 600 MBit upstream
bandwidth), and our largest host group currently has 9497 Entries.
That's just too much for the usual O(n) method, one table containing one
match rule per host, and building some tree-like tables to cut down the
pass time to O(log(n)) is a maintenance nightmare.

Not to mention the time to load an iptable with some tens of thousands
of entries, we cannot wait half an hour for our firewall to boot up.

Currently, my Boss does real-life testing using single processor
kernels, and it seems that it works using current hardware (although I
don't know yet how it performed during the peak times), and it seems to
manage the traffic and to be rather stable.

If you know another method of managing such high traffic and host number
combinations, we'd love to hear about it, because we _really_ want to
leave Checkpoint.

Markus

-- 
Schabi's Flohmarkt: http://www.uni-ulm.de/~s_mschab/flohmarkt/

Der Dienstweg ist die Verbindung der Sackgasse mit dem Holzweg!
[DoLi in unibwm.studium]

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: Problem with IP-Pools

[Roberto Nibali]

Hello,

> You see, we're doing Gigabit ethernet here (about 600 MBit upstream
> bandwidth), and our largest host group currently has 9497 Entries.
> That's just too much for the usual O(n) method, one table containing one
> match rule per host, and building some tree-like tables to cut down the
> pass time to O(log(n)) is a maintenance nightmare.

I'm in kind of the same situation but I have solved it more or less. Please 
contact me privately so we can discuss about it.

> Not to mention the time to load an iptable with some tens of thousands
> of entries, we cannot wait half an hour for our firewall to boot up.

:) I know that problem. I'm working on a solution myself.

> If you know another method of managing such high traffic and host number
> combinations, we'd love to hear about it, because we _really_ want to
> leave Checkpoint.

I am surprised that checkpoint could handle such a configuration. We had to give 
up on checkpoint long ago because it wasn't able to handle hundreds of different 
NAPT configuration per interface correctly without stumbling over its own 
internal tables.

Just contact me offline so we can discuss things. Regards,
Roberto Nibali, ratz
-- 
echo '[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc

Re: Problem with IP-Pools

[Martin Josefsson]

On Thu, 2002-12-05 at 22:43, Markus Schaber wrote:
> Harald Welte wrote:
>
> > I think the pool stuff is pretty much unmaintained as of now, sorry.
> > It was a contribution to the project, and the original author (Gerd
> > Knorr, IIRC) has abandoned it.

No no, not at all. It's true that the original author (Patrick Shaaf)
doesn't maintain it anymore. Joakim Axelsson found it lacking a lot of
features so he rewrote it into the new ippool. The new ippool is modular
like iptables so you have one module per pool-type. And it actually has
the flush feature.

It has three diffrent pool-types, null (just an skeleton), bitmap and
macipmap (like bitmap but also matches macaddresses).

I use the macipmap pool in three production routers (SMP) here and I've
never had any problems with ippool in them. I only had a few crashes
when I wrote macipmap :)

There are still some things missing, here's the most important ones that
come to mind:
	Need to push the locking down into the pooltypes.
	Implement save/restore functionality.
	And of course more pooltypes :)

The new ippool should be integrated into the netfilter cvs (up to Joakim
to decide) or the old ippool ripped out.
The main things before it could be integrated would be to fix ipt_pool
and ipt_POOL and the iptables userspace parts so they report sensible
errors, not just errorcodes like now.

You can find the current version (0.3.2a) here:

http://gandalf.hjorten.nu/ippool/

(I hope it compiles :)

The kernel part isn't a patch, it's a bunch of loose files you have to
copy and then modify Config.in and Makefile manually.


> Not to mention the time to load an iptable with some tens of thousands
> of entries, we cannot wait half an hour for our firewall to boot up.

ippool won't eliminate the load time yet, still needs the save/restore
functionality (shouldn't be hard to implement at all).
 
> Currently, my Boss does real-life testing using single processor
> kernels, and it seems that it works using current hardware (although I
> don't know yet how it performed during the peak times), and it seems to
> manage the traffic and to be rather stable.
> 
> If you know another method of managing such high traffic and host number
> combinations, we'd love to hear about it, because we _really_ want to
> leave Checkpoint.

nfhipac (I think that was the name) and tc-firewall (Jamal wrote it when
he found out about the O(n) iptables thing) comes to mind, they aren't
O(n), they use binary trees of some kind. I havn't used either of them
so I can't say how well they work and if they are stable.

