内核增加layer7模块后找不到:<M> Layer 7 match support

errai
内核增加layer7模块后找不到:<M> Layer 7 match support

内核增加layer7模块后找不到:<M> Layer 7 match support
具体过程如下:
下载:iptables-1.3.7.tar.bz2  l7-protocols-2008-04-23.tar.gz   netfilter-layer7-v2.18.tar.gz linux-2.6.19.7.tar.bz2
全部放置与/usr/src下
[root@mail src]# tar jxvf linux-2.6.19.7.tar.bz2
..............
[root@mail src]# tar zxvf netfilter-layer7-v2.18.tar.gz
[root@mail src]# mv linux-2.6.19.7 linux
[root@mail src]# cd linux
[root@mail linux]# patch -p1 < /usr/src/netfilter-layer7-v2.18/kernel-2.6.25-layer7-2.18.patch
patching file net/netfilter/Kconfig
Hunk #1 succeeded at 432 (offset -303 lines).
patching file net/netfilter/Makefile
Hunk #1 succeeded at 52 (offset -25 lines).
patching file net/netfilter/xt_layer7.c
patching file net/netfilter/regexp/regexp.c
patching file net/netfilter/regexp/regexp.h
patching file net/netfilter/regexp/regmagic.h
patching file net/netfilter/regexp/regsub.c
patching file net/netfilter/nf_conntrack_core.c
Hunk #1 succeeded at 582 with fuzz 1 (offset 372 lines).
patching file net/netfilter/nf_conntrack_standalone.c
Hunk #1 FAILED at 181.
1 out of 1 hunk FAILED -- saving rejects to file net/netfilter/nf_conntrack_standalone.c.rej
patching file include/net/netfilter/nf_conntrack.h
Hunk #1 succeeded at 117 (offset -7 lines).
patching file include/linux/netfilter/xt_layer7.h
[root@mail linux]#make menuconfig
进入Networking options再进入IP:Netfilter Configuration
进入后可以找到如下:
Networking –> Networking options –>
    [*] Network packet filtering (replaces ipchains) –>
        IP: Netfilter Configuration –>
            <M> Connection tracking (required for masq/NAT)

           [*] Connection tracking flow accounting

           <M> IP tables support (required for filtering/masq/NAT)
就是 <M> Layer 7 match support不见踪影,都patch N回了,也换了好多kenerl,不知道是不是PATCH不对还是别的原因

恳求platinum 大师指点

platinum
你的 net/netfilter/nf_conntrack_standalone.c 打补丁失败了
就算 menu 里出现了那个选项，最终也不能完成编译，或者编译后不能正常使用
换 2.6.23 应该没有问题

[[i] 本帖最后由 platinum 于 2008-5-17 11:32 编辑 [/i]]

errai
谢谢回复

非常感谢您的回复
后来我用了
/usr/src/netfilter-layer7-v2.18/for_older_kernels/kernel-2.6.18-2.6.19-layer7-2.9.patch
[root@mail linux]# patch -p1 < /usr/src/netfilter-layer7-v2.18/for_older_kernels/kernel-2.6.18-2.6.19-layer7-2.9.patch
patching file include/linux/netfilter_ipv4/ip_conntrack.h
patching file include/linux/netfilter_ipv4/ipt_layer7.h
patching file net/ipv4/netfilter/Kconfig
patching file net/ipv4/netfilter/Makefile
patching file net/ipv4/netfilter/ip_conntrack_core.c
patching file net/ipv4/netfilter/ip_conntrack_standalone.c
patching file net/ipv4/netfilter/ipt_layer7.c
patching file net/ipv4/netfilter/regexp/regexp.c
patching file net/ipv4/netfilter/regexp/regexp.h
patching file net/ipv4/netfilter/regexp/regmagic.h
patching file net/ipv4/netfilter/regexp/regsub.c
[root@mail linux]#
看起来象是patch成功了
这个补丁打上后OK,但还是在:
Networking  --->
Networking options  --->
[*] Network packet filtering (replaces ipchains)  --->
      Core Netfilter Configuration  --->这里选上一些选项后,下面的
     IP: Netfilter Configuration  ---> 里才出现了:
<M>   Layer 7 match support (EXPERIMENTAL)                                                
[*]     Layer 7 debugging output         
这一项目,因为我在Core Netfilter Configuration  --->里选择了蛮多项,也不知道是那一项选了之后才出现这一项的,很纳闷,在没选Core Netfilter Configuration  --->这里之前, IP: Netfilter Configuration  ---> 里绝对没有layer7的选项   
然后先卸载iptables,再给iptables-1.3.7打补丁,安装:
[root@mail linux]# cd iptables-1.3.7
[root@mail linux]# patch -p1 < ../netfilter-layer7-v2.18/iptables-1.3-for-kernel-2.6.20forward-layer7-2.18.patch
打的补丁是这个文件,没有找到类似于其他例子中的如:iptables-layer7-2.0.patch象这样文件名比较简洁的文件
patching file extensions/.layer7-test
patching file extensions/libipt_layer7.c
patching file extensions/libipt_layer7.man
[root@mail linux]# chmod +x extensions/.layer7-test
[root@mail linux]# export KERNEL_DIR=/usr/src/linux-2.6.19.7
[root@mail linux]# export IPTABLES_DIR=/usr/src/iptables-1.3.7
[root@mail linux]# make BINDIR=/sbin LIBDIR=/lib MANDIR=/usr/share/man install
[root@mail linux]# iptables -V
iptables v1.3.7
iptables 安装完毕

然后再安装Layer7
测试:
[root@mail linux]# /sbin/iptables -F
[root@mail linux]# iptables -t mangle -I PREROUTING -m layer7 --l7proto qq -j DROP
iptables v1.3.7: Couldn't load match `layer7':/lib/iptables/libipt_layer7.so: cannot open shared object file: No such file or directory

Try `iptables -h' or 'iptables --help' for more information.

看起来layer7仍然没有成功, platinum大师看看我操作是否有误

[[i] 本帖最后由 errai 于 2008-5-17 17:05 编辑 [/i]]

errai
回复 #3 errai 的帖子

[root@mail /]# /etc/init.d/iptables restart
Unloading iptables modules:                                [  OK  ]
Applying iptables firewall rules: iptables-restore v1.2.11: iptables-restore: unable to initializetable 'filter'

Error occurred at line: 3
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
我在编译好内核安装之后,出现了这个状况,应该是 filter没有编译进去,不知道是哪个位置,大师可否指点迷津