Can't use iptables -m string with any RedHat distri

Can't use iptables -m string with any RedHat distri

[olivier]

Hello All !


I have been having this problem for quite a while and decided to make a post
about it.
If you run a RedHat distri, and don't want to compile anything, just using
RPM (especially if you plan to maintain your server with RHN), you get this
error trying to use the string matching option:

# iptables -A INPUT -j ACCEPT -m string --string HELLO
iptables v1.x.x: Couldn't load match
`string':/lib/iptables/libipt_string.so: cannot open shared object file: No
such file or directory

Where is this library ?
# find / -name libipt_string.so
#
Hmmm... Obviously not included in any of the iptables RPMs provided by
redhat.

So I downloaded the matching iptables1.x.x.tar.bz2 from netfilter.org, and
found the libipt_string.c in there.
With a "make", this library doesn't get compiled...

OK, then I will compile it myself, then:
cc -O2 -Wall -I etc.. etc...

ipt_strings.h not found...

and can't seem to find this file anywhere.. not even in the redhat kernel
source rpm ....


Anybody has an idea on how to make "iptables --m string" work with RedHat ?


Thanks All !!!

RE: Can't use iptables -m string with any RedHat distri

[Daniel Chemko]

Oliver, there are two halves to IPTABLES. They are the kernel and the
userspace tools. The userspace tools are called iptables, and the kernel
space tools can be found as patch-o-matic. On the iptables site,
download the latest patch-o-matic and apply it to the kernel sources for
the kernel you are using. You cannot do this with RPMS atm since to the
best of my knowledge, there is no RPM available with these features
built in for Redhat releases.

Here goes:

Download P-O-M, whatever the latest is
Download iptables latest
Download Redhat kernel sources to the kernel you are using now (it is
much easier to download the -i386 version of the sources if you have
that option).

rpm -i kernel-source-<kernelversion>-i386.rpm
cp /boot/config-<kernelversion> /usr/src/linux-<kernelversion>/.config
Edit /usr/src/linux-<kernelversion>/Makefile to change the kernel
version

Extract the POM to its own directory
cd <pomdir>
KERNEL_DIR=/usr/src/linux-<kernelversion> ./runme extra
Select the options that you with to install into the kernel. By saying
'y', you install that patch into the kernel sources. The String kernel
patch should be included in this set of patches.

cd /usr/src/linux-<kernelversion>
make menuconfig
Do your business adding Networking -> Netfilter -> Modules into the
netfilter config. I KNOW that modules work, so compile all the patch
added netfilter options as modules.
Make dep; make bzImage; etc...
Install the new kernel

Extract the iptables to its own directory
Use standard make to install things, but postfix LIBDIR, and the other
directory prefixes to match those that Redhat uses.
Install the iptables you just built and run iptables -V to make sure the
version is the one you installed.

Voila! iptables -m string --help

Still no beans?

If you did all the above alright, and you made sure to check string was
in the kernel, I had an issue where iptables makes the module, but does
not install it even though it is made and built. In that case, go to the
extensions directory and copy libipt_string.so into /lib/iptables or
wherever your iptables module directory is.

-----Original Message-----
From: olivier [mailto:netfilter.org@olivier.us] 
Sent: Monday, June 02, 2003 3:58 PM
To: netfilter@lists.netfilter.org
Subject: Can't use iptables -m string with any RedHat distri

Hello All !


I have been having this problem for quite a while and decided to make a
post
about it.
If you run a RedHat distri, and don't want to compile anything, just
using
RPM (especially if you plan to maintain your server with RHN), you get
this
error trying to use the string matching option:

# iptables -A INPUT -j ACCEPT -m string --string HELLO
iptables v1.x.x: Couldn't load match
`string':/lib/iptables/libipt_string.so: cannot open shared object file:
No
such file or directory

Where is this library ?
# find / -name libipt_string.so
#
Hmmm... Obviously not included in any of the iptables RPMs provided by
redhat.

So I downloaded the matching iptables1.x.x.tar.bz2 from netfilter.org,
and
found the libipt_string.c in there.
With a "make", this library doesn't get compiled...

