[问题求助]l7-filter-usespace收不到iptables的QUEUE [复制链接]

最近在探索l7.-.filter-userspace，使用包里默认.的配置文件，在执行l7-filter -f <configfile> -v -v -v -v 以后输出：电脑
unbind.ing exi.sting nf_queue handler for AF_INET (if any)            杀毒

binding nfnetlink_queue as nf_queue handle.r. for AF_INET.

binding .this .socket to queue '0'             汽车

setting .copy_packet mode.
复制代码

然后就停止不动，看了下程序，是在void l7_queue::start(int qu.euenum) 中.阻塞：外贸
...

  l7printf(3, "setting copy_.packet. mode\n");.

  if(nfq_set_mode(qh, NF.QNL_COPY_PACK.ET, 0xffff) < 0) {(        游戏          )

    cerr << "can't .set pac.ket_copy mode\n";学习

    exit(1);

  }



  nh = nfq_nfnlh(h).;            杀毒

  fd = nfnl_f.d(nh);.



  // this is the main. loop.           建材

  while (tru.e){.

    while ((rv = recv(fd, buf,. sizeof(buf), 0)) && rv. >= 0)    健康

      nfq_handle_packet(h, bu.f, rv).;    美容

...
复制代码
即re.cv()函数阻塞，我的理解是l7-filter没有受到iptables发过.来的封包；[成人用品]
又查了半天iptables的配置，.因为之前没怎么接触过，还是没有头绪，以下是ip.tables的配置：<性病>
[root@fedora7 sysconfi.g]# vi /etc/sysconfig/ip.tables           女人

# Firewall configuration writte.n by system-config-s.ecuritylevel.

# M.anual custo.mization of this file is not recommended.           鲜花

*filter

:INPUT ACCEPT. [0:0]            杀毒

:FORWARD ACCEPT [.0:0]             汽车

:OUT.PUT ACCEPT [0:0]域名

-A .FORWARD -j NFQUEUE.

COMMIT

*mangle

:P.REROUTING ACCEPT [0:0]电脑

:INPUT ACCEPT .[0:0].

:FORWA.RD ACCEPT [0:0]投资

:OUTPUT. ACCEPT [0:0]--------------彩票

:POSTROUTING ACCEPT [0.:0]教育

COMMIT



[root@fedora7 sysconfig]# .iptables. -L--- 印刷

Chain INPU..T (policy ACCEPT).

target     prot opt source.           .    destination         (广告)



Chain FORWARD (.p.olicy ACCEPT)           鲜花

targe.t     prot op.t source               destination             健康

NF.QUEUE    0    --  anywhere             anywhere            NFQUEUE. num 0<性病>



Chain OUTPU.T (policy ACCEPT)..

ta.rget     .prot opt source               destination             健康
复制代码
日志文件中有类似输出：
Jan 30 16:20:28 fedora7 kernel: ip_tables: (C) 2000-2006 Netfil.ter Co.re T.eam(        游戏          )

Jan 30 16:23:.09 fedora7 kernel: ip_conntrack version 2.4 (4090 buckets, 32720 max) - 196 byt.es per c.onntrack.

Jan 30 16:23:09 fedora7 kernel: ctnetlink v0.90: registerin.g with nfn.etli.nk.健康
复制代码
机器有两个网卡：
[root@fedora7 .sysconfig]# ifconfig .-a.

eth0      L.ink encap:Ethernet  HWaddr 00:08:A1:05:24:B.5             女人

  .        inet addr:192.168.5.200  Bcast:192.1.68.5.255  Mask:255.255.255.0虚拟主机

       .   inet6 addr: fe80::208:a1ff:fe05:24b.5/64 Scope:Link.