Would be nice to have some kind of general classification thing in the
kernel (that isn't O(n) but behaves like a linear scan like nfhipac
does) so that with one classification we get both routing, tc, ipsec, 
firewall info. Currently they all do their own classifications...


Good luck.
 
-- 
/Martin

Never argue with an idiot. They drag you down to their level, then beat
you with experience.

Re: Problem with IP-Pools

[Markus Schaber]

[-- Attachment #1: Type: text/plain, Size: 545 bytes --]

Hello,

Martin Josefsson <gandalf@wlug.westbo.se> schrieb:

> You can find the current version (0.3.2a) here:
> 
> http://gandalf.hjorten.nu/ippool/
> 
> (I hope it compiles :)

I tried it with 2.4.20 (no patch-o-matic things applied), and the
compilation failed, outputting the attached error messages.

I didn't have time ot have a closer look yet, but if you have any idea,
or a newer verison available, it would be appreciated.

Thanks,
Markus

-- 
Markus Schaber - http://www.schabi.de/

Schabi's Flohmarkt unter http://schabi.de/flohmarkt

[-- Attachment #2: compile.stderr --]
[-- Type: text/plain, Size: 7296 bytes --]

make -C  kernel CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include /usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/kernel'
make[1]: Für das Target »modules« gibt es nichts zu tun.
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/kernel'
make -C  drivers CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include /usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/drivers'
make -C block modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/block'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/block'
make -C cdrom modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/cdrom'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/cdrom'
make -C char modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/char'
make -C drm modules
make[3]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/char/drm'
make[3]: Für das Target »modules« gibt es nichts zu tun.
make[3]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/char/drm'
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/char'
make -C hotplug modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/hotplug'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/hotplug'
make -C ide modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/ide'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/ide'
make -C media modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/media'
make -C radio modules
make[3]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/media/radio'
make[3]: Für das Target »modules« gibt es nichts zu tun.
make[3]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/media/radio'
make -C video modules
make[3]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/media/video'
make[3]: Für das Target »modules« gibt es nichts zu tun.
make[3]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/media/video'
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/media'
make -C misc modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/misc'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/misc'
make -C net modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/net'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/net'
make -C parport modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/parport'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/parport'
make -C scsi modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/scsi'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/scsi'
make -C sound modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/sound'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/sound'
make -C usb modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/usb'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/usb'
make -C video modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/video'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/video'
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers'
make -C  mm CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include /usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/mm'
make[1]: Für das Target »modules« gibt es nichts zu tun.
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/mm'
make -C  fs CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include /usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/fs'
make[1]: Für das Target »modules« gibt es nichts zu tun.
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/fs'
make -C  net CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include /usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/net'
make -C core modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/net/core'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/net/core'
make -C ipv4 modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/net/ipv4'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/net/ipv4'
make -C ipv4/netfilter modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/net/ipv4/netfilter'
ld -m elf_i386 -r -o ip_conntrack.o ip_conntrack_standalone.o ip_conntrack_core.o ip_conntrack_proto_generic.o ip_conntrack_proto_tcp.o ip_conntrack_proto_udp.o ip_conntrack_proto_icmp.o
ld -m elf_i386 -r -o iptable_nat.o ip_nat_standalone.o ip_nat_rule.o ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o ip_nat_proto_udp.o ip_nat_proto_icmp.o
gcc -D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS -include /usr/src/pool/linux-2.4.20/include/linux/modversions.h  -nostdinc -iwithprefix include -DKBUILD_BASENAME=ip_pool  -DEXPORT_SYMTAB -c ip_pool.c
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/net/ipv4/netfilter'
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/net'

Re: Problem with IP-Pools

[Markus Schaber]

[-- Attachment #1: Type: text/plain, Size: 26503 bytes --]

