Perl Modul IPTables::IPv4

[rsi]

Hallo,

ich wollte unter Debian in einem Script IPTables::IPv4 benutzen, musste aber feststellen, dass dies in Debian nicht vorhanden ist.
Nun wollte ich dies direkt über CPAN installieren / kompilieren, aber auch dies geht nicht und ich bekomme folgende Fehlermeldung.

Code: Alles auswählen

IPTables.xs:34:22: fatal error: iptables.h: No such file or directory

iptables-dev ist installiert.
Was nun? Hat jemand eine Idee?

[inne]

Die Datei befindet sich im Paket kernel-headers-...

[rsi]

Soweit ich das sehe, sind alle korrekt installiert.

Code: Alles auswählen

Sat Sep 12/16:51:root@sabretooth:~# apt-search headers | grep "^i"
i   linux-headers-3.2.0-4-amd64     - Header files for Linux 3.2.0-4-amd64
i   linux-headers-3.2.0-4-common    - Common header files for Linux 3.2.0-4

Code: Alles auswählen

Sat Sep 12/16:51:root@sabretooth:~# apt-install linux-kernel-headers linux-headers
No packages will be installed, upgraded, or removed.
0 packages upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B of archives. After unpacking 0 B will be used.
localepurge: Disk space freed in /usr/share/locale: 0 KiB
localepurge: Disk space freed in /usr/share/man: 0 KiB
localepurge: Disk space freed in /usr/share/omf: 0 KiB

Total disk space freed by localepurge: 0 KiB

Oder übersehe ich irgend wo was?

Allerdings habe ich jetzt auch mal versucht, IPTables::IPv4 zu installieren, aber geht auch wieder nicht... wegen Fehler.

Code: Alles auswählen

Executing /usr/bin/perl Makefile.PL  && make ..
                                                                                                    
