Subject: [alpine-devel] 1.7.28 issues

From: Harry Lachanas <[email-masked]>
Date: Mon, 08 Dec 2008 08:34:03 +0200

Hi all,

I salute the 1.7.28 release and found the following little problems ...

xtables-addons + iptables 1.4.2

a) xtables-addons misses the ipp2p component
b) the old ipp2p component is still compiled in the Kernel
but since iptables version 1.4.2 is implied it cannot be used,

The ipp2p component from xtables-addons has to be enabled.

Shorewall incompatibilities.
----------------------------------------------
Xtables-addons maintainer changed the code in the ipp2p component,
so the module does not include the options
iptables -m ipp2p --ipp2p

the reason why he did this in his own words is this ...
I quote

"............................................................................
> Dear Sir,
> >
> > There seems to be a problem for some of us trying to combine
> > xtables-addons and shorewall .... in your code of ipp2p support you
> > have exluded the command line option -m ipp2p --ipp2p as it is used
> > in shorewall and as I presume in many other sh netfilter
> > applications as a result shorewall is unable to detect the
> > existence of ipp2p support in the kernel and also the combined
> > command if --ipp2p now must be specified for all separate protocols
> > ( --kaza, --bit ... etc )....
>   

Correct. I felt that --ipp2p is a very ambiguous option —
“does it include protocol XYZ or not?” — so it has been removed.
Any scripts should be adjusted. There is no workaround other
than to modify libxt_ipp2p.c and add it back, but I will not
be making this change in the repository.

> > Please advise as to whether there are
> > workarounds regarding this problem .... !!!
>   

If you merely need the detection, add

	{.name = "ipp2p", .has_arg = false, .val = 0x1234},

This alone makes --ipp2p a no-op, but at least it is not rejected.
...................................................................."

Shorewall ipp2p usage

shorewall detects the ipp2p module in /usr/share/shorewall/lib.base (
line 1026 )
using this command.

qt $IPTABLES -A fooX1234 -p tcp -m ipp2p --ipp2p -j ACCEPT &&
IPP2P_MATCH=Yes

obviously this breaks down because option -m ipp2p --ipp2p is not
supported anymore.

I've contacted the shorewall list and they provided patches for the
shorewall version 4+
for further details please have a look at www.shorewall.net

shorewall version 3.4.8 is not supported anymore.

For those of us that want to stay with the 3.4.8 version we have to play
with the code a bit ...

that is
Replace the above line with
.............................
qt $IPTABLES -A fooX1234 -p tcp -m ipp2p --edk -j ACCEPT && IPP2P_MATCH=Yes
.............................

with xtables-addons module ipp2p enabled + iptables-1.4.2
shorewall now will detect correctly the support of the new ipp2p module.

save
and
now include this file in
/etc/lbu/include
with

#echo "/usr/share/shorewall/lib.base" >> /etc/lbu/include
#lbu commit

Now in order to drop shape or whatever U like to do with p2p protocols
you have to indicate them in one of shorewall control files
separately for each p2p protocol edk, bit, kazaa, .... etc.

Further howtos on this can be found in www.shorewall.net

In order of all of the above to happen the maintainers of alpine should
provide first the xtables-addons with the ipp2p module enabled
and remove the old ipp2p from kernel ....

Kind Regards,
Harry Lachanas.

---
Unsubscribe:  [email-masked]
Help:         [email-masked]
---

---

From: Natanael Copa <[email-masked]>
Date: Mon, 08 Dec 2008 17:04:36 +0100

> a) xtables-addons misses the ipp2p component

It is supposed to be in the modloop (the loopback device where kernel
modules are). No kernel modules are included in apk packages.

> but since iptables version 1.4.2 is implied it cannot be used,

are you 100% that its not the xtables-addons that is in there? looks to
me that when you modprobe ipp2p you actually get the xtables-addons
module. lsmod shows xt_ipp2p (new from xtables-addons) and not ipt_ipp2p
(old ipp2p)

thanks!

---

---

From: Harry Lachanas <[email-masked]>
Date: Mon, 08 Dec 2008 19:48:13 +0200

> modules are). No kernel modules are included in apk packages.
Hi nc !! I understand now that I wasn't clear enough.

The xtables-addons module seems ok ....

It is the iptables --> libxt_ipp2p.so that is missing from  /lib/xtables

( this is the  lib module that iptables use to contact the 
xtables-addons kernel module. )
instead the /lib/iptables/libipt_ipp2p.so is there, as if the old module 
was compiled in the kernel ??.

> module. lsmod shows xt_ipp2p (new from xtables-addons) and not ipt_ipp2p
yes the xt_ipp2p module gets loaded ....

but if U do  a
#iptables -m ipp2p -help

you get

iptables v1.4.2: Couldn't load match `ipp2p':File not found

Try `iptables -h' or 'iptables --help' for more information.

Cheers,
Harry.

---

---

From: Natanael Copa <[email-masked]>
Date: Tue, 09 Dec 2008 10:30:11 +0100

> Hi nc !! I understand now that I wasn't clear enough.

or i just dont read carefully enough.

> It is the iptables --> libxt_ipp2p.so that is missing from  /lib/xtables

right. this was the problem.

> xtables-addons kernel module. )

i know. i just had too many things going on in my head at the same time.
stuff like this ted to happen then.

> was compiled in the kernel ??.

I think is because you have ipp2p package installed. do: apk_delete
ipp2p.

> iptables v1.4.2: Couldn't load match `ipp2p':File not found

this is due to the missing ipp2p iptables module is missing. not the
kernel module.
> Try `iptables -h' or 'iptables --help' for more information.

ok. i think i finally got it right. (sorry for the confusion).

...

IPP2P was intended for TCP only. Due to increasing usage of UDP we
needed to change this.
You can now use -p udp to search UDP packets only or without -p switch
to search UDP and TCP packets.

See README included with this package for more details or visit
http://www.ipp2p.org

Examples:
 iptables -A FORWARD -m ipp2p --ipp2p -j MARK --set-mark 0x01
 iptables -A FORWARD -p udp -m ipp2p --kazaa --bit -j DROP
 iptables -A FORWARD -p tcp -m ipp2p --edk --soul -j DROP

well the example is wrong but i think the module loads and iptables
works.

There was an another annoying bug in 1.7.28 (both alpine-conf-1.8 and
1.8.1 was installed) and 2 packages was missing (acf-tcpproxy,
acf-iptables). So I think I just push out alpine-1.7.28.1.

while I was there I alos did the simple fix of shorewall so I think that
ipp2p should just work with shorewall now.

If you have a chance, could you please find the 1.7.28.1 release here :
http://dev.alpinelinux.org/~ncopa/alpine/ 

(mind the slow download, 2Mbit)

and please verify that:
1. xt_ipp2p kernel module is there and works.
2. xtables-addons is there and works with iptables.
3. shorewall is able to detect ipp2p and is able to use it.

If everythign is ok i will upload it.

Thank you!

-nc

---

---

From: Harry Lachanas <[email-masked]>
Date: Tue, 09 Dec 2008 13:13:49 +0200

> 1. xt_ipp2p kernel module is there and works.
OK  
> 2. xtables-addons is there and works with iptables.
OK
> 3. shorewall is able to detect ipp2p and is able to use it.
OK
> If everythign is ok i will upload it.

select sum(OK's) as result from mail;
result
----------
ALL OK ;-)

Much better now
Thanks
Harry

---