Hi,

Sorry, it seems that I attached the wrong error message, the correct one
follows below:

make -C  kernel CFLAGS="-D__KERNEL__
-I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes
-Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer
-pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS
-include /usr/src/pool/linux-2.4.20/include/linux/modversions.h"
MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/kernel'
make[1]: Für das Target »modules« gibt es nichts zu tun.
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/kernel'
make -C  drivers CFLAGS="-D__KERNEL__
-I/usr/src/pool/linux-2.4.20/include -Wall -Wstrict-prototypes
-Wno-trigraphs -O2 -fno-strict-aliasing -fno-common -fomit-frame-pointer
-pipe -mpreferred-stack-boundary=2 -march=i686 -DMODULE -DMODVERSIONS
-include /usr/src/pool/linux-2.4.20/include/linux/modversions.h"
MAKING_MODULES=1 modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/drivers'
make -C block modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/block'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/block'
make -C cdrom modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/cdrom'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/cdrom'
make -C char modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/char'
make -C drm modules
make[3]: Entering directory
`/usr/src/pool/linux-2.4.20/drivers/char/drm'
make[3]: Für das Target »modules« gibt es nichts zu tun.
make[3]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/char/drm'
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/char'
make -C hotplug modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/hotplug'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/hotplug'
make -C ide modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/ide'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/ide'
make -C media modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/media'
make -C radio modules
make[3]: Entering directory
`/usr/src/pool/linux-2.4.20/drivers/media/radio'
make[3]: Für das Target »modules« gibt es nichts zu tun.
make[3]: Leaving directory
`/usr/src/pool/linux-2.4.20/drivers/media/radio'
make -C video modules
make[3]: Entering directory
`/usr/src/pool/linux-2.4.20/drivers/media/video'
make[3]: Für das Target »modules« gibt es nichts zu tun.
make[3]: Leaving directory
`/usr/src/pool/linux-2.4.20/drivers/media/video'
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/media'
make -C misc modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/misc'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/misc'
make -C net modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/net'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/net'
make -C parport modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/parport'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/parport'
make -C scsi modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/scsi'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/scsi'
make -C sound modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/sound'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/sound'
make -C usb modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/usb'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/usb'
make -C video modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/drivers/video'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers/video'
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/drivers'
make -C  mm CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include
-Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing
-fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2
-march=i686 -DMODULE -DMODVERSIONS -include
/usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1
modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/mm'
make[1]: Für das Target »modules« gibt es nichts zu tun.
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/mm'
make -C  fs CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include
-Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing
-fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2
-march=i686 -DMODULE -DMODVERSIONS -include
/usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1
modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/fs'
make[1]: Für das Target »modules« gibt es nichts zu tun.
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/fs'
make -C  net CFLAGS="-D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include
-Wall -Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing
-fno-common -fomit-frame-pointer -pipe -mpreferred-stack-boundary=2
-march=i686 -DMODULE -DMODVERSIONS -include
/usr/src/pool/linux-2.4.20/include/linux/modversions.h" MAKING_MODULES=1
modules
make[1]: Entering directory `/usr/src/pool/linux-2.4.20/net'
make -C core modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/net/core'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/net/core'
make -C ipv4 modules
make[2]: Entering directory `/usr/src/pool/linux-2.4.20/net/ipv4'
make[2]: Für das Target »modules« gibt es nichts zu tun.
make[2]: Leaving directory `/usr/src/pool/linux-2.4.20/net/ipv4'
make -C ipv4/netfilter modules
make[2]: Entering directory
`/usr/src/pool/linux-2.4.20/net/ipv4/netfilter'
make[2]: Zirkuläre Datei
/usr/src/pool/linux-2.4.20/include/linux/netfilter_ipv4/ip_conntrack_he
lper.h <-
/usr/src/pool/linux-2.4.20/include/linux/netfilter_ipv4/ip_conntrack.h
Abhängigkeit wird nicht verwendet.
ld -m elf_i386 -r -o ip_conntrack.o ip_conntrack_standalone.o
ip_conntrack_core.o ip_conntrack_proto_generic.o
ip_conntrack_proto_tcp.o ip_conntrack_proto_udp.o
ip_conntrack_proto_icmp.o
ld -m elf_i386 -r -o iptable_nat.o ip_nat_standalone.o ip_nat_rule.o
ip_nat_core.o ip_nat_helper.o ip_nat_proto_unknown.o ip_nat_proto_tcp.o
ip_nat_proto_udp.o ip_nat_proto_icmp.o
gcc -D__KERNEL__ -I/usr/src/pool/linux-2.4.20/include -Wall
-Wstrict-prototypes -Wno-trigraphs -O2 -fno-strict-aliasing -fno-common
-fomit-frame-pointer -pipe -mpreferred-stack-boundary=2 -march=i686
-DMODULE -DMODVERSIONS -include
/usr/src/pool/linux-2.4.20/include/linux/modversions.h  -nostdinc
-iwithprefix include -DKBUILD_BASENAME=ip_pool  -DEXPORT_SYMTAB -c
ip_pool.c
ip_pool.c:40: linux/netfilter_ipv4/ip_pool.h: No such file or directory
ip_pool.c:65: warning: `struct ip_pool' declared inside parameter list
ip_pool.c:65: warning: its scope is only this definition or declaration,
which is probably not what you want.
ip_pool.c: In function `ip_pool_testip_R706d4544':
ip_pool.c:69: dereferencing pointer to incomplete type
ip_pool.c:70: dereferencing pointer to incomplete type
ip_pool.c:67: warning: `res' might be used uninitialized in this
function
ip_pool.c: At top level:
ip_pool.c:85: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_addip_kernel_R7faca846':
ip_pool.c:87: dereferencing pointer to incomplete type
ip_pool.c:92: dereferencing pointer to incomplete type
ip_pool.c: At top level:
ip_pool.c:98: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_delip_kernel_R6a55fd62':
ip_pool.c:100: dereferencing pointer to incomplete type
ip_pool.c:101: dereferencing pointer to incomplete type
ip_pool.c:102: dereferencing pointer to incomplete type
ip_pool.c: At top level:
ip_pool.c:108: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_addip':
ip_pool.c:112: dereferencing pointer to incomplete type
ip_pool.c:113: dereferencing pointer to incomplete type
ip_pool.c:116: dereferencing pointer to incomplete type
ip_pool.c:110: warning: `res' might be used uninitialized in this
function
ip_pool.c: At top level:
ip_pool.c:123: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_delip':
ip_pool.c:127: dereferencing pointer to incomplete type
ip_pool.c:128: dereferencing pointer to incomplete type
ip_pool.c:130: dereferencing pointer to incomplete type
ip_pool.c:125: warning: `res' might be used uninitialized in this
function
ip_pool.c: At top level:
ip_pool.c:137: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_flushpool':
ip_pool.c:139: dereferencing pointer to incomplete type
ip_pool.c:140: dereferencing pointer to incomplete type
ip_pool.c:141: dereferencing pointer to incomplete type
