How to disable ip_contrack_irc when its compiled into the kernel?

How to disable ip_contrack_irc when its compiled into the kernel?

[Justin Hammond]

Hi all

We have a problem on one of our servers. Its running:

Linux 2.4.17 on a Sparc Box with IPtables 1.2.4

The Kernel support for IPtables was compiled into the kernel, not as
loadable modules, and now we have some problems. 

We recently setup a IRC server for a customer, and they came back and
told us that DCC sending was not working for any client connected to
this IRC server. A quick check of the logs revealed:

Forged DCC command from 218.103.157.103: 1.154.254.169:0
Forged DCC command from 218.103.157.103: 1.154.254.169:0
Forged DCC command from 218.103.157.103: 1.154.254.169:0
Forged DCC command from 218.103.157.103: 1.154.254.169:0


Throughout the entire kernel log. 

(I believe the problem has been fixed in later releases of iptables, so
I'm not after a fix)

Now here is my problem. The Server is in Sydney, Australia, and I'm in
Singapore, around 8000Miles away, so doing a remote kernel compile and
reboot to remove the contrack_irc module is not something that I fancy. 

I'm wondering if there is a Rule or way that I can disable the contrack
module from operating?

Thanks :)

Justin

Re: How to disable ip_contrack_irc when its compiled into the kernel?

[Dan Egli]

Justin Hammond wrote:

>Hi all
>
>We have a problem on one of our servers. Its running:
>
>Linux 2.4.17 on a Sparc Box with IPtables 1.2.4
>
>The Kernel support for IPtables was compiled into the kernel, not as
>loadable modules, and now we have some problems. 
>
>We recently setup a IRC server for a customer, and they came back and
>told us that DCC sending was not working for any client connected to
>this IRC server. A quick check of the logs revealed:
>
>Forged DCC command from 218.103.157.103: 1.154.254.169:0
>Forged DCC command from 218.103.157.103: 1.154.254.169:0
>Forged DCC command from 218.103.157.103: 1.154.254.169:0
>Forged DCC command from 218.103.157.103: 1.154.254.169:0
>
>
>Throughout the entire kernel log. 
>
>(I believe the problem has been fixed in later releases of iptables, so
>I'm not after a fix)
>
>Now here is my problem. The Server is in Sydney, Australia, and I'm in
>Singapore, around 8000Miles away, so doing a remote kernel compile and
>reboot to remove the contrack_irc module is not something that I fancy. 
>
>I'm wondering if there is a Rule or way that I can disable the contrack
>module from operating?
>
>Thanks :)
>
>Justin
>
>
>
>  
>
Unfortunately, I believe that once a module is compiled into the kernel 
it's present, end of discussion. And besides. thats not quite what you 
want is it? removing ip_conntrack_irc would kill ALL irc abilities, not 
just DCC. After all, doens't IRC operate on multiple ports, similiar to FTP?

Re: How to disable ip_contrack_irc when its compiled into the kernel?

[Athanasius]

[-- Attachment #1: Type: text/plain, Size: 1297 bytes --]

On Fri, Dec 27, 2002 at 11:27:43AM -0700, Dan Egli wrote:
> Unfortunately, I believe that once a module is compiled into the kernel 
> it's present, end of discussion. And besides. thats not quite what you 

   Agreed on this.  It's a big incentive to do all/most of the netfilter
stuff as modules.

> want is it? removing ip_conntrack_irc would kill ALL irc abilities, not 
> just DCC. After all, doens't IRC operate on multiple ports, similiar to FTP?

   You should be able to actually IRC through the box, as that's a
simple TCP connection one way or the other, assuming other rules allow
it.  The ip_nat_irc and ip_conntrack_irc are to snoop DCC commands to
allow those to work.
   Yes, the client<->server can use any port really, which is why the
irc modules allow you to pass a list of ports to snoop.  Another good
reason to compile them as modules as I don't believe you can specify the
ports option when hard compiled in?  Or is there some runtime option
that could be added with lilo's append statement?

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]

Re: How to disable ip_contrack_irc when its compiled into the kernel?

[Sascha Reissner]

> Unfortunately, I believe that once a module is compiled into the kernel
> it's present, end of discussion. And besides. thats not quite what you
> want is it? removing ip_conntrack_irc would kill ALL irc abilities, not
> just DCC. After all, doens't IRC operate on multiple ports, similiar to
FTP?

No irc just uses a single connection for all the basic stuff (usually from a
random port/tcp clientside to port 6667/tcp serverside)

just DCC (direct client connection) uses additional ports. DCC is used for
the inter user communication.

Re: How to disable ip_contrack_irc when its compiled into the kernel?

[Alistair Tonner]

	This error is caused when the connection inside the firewall is using 
	its outside IP address, which is NOT what irc-conntract/irc-nat 
	expects to see.  

	This error is more commonly seen when a client inside a firewall is 
attempting to DCC connect to a client outside the firewall, and the client
	is using the IP address of the outside of the firewall  ... how this 
	can be cured in a *server* I'm not sure, not running any of the servers,
	but with the MIRC client you tell the client to "Use Local IP" rather than
	"Use IP from Server" (Its been a while...) given that this is a server 
	inside your firewall --- I'd suspect that similar rules for NATting and
	DENATting the connection exist and you need to tell the server to use
	its local IP rather than the internet IP address on the outside of the
	firewall....

	Alistair


On December 27, 2002 11:55 am, Justin Hammond wrote:
> Hi all
>
> We have a problem on one of our servers. Its running:
>
> Linux 2.4.17 on a Sparc Box with IPtables 1.2.4
>
> The Kernel support for IPtables was compiled into the kernel, not as
> loadable modules, and now we have some problems.
>
> We recently setup a IRC server for a customer, and they came back and
> told us that DCC sending was not working for any client connected to
> this IRC server. A quick check of the logs revealed:
>
> Forged DCC command from 218.103.157.103: 1.154.254.169:0
> Forged DCC command from 218.103.157.103: 1.154.254.169:0
> Forged DCC command from 218.103.157.103: 1.154.254.169:0
> Forged DCC command from 218.103.157.103: 1.154.254.169:0
>
>
> Throughout the entire kernel log.
>
> (I believe the problem has been fixed in later releases of iptables, so
> I'm not after a fix)
>
> Now here is my problem. The Server is in Sydney, Australia, and I'm in
> Singapore, around 8000Miles away, so doing a remote kernel compile and
> reboot to remove the contrack_irc module is not something that I fancy.
>
> I'm wondering if there is a Rule or way that I can disable the contrack
> module from operating?
>
> Thanks :)
>
> Justin