OK, then I will compile it myself, then:
cc -O2 -Wall -I etc.. etc...

ipt_strings.h not found...

and can't seem to find this file anywhere.. not even in the redhat
kernel
source rpm ....


Anybody has an idea on how to make "iptables --m string" work with
RedHat ?


Thanks All !!!

RE: Can't use iptables -m string with any RedHat distri

[George Vieira]

Don't use the version that comes with RedHat but download the latest iptables version with it's companion patch-o-matic.. then patch the latest kernel with the latest iptables and use patch-o-matic to add the string module in. it's not standard on the distros...

I have 2.4.19 and 1.2.7a and all is well in the land of Oz... ;)

I don't recommend 1.2.8 with 2.4.20 if your new to kernel compiling and patching...

Thanks,
____________________________________________
George Vieira
Systems Manager
georgev@citadelcomputer.com.au

Citadel Computer Systems Pty Ltd
http://www.citadelcomputer.com.au
 

-----Original Message-----
From: olivier [mailto:netfilter.org@olivier.us]
Sent: Tuesday, June 03, 2003 8:58 AM
To: netfilter@lists.netfilter.org
Subject: Can't use iptables -m string with any RedHat distri


Hello All !


I have been having this problem for quite a while and decided to make a post
about it.
If you run a RedHat distri, and don't want to compile anything, just using
RPM (especially if you plan to maintain your server with RHN), you get this
error trying to use the string matching option:

# iptables -A INPUT -j ACCEPT -m string --string HELLO
iptables v1.x.x: Couldn't load match
`string':/lib/iptables/libipt_string.so: cannot open shared object file: No
such file or directory

Where is this library ?
# find / -name libipt_string.so
#
Hmmm... Obviously not included in any of the iptables RPMs provided by
redhat.

So I downloaded the matching iptables1.x.x.tar.bz2 from netfilter.org, and
found the libipt_string.c in there.
With a "make", this library doesn't get compiled...

OK, then I will compile it myself, then:
cc -O2 -Wall -I etc.. etc...

ipt_strings.h not found...

and can't seem to find this file anywhere.. not even in the redhat kernel
source rpm ....


Anybody has an idea on how to make "iptables --m string" work with RedHat ?


Thanks All !!!

Re: Can't use iptables -m string with any RedHat distri

[Arnt Karlsen]

On Tue, 3 Jun 2003 10:46:22 +1000, 
"George Vieira" <georgev@citadelcomputer.com.au> wrote in message 
<09B04A55822EFF4DA48D2E0BB2941D4A0D6D90@wardrive.citadelcomputer.com.au
>:

> Don't use the version that comes with RedHat but download the latest
> iptables version with it's companion patch-o-matic.. then patch the
> latest kernel with the latest iptables and use patch-o-matic to add

.."latest kernel", here you mean vanilla, not Red Hat kernel?

> the string module in. it's not standard on the distros...
> 
> I have 2.4.19 and 1.2.7a and all is well in the land of Oz... ;)
> 
> I don't recommend 1.2.8 with 2.4.20 if your new to kernel compiling
> and patching...


-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.

Re: Can't use iptables -m string with any RedHat distri

[Arnt Karlsen]

On Mon, 2 Jun 2003 17:36:36 -0700, 
"Daniel Chemko" <dchemko@smgtec.com> wrote in message 
<7C9884991ADAE0479C14F10C858BCDF5122DCC@alderaan.smgtec.com>:

> cd /usr/src/linux-<kernelversion>
> make menuconfig
> Do your business adding Networking -> Netfilter -> Modules into the
> netfilter config. I KNOW that modules work, so compile all the patch
> added netfilter options as modules.
> Make dep; make bzImage; etc...
> Install the new kernel

..a better approach is 'make dep modules modules_install install', 
which drops everything home, automagically, on Red Hat 7.3 and up.

-- 
..med vennlig hilsen = with Kind Regards from Arnt... ;-)
...with a number of polar bear hunters in his ancestry...
  Scenarios always come in sets of three: 
  best case, worst case, and just in case.