ip_pool.c: At top level:
ip_pool.c:146: warning: `struct ip_pool' declared inside parameter list
ip_pool.c:152: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `poolname_equal':
ip_pool.c:154: warning: implicit declaration of function `DP'
ip_pool.c:154: dereferencing pointer to incomplete type
ip_pool.c:155: dereferencing pointer to incomplete type
ip_pool.c:155: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c:155: (Each undeclared identifier is reported only once
ip_pool.c:155: for each function it appears in.)
ip_pool.c: At top level:
ip_pool.c:161: warning: `struct ip_pool_type' declared inside parameter
list
ip_pool.c: In function `pooltype_equal':
ip_pool.c:162: dereferencing pointer to incomplete type
ip_pool.c:163: dereferencing pointer to incomplete type
ip_pool.c:163: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c: At top level:
ip_pool.c:170: `IP_POOL_MAXNAMELEN' undeclared here (not in a function)
ip_pool.c:171: parameter `name' has incomplete type
ip_pool.c: In function `find_pooltype':
ip_pool.c:173: warning: passing arg 1 of `pooltype_equal' from
incompatible pointer type
ip_pool.c: In function `ip_pool_register_pooltype_Rb2dab173':
ip_pool.c:179: dereferencing pointer to incomplete type
ip_pool.c:179: `IP_POOL_PROTOCOL_VERSION' undeclared (first use in this
function)
ip_pool.c:184: dereferencing pointer to incomplete type
ip_pool.c:184: type of formal parameter 1 is incomplete
ip_pool.c:188: dereferencing pointer to incomplete type
ip_pool.c:194: warning: implicit declaration of function
`ip_pool_printk'
ip_pool.c:194: dereferencing pointer to incomplete type
ip_pool.c:199: dereferencing pointer to incomplete type
ip_pool.c:200: dereferencing pointer to incomplete type
ip_pool.c: In function `ip_pool_unregister_pooltype_Rea435b0a':
ip_pool.c:208: dereferencing pointer to incomplete type
ip_pool.c:208: type of formal parameter 1 is incomplete
ip_pool.c:209: dereferencing pointer to incomplete type
ip_pool.c:217: dereferencing pointer to incomplete type
ip_pool.c: At top level:
ip_pool.c:221: `IP_POOL_MAXNAMELEN' undeclared here (not in a function)
ip_pool.c:222: `IP_POOL_MAXNAMELEN' undeclared here (not in a function)
ip_pool.c:225: parameter `name' has incomplete type
ip_pool.c:225: parameter `typename' has incomplete type
ip_pool.c: In function `ip_pool_createpool':
ip_pool.c:233: sizeof applied to an incomplete type
ip_pool.c:236: dereferencing pointer to incomplete type
ip_pool.c:237: dereferencing pointer to incomplete type
ip_pool.c:237: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c:238: dereferencing pointer to incomplete type
ip_pool.c:239: dereferencing pointer to incomplete type
ip_pool.c:240: dereferencing pointer to incomplete type
ip_pool.c:241: dereferencing pointer to incomplete type
ip_pool.c:242: dereferencing pointer to incomplete type
ip_pool.c:243: dereferencing pointer to incomplete type
ip_pool.c:254: dereferencing pointer to incomplete type
ip_pool.c:255: warning: passing arg 1 of `pooltype_equal' from
incompatible pointer type
ip_pool.c:256: dereferencing pointer to incomplete type
ip_pool.c:263: dereferencing pointer to incomplete type
ip_pool.c:263: dereferencing pointer to incomplete type
ip_pool.c:263: warning: value computed is not used
ip_pool.c:269: dereferencing pointer to incomplete type
ip_pool.c:271: dereferencing pointer to incomplete type
ip_pool.c:271: dereferencing pointer to incomplete type
ip_pool.c:271: warning: value computed is not used
ip_pool.c:283: dereferencing pointer to incomplete type
ip_pool.c:283: warning: passing arg 1 of `poolname_equal' from
incompatible pointer type
ip_pool.c:284: dereferencing pointer to incomplete type
ip_pool.c:285: dereferencing pointer to incomplete type
ip_pool.c:285: dereferencing pointer to incomplete type
ip_pool.c:285: warning: value computed is not used
ip_pool.c: At top level:
ip_pool.c:300: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_destroypool':
ip_pool.c:310: dereferencing pointer to incomplete type
ip_pool.c:310: dereferencing pointer to incomplete type
