Connlimit and linux-2.6.17

DISCUSSION Andrew Beverley 2 participants 10 messages Jul 19, 2006 – Jul 22, 2006 netfilter

Share & tools

Andrew Beverley

author

2006-07-19 21:29 UTC #0 lore raw

I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:

iptables -t mangle -A PREROUTING -p tcp -i eth0 -m \
	connlimit --connlimit-above 5 -j LOG

I get "iptables: Invalid argument", and dmesg tells me "ip_tables: connlimit match: invalid size 0 != 16"

The kernel and iptables are patched with connlimit from patch-o-matic-ng-20060626, which in turn is patched as per http://patchwork.netfilter.org/netfilter-devel/patch.pl?id=3456 to update the connlimit patch.

I have noticed that when compiling the kernel I get error messages as follows when compiling connlimit:

net/ipv4/netfilter/ipt_connlimit.c:211: warning: initialization from incompatible pointer type net/ipv4/netfilter/ipt_connlimit.c:212: warning: initialization from incompatible pointer type net/ipv4/netfilter/ipt_connlimit.c:213: warning: initialization from incompatible pointer type

The code in question is the highlighted lines below:

static struct ipt_match connlimit_match = {
.name = "connlimit",
.match = &match, <--
.checkentry = &check, <--
.destroy = &destroy, <--
.me = THIS_MODULE
};

The above error messages do not appear when using 2.6.15, and connlimit works.

Any ideas?

On another note, is it possible for connlimit to form part of the stable kernel? It is a real pain having to mess around patching each time I get a new kernel, especially as currently the patch-o-matic also requires patching!

Andy Beverley

Krzysztof Oledzki

2006-07-19 22:39 UTC #1 lore raw

Quoted 26 lines · Andrew Beverley

I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
iptables -t mangle -A PREROUTING -p tcp -i eth0 -m \
	connlimit --connlimit-above 5 -j LOG
I get "iptables: Invalid argument", and dmesg tells me "ip_tables: connlimit match: invalid size 0 != 16"
The kernel and iptables are patched with connlimit from patch-o-matic-ng-20060626, which in turn is patched as per http://patchwork.netfilter.org/netfilter-devel/patch.pl?id=3456 to update the connlimit patch.
I have noticed that when compiling the kernel I get error messages as follows when compiling connlimit:
net/ipv4/netfilter/ipt_connlimit.c:211: warning: initialization from incompatible pointer type net/ipv4/netfilter/ipt_connlimit.c:212: warning: initialization from incompatible pointer type net/ipv4/netfilter/ipt_connlimit.c:213: warning: initialization from incompatible pointer type
The code in question is the highlighted lines below:
static struct ipt_match connlimit_match = {
.name = "connlimit",
.match = &match, <--
.checkentry = &check, <--
.destroy = &destroy, <--
.me = THIS_MODULE
};

Quoted 5 lines

The above error messages do not appear when using 2.6.15, and connlimit works.
Any ideas?
On another note, is it possible for connlimit to form part of the stable kernel? It is a real pain having to mess around patching each time I get a new kernel, especially as currently the patch-o-matic also requires patching!

Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.

Best regards,

Krzysztof Olędzki

Andrew Beverley

author

2006-07-19 22:45 UTC #2 lore raw

Quoted 1 line

Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:

<snip>

Quoted 1 line

Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.

Many thanks. I do not envy you working through GPRS - very tedious!

Will it still be a patch or is it possible to get it in the stable kernel?

Andy Beverley

Krzysztof Oledzki

2006-07-21 20:06 UTC #3 lore raw

Quoted 7 lines · Andrew Beverley

Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
<snip>
Quoted 1 line
Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.
Many thanks.

OK, I fixed the connlimit extension. Please:

- download recent version of patch-o-matic-ng

- remove "patchlets/connlimit" directory from extracted pom-ng

- run "./runme --download"

- patch & recompile your kernel, as always

- tell me if it works (or not).

Quoted 1 line

I do not envy you working through GPRS - very tedious!

GPRS/EDGE is not so bad, especially if you don't have anything better. ;)

Quoted 1 line

Will it still be a patch or is it possible to get it in the stable kernel?

Connlimit goes to my external pom-ng repository.

Best regards,

Krzysztof Olędzki

Andrew Beverley

author

2006-07-21 20:23 UTC #4 lore raw

Quoted 3 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
OK, I fixed the connlimit extension.

Excellent!

Quoted 6 lines

- download recent version of patch-o-matic-ng
- remove "patchlets/connlimit" directory from extracted pom-ng
- run "./runme --download"

I've downloaded 20060720 but when I run --download I get:

could not get /index
could not get http://mynodes.net/pub/linux/netfilter/patchlets/index
could not get /index
could not get http://www.nucleus.it/pom-repo/index
could not get /index
could not get http://people.netfilter.org/ole/pom//index

and connlimit does not appear. Am I doing something stupid?

