Dotaz: modul ipp2p (xtables) pro ip6tables? No such file or directory

[PepeONaChair]

Zdravim vas,

mozna uz jste se s tim setkali, tak bych rad pozadal o radu/nasmerovani.

Jal jsem se prepisovat iptables pravidla tak, aby fungovala i pro ip6tables. (zatim neprechazim na nftables, ale to prijde casem...)

Nefunguje mi pravidlo:

$ ip6tables -t mangle -A PREROUTING -m ipp2p --dc -j ACCEPT

ip6tables v1.8.4 (legacy): Couldn't load match `ipp2p':No such file or directory

Try `ip6tables -h' or 'ip6tables --help' for more information.

pkg-xtables-addons mam instalovany ze zdrojaku (verzi pkg-xtables-addons-debian-3.18-1) do Debianu 10 a ve 4kovych iptables to funguje jak ma:

$ iptables -m ipp2p --help

iptables v1.8.4

Usage: iptables -[ACD] chain rule-specification [options]

... zkraceno...

Je treba potreba xtables kompilovat s podporou ip6tables? Nic takovyho jsem ale nevygooglil.

dekuju

Pep.

Odpovědi

[X]

Dej pred ip6tables strace at se ukaze, kde to hleda ten modul..

[PepeONaChair]

Provedl jsem, ale obavam se ze to, co to vypsano je dalece nad moji mozkovou kapacitu :)