ip_pool.c:315: dereferencing pointer to incomplete type
ip_pool.c:316: dereferencing pointer to incomplete type
ip_pool.c:316: dereferencing pointer to incomplete type
ip_pool.c:316: warning: value computed is not used
ip_pool.c: At top level:
ip_pool.c:325: warning: `struct ip_pool' declared inside parameter list
ip_pool.c: In function `ip_pool_renamepool':
ip_pool.c:331: warning: passing arg 1 of `poolname_equal' from
incompatible pointer type
ip_pool.c:339: dereferencing pointer to incomplete type
ip_pool.c:339: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c:340: dereferencing pointer to incomplete type
ip_pool.c: At top level:
ip_pool.c:347: warning: `struct ip_pool' declared inside parameter list
ip_pool.c:359: parse error before `ip_pool_ip_t'
ip_pool.c:359: warning: `struct ip_pool' declared inside parameter list
ip_pool.c:360: warning: function declaration isn't a prototype
ip_pool.c: In function `ip_pool_userspacetestip':
ip_pool.c:363: `pool' undeclared (first use in this function)
ip_pool.c:364: `ip' undeclared (first use in this function)
ip_pool.c:361: warning: `res' might be used uninitialized in this
function
ip_pool.c: At top level:
ip_pool.c:385: `IP_POOL_MAXNAMELEN' undeclared here (not in a function)
ip_pool.c:386: parameter `name' has incomplete type
ip_pool.c: In function `ip_pool_get_by_name_Rdeb5ac67':
ip_pool.c:390: warning: passing arg 1 of `poolname_equal' from
incompatible pointer type
ip_pool.c:392: dereferencing pointer to incomplete type
ip_pool.c: In function `ip_pool_get_by_addr_R01f1793e':
ip_pool.c:408: warning: passing arg 1 of `addr_equal' from incompatible
pointer type
ip_pool.c:408: warning: passing arg 2 of `addr_equal' from incompatible
pointer type
ip_pool.c:410: dereferencing pointer to incomplete type
ip_pool.c: In function `ip_pool_put_R0077b403':
ip_pool.c:426: warning: passing arg 1 of `addr_equal' from incompatible
pointer type
ip_pool.c:426: warning: passing arg 2 of `addr_equal' from incompatible
pointer type
ip_pool.c:428: dereferencing pointer to incomplete type
ip_pool.c: In function `ip_pool_list_headers_size':
ip_pool.c:445: sizeof applied to an incomplete type
ip_pool.c:447: dereferencing pointer to incomplete type
ip_pool.c:448: dereferencing pointer to incomplete type
ip_pool.c: In function `ip_pool_list_headers':
ip_pool.c:475: sizeof applied to an incomplete type
ip_pool.c:477: sizeof applied to an incomplete type
ip_pool.c:480: dereferencing pointer to incomplete type
ip_pool.c:483: dereferencing pointer to incomplete type
ip_pool.c:483: dereferencing pointer to incomplete type
ip_pool.c:484: dereferencing pointer to incomplete type
ip_pool.c:490: dereferencing pointer to incomplete type
ip_pool.c:490: dereferencing pointer to incomplete type
ip_pool.c:490: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c:491: dereferencing pointer to incomplete type
ip_pool.c:491: dereferencing pointer to incomplete type
ip_pool.c:492: dereferencing pointer to incomplete type
ip_pool.c:492: dereferencing pointer to incomplete type
ip_pool.c:493: dereferencing pointer to incomplete type
ip_pool.c:493: dereferencing pointer to incomplete type
ip_pool.c:494: dereferencing pointer to incomplete type
ip_pool.c:494: dereferencing pointer to incomplete type
ip_pool.c:495: dereferencing pointer to incomplete type
ip_pool.c:495: dereferencing pointer to incomplete type
ip_pool.c:498: dereferencing pointer to incomplete type
ip_pool.c:500: dereferencing pointer to incomplete type
ip_pool.c: In function `ip_pool_list_poolmembers_size':
ip_pool.c:524: dereferencing pointer to incomplete type
ip_pool.c:525: dereferencing pointer to incomplete type
ip_pool.c:522: warning: `size' might be used uninitialized in this
function
ip_pool.c: In function `ip_pool_list_poolmembers':
ip_pool.c:537: dereferencing pointer to incomplete type
ip_pool.c:539: dereferencing pointer to incomplete type
ip_pool.c:544: dereferencing pointer to incomplete type
ip_pool.c:535: warning: `need' might be used uninitialized in this
function
ip_pool.c: In function `setpool':
ip_pool.c:642: `SO_IP_POOL' undeclared (first use in this function)