Quoted 4 lines

Quoted 1 line
Will it still be a patch or is it possible to get it in the stable kernel?
Connlimit goes to my external pom-ng repository.

Ok, but I would *really* like to see this in the stable kernel! Who do I contact to encourage it to be included? IMHO it's been stable for years!

Many thanks,

Andy

Krzysztof Oledzki

2006-07-21 20:32 UTC #5 lore raw

Quoted 15 lines · Andrew Beverley

Quoted 3 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
OK, I fixed the connlimit extension.
Excellent!
Quoted 6 lines
- download recent version of patch-o-matic-ng
- remove "patchlets/connlimit" directory from extracted pom-ng
- run "./runme --download"
I've downloaded 20060720 but when I run --download I get:

Quoted 8 lines

could not get /index
could not get http://mynodes.net/pub/linux/netfilter/patchlets/index
could not get /index
could not get http://www.nucleus.it/pom-repo/index
could not get /index
could not get http://people.netfilter.org/ole/pom//index
and connlimit does not appear. Am I doing something stupid?

It seems you don't have curl installed, which is required to use external pom-ng repositories.

Best regards,

Krzysztof Olędzki

Andrew Beverley

author

2006-07-21 23:30 UTC #6 lore raw

In reply to Krzysztof Oledzki

Quoted 8 lines

Quoted 5 lines
Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
<snip>
Quoted 1 line
Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.
OK, I fixed the connlimit extension. Please:
- tell me if it works (or not).

Yes, many thanks, I've just compiled the patched kernel and connlimit seems to work fine.

Andy

Andrew Beverley

author

2006-07-22 00:10 UTC #7 lore raw

In reply to Krzysztof Oledzki

Quoted 10 lines

Quoted 5 lines
Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
<snip>
Quoted 1 line
Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.
OK, I fixed the connlimit extension. Please:
- tell me if it works (or not).

I forgot to mention - I get a lot of 'ipt_connlimit: Oops: invalid ct state' error messages scrolling up the screen. Is it safe for me to edit ipt_connlimit.c to not print them? Or are they telling me there is something wrong with my setup?

Thanks,

Andy

Krzysztof Oledzki

2006-07-22 00:37 UTC #8 lore raw

Quoted 4 lines · Andrew Beverley

Quoted 4 lines
Quoted 4 lines
Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
<snip>

Quoted 8 lines

Quoted 6 lines
Quoted 1 line
Quoted 1 line
Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.
OK, I fixed the connlimit extension. Please:
- tell me if it works (or not).
I forgot to mention - I get a lot of 'ipt_connlimit: Oops: invalid ct state' error messages scrolling up the screen.

But when did it start? In 2.6.17?

Quoted 1 line

Is it safe for me to edit ipt_connlimit.c to not print them? Or are they telling me there is something wrong with my setup?

Plase try adding "-m conntrack --ctstate INVALID -j DROP" before "-m connlimit (...)". Did it help?

Best regards,

Krzysztof Olędzki

Andrew Beverley

author

2006-07-22 09:34 UTC #9 lore raw

Quoted 10 lines · Krzysztof Oledzki

Quoted 6 lines · Andrew Beverley
Quoted 6 lines
Quoted 5 lines
Quoted 1 line
Quoted 1 line
I (and others, see netfilter list) are having trouble compiling kernel 2.6.17.4 and iptables-1.3.5-20060508 to use connlimit. Once compiled in and I run:
<snip>
Quoted 1 line
Yes, the API was changed in 2.6.17, so small fixes are required to allow extensions to work. I'm currently traveling a lot so connlimit & TARPIT is still on my TODO list. I'm going to finish it ASAP but with limited GPRS/EDGE access it is not so simple.

Quoted 8 lines

Quoted 6 lines
Quoted 4 lines
OK, I fixed the connlimit extension. Please:
- tell me if it works (or not).
I forgot to mention - I get a lot of 'ipt_connlimit: Oops: invalid ct state' error messages scrolling up the screen.
But when did it start? In 2.6.17?

Sorry - should have said. It has always done it. I thought I'd take the opportunity to ask as I've never found the answer.

Quoted 4 lines

Quoted 2 lines
Is it safe for me to edit ipt_connlimit.c to not print them? Or are they telling me there is something wrong with my setup?
Plase try adding "-m conntrack --ctstate INVALID -j DROP" before "-m connlimit (...)". Did it help?

Yes, that sorts it. I have a lot of clients on my network and these look like they're generated by some p2p software of one PC.

Many thanks,

Andy