         . UP BROADCA.ST RUNNING MULTICAST  MTU:1500  Metric:1           女人

          RX packets:208405 errors:0 dropp.ed:0 o.verruns:0 frame:0电脑

          TX pack..ets:40379 errors:0 dropped:0 overruns:0 carrier:0服务器

      .    collis.ions:0 txqueuelen:1000 电脑

          RX bytes:23832515 (22.7 MiB)  TX bytes:1514695.4. (14.4 MiB)    美容

     .     Interrupt:11 Base .address:0xd800 .



eth1      Lin.k encap:Ethernet  HWaddr 00:0.8:A1:05:22:9F  <性病>

.         inet addr:192.168.5.25.4  Bcast:192.168.5.255  Mask:255.255.255.0(广告)

          inet6 .addr: fe80::208:a1ff:fe.05:229f/64 Scope:Link

          UP BROADC.A.ST RUNNING MULTICAST  MTU:1500  Metric:1.

          RX packets:.67.85040 errors:0 dropped:0 overruns:0 frame:0虚拟主机

          TX. packe.ts:823 errors:0 dropped:0 overruns:0 carrier:0<性病>

          collision.s:0 txqueuelen:1000. .

          RX bytes:3537398437 (3.2 GiB)  T.X bytes:41836 .(40.8 KiB).

          Interrupt:9 Base addre.ss:0xd4.00     健康



lo        Link. encap.:Local Loopback             女人

          inet addr:127.0.0.1  Mask:.255.0.0..0<性病>

          inet6 ad.dr: ::1/128 Scope:.Host投资

          U.P LOOPBACK RUNNING  MTU:16436  Met.ric:1          婚庆

          RX packets:4.138 errors:0 d.ropped:0 overruns:0 frame:0域名

      .    TX packets:4138 errors:0 dr.opped:0 overruns:0 carrier:0          婚庆

          collisions:.0 txqueuele.n:0 虚拟主机

          RX bytes:23549732 (22.4 MiB).  TX .bytes:23549732 (22.4 MiB)电脑
复制代码
其中e.th0是交换机镜像输出的端.口(不过也可以从该地址登录上来)，eth1是控制端口，也可以从该地址登录上来。电脑

各位帮我看看问题大概出.在那一步？谢谢。.

[ 本帖最后由 dige.x 于 2.008-1-30 16:35 编辑 ]    健康

自顶.iptables-1.3.7,l7-filter-userspace-v0.4 ,操作系统，Linux fedora7 2.6.21 #1 SMP Mon Jan 28 16:02:43 CST 2008 i686 i686 i386 GNU/Linux

参照http://l7-filter.sourceforge.net/HOWTO-userspace
For Linux 2.6.20 and newer, Netfilter has new "Layer 3 Independent Connection tracking" which l7-filter is not yet compatible with (mostly due to lack of library support from libnetfilter_conntrack). While the old layer 3 dependent connection tracking is still available, it is not selected by default, so you will probably need to recompile your kernel with it. In the Linux kernel config, go to Networking → Networking options → Network packet filtering framework (Netfilter) → Core Netfilter Configuration. Under "Netfilter connection tracking support", select "Layer 3 Dependent Connection tracking (OBSOLETE)". Then go to Networking → Networking options → Network packet filtering framework → IP: Netfilter Configuration" and enable "Connection tracking netlink interface" (and probably most of the rest of the stuff on that page). This is a pain in the ass, sorry!
将该页里的模块全部选中，重新编译下内核就好了。

内核不支持 netlink 吧？

将 Networking → Networking options → Network packet filtering framework → IP: Netfilter Configuration" 页面里全部选项选中以后，重新编译了下内核就可以了。
iptables -A FORWARD -j NFQUEUE 发现l7-filter受到的包很少，增加了
iptables -A INPUT -i eth1 -j NFQUEUE，l7-filter受到的包倒是多很多，
不过识别的好像不太理想，配置文件：
msn-filetransfer        55
msnmessenger    56
qq      68
xunlei  110
skypeout        78
skypetoskype    79
ssh     87
telnet  94
tftp    96
bittorrent      16
dhcp    24
dns     26
edonkey 28
ftp     32
http    43
jabber  49
pop3    67
sip     77
识别的有dhcp dns edonkey qq skypeout skypetoskype。
这是通过l7-filter -v -v -v -v 输出日志里的 “matched dhcp”之类的信息来判断，不知道是否准确。
还有下一步该做什么工作？