ip_pool.c:644: sizeof applied to an incomplete type
ip_pool.c:646: sizeof applied to an incomplete type
ip_pool.c:662: dereferencing pointer to incomplete type
ip_pool.c:662: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c:666: dereferencing pointer to incomplete type
ip_pool.c:666: `IP_POOL_OP_CREATE_POOL' undeclared (first use in this
function)
ip_pool.c:669: sizeof applied to an incomplete type
ip_pool.c:672: sizeof applied to an incomplete type
ip_pool.c:675: dereferencing pointer to incomplete type
ip_pool.c:677: dereferencing pointer to incomplete type
ip_pool.c:678: dereferencing pointer to incomplete type
ip_pool.c:679: sizeof applied to an incomplete type
ip_pool.c:680: sizeof applied to an incomplete type
ip_pool.c:680: type of formal parameter 1 is incomplete
ip_pool.c:680: type of formal parameter 2 is incomplete
ip_pool.c:689: dereferencing pointer to incomplete type
ip_pool.c:689: type of formal parameter 1 is incomplete
ip_pool.c:695: dereferencing pointer to incomplete type
ip_pool.c:696: `IP_POOL_OP_ADD_IP' undeclared (first use in this
function)
ip_pool.c:698: sizeof applied to an incomplete type
ip_pool.c:699: sizeof applied to an incomplete type
ip_pool.c:699: warning: passing arg 1 of `ip_pool_addip' from
incompatible pointer type
ip_pool.c:702: `IP_POOL_OP_DEL_IP' undeclared (first use in this
function)
ip_pool.c:704: sizeof applied to an incomplete type
ip_pool.c:705: sizeof applied to an incomplete type
ip_pool.c:705: warning: passing arg 1 of `ip_pool_delip' from
incompatible pointer type
ip_pool.c:708: `IP_POOL_OP_DESTROY_POOL' undeclared (first use in this
function)
ip_pool.c:709: warning: passing arg 1 of `ip_pool_destroypool' from
incompatible pointer type
ip_pool.c:713: `IP_POOL_OP_FLUSH_POOL' undeclared (first use in this
function)
ip_pool.c:714: warning: passing arg 1 of `ip_pool_flushpool' from
incompatible pointer type
ip_pool.c:718: `IP_POOL_OP_RENAME_POOL' undeclared (first use in this
function)
ip_pool.c:721: sizeof applied to an incomplete type
ip_pool.c:724: sizeof applied to an incomplete type
ip_pool.c:728: dereferencing pointer to incomplete type
ip_pool.c:729: dereferencing pointer to incomplete type
ip_pool.c:729: warning: passing arg 1 of `ip_pool_renamepool' from
incompatible pointer type
ip_pool.c:732: `IP_POOL_OP_SETCOUNTER_POOL' undeclared (first use in
this function)
ip_pool.c:735: sizeof applied to an incomplete type
ip_pool.c:738: sizeof applied to an incomplete type
ip_pool.c:742: dereferencing pointer to incomplete type
ip_pool.c:742: dereferencing pointer to incomplete type
ip_pool.c:742: warning: passing arg 1 of `ip_pool_counterpool' from
incompatible pointer type
ip_pool.c:697: warning: unreachable code at beginning of switch
statement
ip_pool.c:747: dereferencing pointer to incomplete type
ip_pool.c: In function `getpool':
ip_pool.c:772: `SO_IP_POOL' undeclared (first use in this function)
ip_pool.c:774: sizeof applied to an incomplete type
ip_pool.c:776: sizeof applied to an incomplete type
ip_pool.c:792: dereferencing pointer to incomplete type
ip_pool.c:792: `IP_POOL_MAXNAMELEN' undeclared (first use in this
function)
ip_pool.c:794: dereferencing pointer to incomplete type
ip_pool.c:794: dereferencing pointer to incomplete type
ip_pool.c:796: dereferencing pointer to incomplete type
ip_pool.c:797: `IP_POOL_OP_TEST_IP' undeclared (first use in this
function)
ip_pool.c:801: sizeof applied to an incomplete type
ip_pool.c:803: sizeof applied to an incomplete type
ip_pool.c:806: dereferencing pointer to incomplete type
ip_pool.c:806: type of formal parameter 1 is incomplete
ip_pool.c:811: dereferencing pointer to incomplete type
ip_pool.c:811: dereferencing pointer to incomplete type
ip_pool.c:811: dereferencing pointer to incomplete type
ip_pool.c:813: sizeof applied to an incomplete type
ip_pool.c:813: sizeof applied to an incomplete type
ip_pool.c:813: sizeof applied to an incomplete type
ip_pool.c:816: `IP_POOL_OP_VERSION' undeclared (first use in this
function)
ip_pool.c:819: sizeof applied to an incomplete type
