编译内核和iptables及安装l7proto
一、环境介绍
操作系统：Redhat5.8_64bit
需要软件包：
linux-2.6.28.10.tar.gz
netfilter-layer7-v2.22.tar.gz
l7-protocols-2009-05-28.tar.gz
iptables-1.4.6.tar.bz2
安装步骤：
1)、给内核打补丁，并重新编译内核
2)、给iptables源码打补丁，并重新编译iptables
3)、安装l7proto
1、给内核打补丁并重新编译内核
[root@localhost ~]# uname -r //Redhat5.8自带内核版本是2.6.18
2.6.18-308.el5
# tar zxvf linux-2.6.28.10.tar.gz -C /usr/src //解压linux-2.6.28
# tar zxvf netfilter-layer7-v2.22.tar.gz -C /usr/src //解压netfilter-layer7
# cd /usr/src/
# ln -s linux-2.6.28 linux
# cd /usr/src/linux/
# patch -p1 < ../netfilter-layer7-v2.22/kernel-2.6.25-2.6.28-layer7-2.22.patch
patching file net/netfilter/Kconfig
patching file net/netfilter/Makefile
patching file net/netfilter/xt_layer7.c
patching file net/netfilter/regexp/regexp.c
patching file net/netfilter/regexp/regexp.h
patching file net/netfilter/regexp/regmagic.h
patching file net/netfilter/regexp/regsub.c
patching file net/netfilter/nf_conntrack_core.c
patching file net/netfilter/nf_conntrack_standalone.c
patching file include/net/netfilter/nf_conntrack.h
patching file include/linux/netfilter/xt_layer7.h
# cp /boot/config-2.6.18-308.el5 /usr/src/linux/.config
# make menuconfig
提示：make menuconfig之前确保下面开发环境安装好了：
Development Libraries
Development Tools
执行：make menuconfig如下错误提示：
scripts/kconfig/mconf arch/x86/Kconfig
.config:1365:warning: symbol value 'm' invalid for FIXED_PHY
.config:1671:warning: symbol value 'm' invalid for ISDN
.config:2789:warning: symbol value 'm' invalid for RTC_INTF_SYSFS
.config:2790:warning: symbol value 'm' invalid for RTC_INTF_PROC
.config:2791:warning: symbol value 'm' invalid for RTC_INTF_DEV
.config:2813:warning: symbol value 'm' invalid for DMA_ENGINE
Your display is too small to run Menuconfig!
It must be at least 19 lines by 80 columns.
make[1]: *** [menuconfig] Error 1
make: *** [menuconfig] Error 2
原因：终端窗口大小了，导致的。
General setup ---> ()Local version - append to kernel release -->输入：-layer7 -->OK --> Exit
Processor type and features ---> Processor family (Generic-x86-64) ---> (X) Core 2/newer Xeon
Networking support → Networking Options →Network packet filtering framework →Core Netfilter Configuration
<M> Netfilter connection tracking support
<M> “layer7” match support
<M> “string” match support
<M> “time” match support
<M> “iprange” match support
<M> FTP protocol support
<M> Connection tracking netlink interface
<M> “connlimit” match support
<M> “state” match support
<M> “conntrack” connection match support
<M> “mac” address match support
<M> "multiport" Multiple port match support
Networking support → Networking Options →Network packet filtering framework → IP: Netfilter Configuration
<M> IPv4 connection tracking support (required for NAT)
<M> Full NAT
<M> MASQUERADE target support
<M> NETMAP target support
<M> REDIRECT target support
# screen //防止make时候中断
# make
# make modules_install
# make install
2、编译新版本iptables
# cp /etc/init.d/iptables ~/iptables
# cp /etc/sysconfig/iptables-config ~/
# cp /etc/sysconfig/iptables ~/iptables.rules
# service iptables stop
# chkconfig iptables off
# rpm -e iptables-ipv6 iptables iptstate --nodeps
# tar jxvf iptables-1.4.6.tar.bz2 –C /usr/src
# cd /usr/src/iptables-1.4.6
# cp ../netfilter-layer7-v2.22/iptables-1.4.3forward-for-kernel-2.6.20forward/libxt_layer7.* ./extensions/
# ./configure --prefix=/usr --with-ksource=/usr/src/linux
# make
# make install
# which iptables
/usr/sbin/iptables
# vim ~/iptables -->修改如下内容
if [ ! -x /usr/sbin/$IPTABLES ]; then
echo -n $"/usr/sbin/$IPTABLES does not exist."; warning; echo
exit 0
fi
# cp ~/iptables /etc/init.d/
# chkconfig --add iptables
# cp ~/iptables-configs /etc/sysconfig/
# service iptables start
Applying iptables firewall rules: [ OK ]
Loading additional iptables modules: ip_nat_ftp ip_conntrac[ OK ]
3、安装l7-protocols
# tar zxvf l7-protocols-2009-05-28.tar.gz
# cd l7-protocols-2009-05-28
# make install
mkdir -p /etc/l7-protocols
cp -R * /etc/l7-protocols
# service iptables restart