$ strace ip6tables -t mangle -A PREROUTING -m ipp2p --dc -j ACCEPT
execve("/usr/sbin/ip6tables", ["ip6tables", "-t", "mangle", "-A", "PREROUTING", "-m", "ipp2p", "--dc", "-j", "ACCEPT"], 0x7ffdd354b778 /* 18 vars */) = 0
brk(NULL)                               = 0x564a5f5ec000
access("/etc/ld.so.preload", R_OK)      = -1 ENOENT (Adresář nebo soubor neexistuje)
openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=25836, ...}) = 0
mmap(NULL, 25836, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f7d55a8c000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libip4tc.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\220!\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=35280, ...}) = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7d55a8a000
mmap(NULL, 37440, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7d55a80000
mmap(0x7f7d55a82000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d55a82000
mmap(0x7f7d55a86000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f7d55a86000
mmap(0x7f7d55a88000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7f7d55a88000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libip6tc.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\300!\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=35280, ...}) = 0
mmap(NULL, 37440, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7d55a76000
mmap(0x7f7d55a78000, 16384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d55a78000
mmap(0x7f7d55a7c000, 8192, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x6000) = 0x7f7d55a7c000
mmap(0x7f7d55a7e000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x7000) = 0x7f7d55a7e000
close(3)                                = 0
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libxtables.so.12", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320F\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=63408, ...}) = 0
mmap(NULL, 77000, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7d55a63000
mprotect(0x7f7d55a67000, 45056, PROT_NONE) = 0
mmap(0x7f7d55a67000, 28672, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f7d55a67000
mmap(0x7f7d55a6e000, 12288, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xb000) = 0x7f7d55a6e000
mmap(0x7f7d55a72000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0xe000) = 0x7f7d55a72000
mmap(0x7f7d55a74000, 7368, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f7d55a74000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\320l\2\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=1820104, ...}) = 0
mmap(NULL, 1832568, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7d558a3000
mprotect(0x7f7d558c8000, 1642496, PROT_NONE) = 0
mmap(0x7f7d558c8000, 1339392, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x25000) = 0x7f7d558c8000
mmap(0x7f7d55a0f000, 299008, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x16c000) = 0x7f7d55a0f000
mmap(0x7f7d55a59000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1b5000) = 0x7f7d55a59000
mmap(0x7f7d55a5f000, 13944, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f7d55a5f000
close(3)                                = 0
openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libdl.so.2", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0000\21\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0644, st_size=14592, ...}) = 0
mmap(NULL, 16656, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7d5589e000
mmap(0x7f7d5589f000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7f7d5589f000
mmap(0x7f7d558a0000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d558a0000
mmap(0x7f7d558a1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d558a1000
close(3)                                = 0
mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f7d5589c000
arch_prctl(ARCH_SET_FS, 0x7f7d5589d000) = 0
mprotect(0x7f7d55a59000, 12288, PROT_READ) = 0
mprotect(0x7f7d558a1000, 4096, PROT_READ) = 0
mprotect(0x7f7d55a72000, 4096, PROT_READ) = 0
mprotect(0x7f7d55a7e000, 4096, PROT_READ) = 0
mprotect(0x7f7d55a88000, 4096, PROT_READ) = 0
mprotect(0x564a5ef66000, 4096, PROT_READ) = 0
mprotect(0x7f7d55abb000, 4096, PROT_READ) = 0
munmap(0x7f7d55a8c000, 25836)           = 0
stat("/usr/lib/x86_64-linux-gnu/xtables/libip6t_ipp2p.so", 0x7ffe8d53a9d0) = -1 ENOENT (Adresář nebo soubor neexistuje)
stat("/usr/lib/x86_64-linux-gnu/xtables/libxt_ipp2p.so", {st_mode=S_IFREG|0755, st_size=33440, ...}) = 0
brk(NULL)                               = 0x564a5f5ec000
brk(0x564a5f60d000)                     = 0x564a5f60d000
openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/xtables/libxt_ipp2p.so", O_RDONLY|O_CLOEXEC) = 3
read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0p\20\0\0\0\0\0\0"..., 832) = 832
fstat(3, {st_mode=S_IFREG|0755, st_size=33440, ...}) = 0
mmap(NULL, 16680, PROT_READ, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f7d55a8e000
mmap(0x7f7d55a8f000, 4096, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1000) = 0x7f7d55a8f000
mmap(0x7f7d55a90000, 4096, PROT_READ, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d55a90000
mmap(0x7f7d55a91000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x2000) = 0x7f7d55a91000
close(3)                                = 0
mprotect(0x7f7d55a91000, 4096, PROT_READ) = 0
write(2, "ip6tables v1.8.4 (legacy): ", 27ip6tables v1.8.4 (legacy): ) = 27
write(2, "Couldn't load match `ipp2p':No s"..., 54Couldn't load match `ipp2p':No such file or directory
) = 54
write(2, "\n", 1
)                       = 1
write(2, "Try `ip6tables -h' or 'ip6tables"..., 63Try `ip6tables -h' or 'ip6tables --help' for more information.
) = 63
exit_group(2)                           = ?
+++ exited with 2 +++

[X]

Kousek od konce to tam mas:

stat("/usr/lib/x86_64-linux-gnu/xtables/libip6t_ipp2p.so", 0x7ffe8d53a9d0) = -1 ENOENT (Adresář nebo soubor neexistuje)

Rekl bych, ze ipp2p modul pro IPv6 proste neni k dispozici a budes to muset vyresit jinak.

[PepeONaChair]

Jaaaj, to by bylo nemile, ale co uz. Kazdopadne velmi dekuju za vasi pomoc. Jeste jsem zkusil napsat na forum developeru, tak uvidim :)

diiiky Pep.

[PepeONaChair]

V patek jsem napsal do developerskeho fora, skoro hned mi nekdo odpovedel, ze IPP2P nema podporu IPv6.

A dneska dopoledne (pondeli) mi v mejlu pristaly 4 patche, ktere maji podporu IPv6 pro IPP2P zapinat. Zatim jsem to netestoval, ale i tak, to je proste parada, neuveritelne ;)

[j]

Jen tak pro zajimavost, jakej problem timhle resis? Paac IMO resis neco uplne jinde, nez bys mel.

---

Dete s tim guuglem dopice!

[PepeONaChair]

Je to takove prilepseni k dalsim funkcim stroje, ktery ridi datovy provoz ve firme a zajistuje, aby se nas uplink prilis neucpaval.