ip_pool.c:821: sizeof applied to an incomplete type
ip_pool.c:825: dereferencing pointer to incomplete type
ip_pool.c:825: `IP_POOL_PROTOCOL_VERSION' undeclared (first use in this
function)
ip_pool.c:827: sizeof applied to an incomplete type
ip_pool.c:827: sizeof applied to an incomplete type
ip_pool.c:827: sizeof applied to an incomplete type
ip_pool.c:830: `IP_POOL_OP_GETPOOL_BYNAME' undeclared (first use in this
function)
ip_pool.c:833: sizeof applied to an incomplete type
ip_pool.c:835: sizeof applied to an incomplete type
ip_pool.c:838: dereferencing pointer to incomplete type
ip_pool.c:838: dereferencing pointer to incomplete type
ip_pool.c:838: type of formal parameter 1 is incomplete
ip_pool.c:839: dereferencing pointer to incomplete type
ip_pool.c:843: dereferencing pointer to incomplete type
ip_pool.c:844: sizeof applied to an incomplete type
ip_pool.c:844: sizeof applied to an incomplete type
ip_pool.c:844: sizeof applied to an incomplete type
ip_pool.c:847: `IP_POOL_OP_GETPOOL_BYADDR' undeclared (first use in this
function)
ip_pool.c:850: sizeof applied to an incomplete type
ip_pool.c:852: sizeof applied to an incomplete type
ip_pool.c:856: dereferencing pointer to incomplete type
ip_pool.c:856: dereferencing pointer to incomplete type
ip_pool.c:857: dereferencing pointer to incomplete type
ip_pool.c:861: dereferencing pointer to incomplete type
ip_pool.c:862: dereferencing pointer to incomplete type
ip_pool.c:862: dereferencing pointer to incomplete type
ip_pool.c:864: dereferencing pointer to incomplete type
ip_pool.c:865: sizeof applied to an incomplete type
ip_pool.c:865: sizeof applied to an incomplete type
ip_pool.c:865: sizeof applied to an incomplete type
ip_pool.c:870: `IP_POOL_OP_LISTHEADERS_SIZE' undeclared (first use in
this function)
ip_pool.c:876: sizeof applied to an incomplete type
ip_pool.c:878: sizeof applied to an incomplete type
ip_pool.c:882: dereferencing pointer to incomplete type
ip_pool.c:884: dereferencing pointer to incomplete type
ip_pool.c:886: sizeof applied to an incomplete type
ip_pool.c:886: sizeof applied to an incomplete type
ip_pool.c:886: sizeof applied to an incomplete type
ip_pool.c:889: `IP_POOL_OP_LISTMEMBERS_SIZE' undeclared (first use in
this function)
ip_pool.c:894: sizeof applied to an incomplete type
ip_pool.c:896: sizeof applied to an incomplete type
ip_pool.c:900: dereferencing pointer to incomplete type
ip_pool.c:900: type of formal parameter 1 is incomplete
ip_pool.c:905: dereferencing pointer to incomplete type
ip_pool.c:907: sizeof applied to an incomplete type
ip_pool.c:907: sizeof applied to an incomplete type
ip_pool.c:907: sizeof applied to an incomplete type
ip_pool.c:911: `IP_POOL_OP_LISTHEADERS' undeclared (first use in this
function)
ip_pool.c:921: `IP_POOL_OP_LISTMEMBERS' undeclared (first use in this
function)
ip_pool.c:926: dereferencing pointer to incomplete type
ip_pool.c:926: type of formal parameter 1 is incomplete
ip_pool.c:798: warning: unreachable code at beginning of switch
statement
ip_pool.c:950: dereferencing pointer to incomplete type
ip_pool.c: At top level:
ip_pool.c:963: `SO_IP_POOL' undeclared here (not in a function)
ip_pool.c:963: initializer element is not constant
ip_pool.c:963: (near initialization for `so_pool.set_optmin')
ip_pool.c:963: `SO_IP_POOL' undeclared here (not in a function)
ip_pool.c:963: initializer element is not constant
ip_pool.c:963: (near initialization for `so_pool.set_optmax')
ip_pool.c:964: `SO_IP_POOL' undeclared here (not in a function)
ip_pool.c:964: initializer element is not constant
ip_pool.c:964: (near initialization for `so_pool.get_optmin')
ip_pool.c:964: `SO_IP_POOL' undeclared here (not in a function)
ip_pool.c:964: initializer element is not constant
ip_pool.c:964: (near initialization for `so_pool.get_optmax')
make[2]: *** [ip_pool.o] Fehler 1
make[2]: Leaving directory
`/usr/src/pool/linux-2.4.20/net/ipv4/netfilter'
make[1]: *** [_modsubdir_ipv4/netfilter] Fehler 2
make[1]: Leaving directory `/usr/src/pool/linux-2.4.20/net'
make: *** [_mod_net] Fehler 2

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]