Checking if your kit is complete...
Looks good
Writing Makefile for IPTables::IPv4
Writing MYMETA.yml
cp IPv4/Chain.pm blib/lib/IPTables/IPv4/Chain.pm
cp IPv4/TableTie.pm blib/lib/IPTables/IPv4/TableTie.pm
cp IPv4.pm blib/lib/IPTables/IPv4.pm
AutoSplitting blib/lib/IPTables/IPv4.pm (blib/lib/auto/IPTables/IPv4)
cp IPv6.pm blib/lib/IPTables/IPv6.pm
AutoSplitting blib/lib/IPTables/IPv6.pm (blib/lib/auto/IPTables/IPv6)
cp IPv4/Rule.pm blib/lib/IPTables/IPv4/Rule.pm
cp IPv4/Toplevel.pm blib/lib/IPTables/IPv4/Toplevel.pm
cp IPv4/RuleList.pm blib/lib/IPTables/IPv4/RuleList.pm
/usr/bin/perl /usr/share/perl/5.14/ExtUtils/xsubpp -noprototypes -typemap /usr/share/perl/5.14/ExtUt
ils/typemap -typemap IPTables.typemap  IPv4.xs > IPv4.xsc && mv IPv4.xsc IPv4.c
cc -c  -Iinclude -I/usr/src/linux/include -Wall -DMODULE_PATH=\"/usr/local/lib/IPTables-IPv4\" -DPER
L_USES_64BIT_INT -O2 -g   -DVERSION=\"0.98\" -DXS_VERSION=\"0.98\" -fPIC "-I/usr/lib/perl/5.14/CORE"
   IPv4.c
IPv4.c: In function 'XS_IPTables__IPv4__Table_list_chains':
IPv4.xs:78:9: warning: variable 'sv' set but not used [-Wunused-but-set-variable]
IPv4.c: In function 'XS_IPTables__IPv4__Table_list_rules':
IPv4.xs:97:11: warning: variable 'sv' set but not used [-Wunused-but-set-variable]
IPv4.c: In function 'XS_IPTables__IPv4__Table_get_policy':
IPv4.xs:129:11: warning: variable 'sv' set but not used [-Wunused-but-set-variable]
IPv4.xs: In function 'XS_IPTables__IPv4__Table_get_references':
IPv4.xs:379:3: warning: pointer targets in passing argument 1 of 'iptc_get_references' differ in sig
nedness [-Wpointer-sign]
In file included from IPv4.xs:28:0:
include/libiptc/libiptc.h:132:5: note: expected 'unsigned int *' but argument is of type 'int *'
cc -c  -Iinclude -I/usr/src/linux/include -Wall -DMODULE_PATH=\"/usr/local/lib/IPTables-IPv4\" -DPER
L_USES_64BIT_INT -O2 -g   -DVERSION=\"0.98\" -DXS_VERSION=\"0.98\" -fPIC "-I/usr/lib/perl/5.14/CORE"
   loader.c
cc -c  -Iinclude -I/usr/src/linux/include -Wall -DMODULE_PATH=\"/usr/local/lib/IPTables-IPv4\" -DPER
L_USES_64BIT_INT -O2 -g   -DVERSION=\"0.98\" -DXS_VERSION=\"0.98\" -fPIC "-I/usr/lib/perl/5.14/CORE"
   packer.c
packer.c: In function 'ipt_do_pack':
packer.c:261:5: warning: passing argument 3 of 'Perl_sv_2pv_flags' from incompatible pointer type [e
nabled by default]
In file included from /usr/lib/perl/5.14/CORE/perl.h:5036:0,
                 from packer.c:26:
/usr/lib/perl/5.14/CORE/proto.h:3565:21: note: expected 'STRLEN * const' but argument is of type 'un
signed int *'
packer.c:319:5: warning: passing argument 3 of 'Perl_sv_2pv_flags' from incompatible pointer type [e
nabled by default]
In file included from /usr/lib/perl/5.14/CORE/perl.h:5036:0,
                 from packer.c:26:
/usr/lib/perl/5.14/CORE/proto.h:3565:21: note: expected 'STRLEN * const' but argument is of type 'un
signed int *'
packer.c:380:3: warning: passing argument 3 of 'Perl_sv_2pv_flags' from incompatible pointer type [e
nabled by default]
In file included from /usr/lib/perl/5.14/CORE/perl.h:5036:0,
                 from packer.c:26:
/usr/lib/perl/5.14/CORE/proto.h:3565:21: note: expected 'STRLEN * const' but argument is of type 'un
signed int *'
cc -c  -Iinclude -I/usr/src/linux/include -Wall -DMODULE_PATH=\"/usr/local/lib/IPTables-IPv4\" -DPER
L_USES_64BIT_INT -O2 -g   -DVERSION=\"0.98\" -DXS_VERSION=\"0.98\" -fPIC "-I/usr/lib/perl/5.14/CORE"
   unpacker.c
unpacker.c: In function 'ipt_do_unpack':
unpacker.c:132:3: warning: value computed is not used [-Wunused-value]
unpacker.c:139:3: warning: value computed is not used [-Wunused-value]
unpacker.c:150:3: warning: value computed is not used [-Wunused-value]
unpacker.c:162:3: warning: value computed is not used [-Wunused-value]
unpacker.c:189:3: warning: value computed is not used [-Wunused-value]
unpacker.c:195:3: warning: value computed is not used [-Wunused-value]
unpacker.c:204:4: warning: value computed is not used [-Wunused-value]
unpacker.c:217:5: warning: value computed is not used [-Wunused-value]
unpacker.c:252:4: warning: value computed is not used [-Wunused-value]
unpacker.c:261:3: warning: value computed is not used [-Wunused-value]
unpacker.c:265:2: warning: value computed is not used [-Wunused-value]
unpacker.c:268:2: warning: value computed is not used [-Wunused-value]
cc -c  -Iinclude -I/usr/src/linux/include -Wall -DMODULE_PATH=\"/usr/local/lib/IPTables-IPv4\" -DPER
L_USES_64BIT_INT -O2 -g   -DVERSION=\"0.98\" -DXS_VERSION=\"0.98\" -fPIC "-I/usr/lib/perl/5.14/CORE"
   maskgen.c
make -C libiptc/ all
make[1]: Entering directory `/tmp/.webmin/IPTables-IPv4-0.98/libiptc'
gcc -o libip4tc.o -c libip4tc.c -I../include -I/usr/src/linux/include -DIPTABLES_VERSION=\"1.2.8\" -
O2 -Wall
In file included from libip4tc.c:116:0:
libiptc.c:62:8: error: redefinition of 'struct xt_error_target'
In file included from /usr/include/linux/netfilter_ipv4/ip_tables.h:22:0,
                 from ../include/libiptc/libiptc.h:6,
                 from libip4tc.c:29:
/usr/include/linux/netfilter/x_tables.h:69:8: note: originally defined here
In file included from libip4tc.c:116:0:
libiptc.c: In function 'entry2index':
libiptc.c:136:4: warning: format '%i' expects argument of type 'int', but argument 3 has type 'long 
int' [-Wformat]
libiptc.c: In function 'iptc_init':
libiptc.c:312:10: warning: pointer targets in passing argument 5 of 'getsockopt' differ in signednes
s [-Wpointer-sign]
In file included from /usr/include/netinet/in.h:25:0,
                 from /usr/include/netinet/ip.h:25,
                 from ../include/libiptc/ipt_kernel_headers.h:9,
                 from ../include/libiptc/libiptc.h:5,
                 from libip4tc.c:29:
/usr/include/x86_64-linux-gnu/sys/socket.h:190:12: note: expected 'socklen_t * __restrict__' but arg
ument is of type 'int *'
In file included from libip4tc.c:116:0:
libiptc.c: In function 'target_name':
libiptc.c:727:2: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstri
ct-aliasing]
libiptc.c: In function 'iptc_zero_counter':
libiptc.c:1396:16: warning: variable 'e' set but not used [-Wunused-but-set-variable]
libip4tc.c: In function 'dump_entry':
libip4tc.c:170:3: warning: dereferencing type-punned pointer will break strict-aliasing rules [-Wstr
ict-aliasing]
make[1]: *** [libip4tc.o] Error 1
make[1]: Leaving directory `/tmp/.webmin/IPTables-IPv4-0.98/libiptc'
make: *** [libiptc/libiptc.a] Error 2

[inne]

Ich kann dir nicht weiterhelfen.

Ansonsten hat das IPTables::IPv4 Modul eine Maillingliste, vlt. wendest du dich direkt dorthin: http://lists.sourceforge.net/lists/list ... rl-general

Mehr habe jezt beim überfliegen der README auch nicht herrausgelesen...

This particular module has certain advantages over other similar modules:

[...]

- This code includes a snap of libiptc, with a few minor changes to
correct error string problems I discovered. That means that this
package is 100% self-contained - it does not require any acrobatics
with installing libiptc.a and the libiptc/iptables headers in unusual
locations to build.


Quick how-to on building IPTables:

Code: Alles auswählen

tar zxf IPTables-IPv4-<version>.tar.gz -C <target dir>
cd <target dir>/IPTables-IPv4-<version>
perl Makefile.PL
make
make test # from here on must be as root! this will fail if not!
make install

[inne]

Code: Alles auswählen

Executing /usr/bin/perl Makefile.PL  && make ..
[...]
                               libiptc.c:62:8: error: redefinition of 'struct xt_error_target'
In file included from /usr/include/linux/netfilter_ipv4/ip_tables.h:22:0,
                 from ../include/libiptc/libiptc.h:6,
                 from libip4tc.c:29:
[...]

Hm, liest sich doch fast wie ein Programmierfehler :-/

[rsi]

Ich habe auch das Empfinden, dass IPTables bzw. IPTables::IPv4 nicht ganz in Ordnung sind.
Da es aber noch IPTables::Parse und andere gibt, die unter Debian vorhanden sind, versuche ich es auf diesem Weg, statt mich lange mit IPTables / IPTables::IPv4 herum zu schlagen.

Trotzdem, danke für die Hilfe!

[inne]

Da es aber noch IPTables::Parse und andere gibt, die unter Debian vorhanden sind,

Evtl. könntest du hier mal fragen, welches Modul empfohlen wird: http://www.perl-community.de
Für das was du vorhast...

[rsi]

Danke für den Hinweis / Link, ich habe mich aber jetzt entschieden nur IPTables::Parse zu benutzen und die iptable nicht direkt aus Perl zu "verändern", sondern nur die Überprüfungen damit zu machen. Änderungen mache ich dann manuell direkt mit iptables.
Ist vielleicht die beste und auch sicherste Lösung.

[Cae]

sondern nur die Überprüfungen damit zu machen. Änderungen mache ich dann manuell direkt mit iptables.

Dann koennte vielleicht iptables-restore fuer dich interessant sein, welches eine Datei im Ausgangsformat von iptables-save nur dann laedt, wenn sie fehlerfrei geparst werden kann. Das Format ist praktisch identisch mit iptables-Aufrufen.

Gruss Cae