출처 : http://www.digimoon.net/blog/342
일전에 커널과 iptables 소스를 새로 받아다가 완전히 새로 컴파일하여 geoip 모듈을 탑재하는 걸 포스팅한 적이 있는데 이번엔 기존 커널 & iptables rpm 패키지를 그대로 유지한 채 geoip 모듈만 리빌드하는 방법을 포스팅합니다.
rpm으로 기본 탑재된 커널도 충분히 재구실을 하는지라… 사실 커널 소스를 받아 컴파일해서 설치하는 건 요즘 들어선 불필요한 모듈을 뺄 수 있다는 점 외엔 거의 메리트가 없다고 봐도 무방합니다.
( http://kldp.org/node/103402 )
시간 소요도 커널을 통으로 컴파일하는 방법에 비해 훨씬 적고 간단하기에 개인적으로 선호하는 방법이 되겠습니다.
2009년 10월 31일 현재 CentOS 5.4 32bit의 최신 커널과 iptables 버전은 아래와 같네요.
[root@localhost ~]# uname -a
Linux localhost.localdomain 2.6.18-164.el5 #1 SMP Thu Sep 3 03:33:56 EDT 2009 i686 athlon i386 GNU/Linux
[root@localhost ~]# iptables -V
iptables v1.3.5
[root@localhost ~]#
Linux localhost.localdomain 2.6.18-164.el5 #1 SMP Thu Sep 3 03:33:56 EDT 2009 i686 athlon i386 GNU/Linux
[root@localhost ~]# iptables -V
iptables v1.3.5
[root@localhost ~]#
patch-o-matic-ng 구버전을 받아 압축을 풉니다.
patch-o-matic-ng 최근 버전의 경우 커널과 iptables에 ipt_geoip가 아닌 xt_geoip 모듈이 추가되는데 정보를 검색한 결과 이게 2.6.18.x 커널과 iptables 1.3.5 버전엔 맞지 않는 모듈이더군요. iptables의 경우 v1.4.3 이상이 설치되어 있어야 사용 가능합니다.
[root@localhost ~]# cd /usr/src/
[root@localhost src]# wget http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20080521.tar.bz2
--13:39:59-- http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20080521.tar.bz2
Resolving ftp.netfilter.org… 213.95.27.115, 2001:780:45:1d:20d:93ff:fe9b:e443
Connecting to ftp.netfilter.org|213.95.27.115|:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 137310 (134K) [application/x-tar]
Saving to: `patch-o-matic-ng-20071231.tar.bz2' 100%[====================================================================================>] 137,310 84.2K/s in 1.6s 13:40:02 (84.2 KB/s) - `patch-o-matic-ng-20080521.tar.bz2' saved [137310/137310]
[root@localhost src]# tar xvfj patch-o-matic-ng-20080521.tar.bz2
[root@localhost src]# wget http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20080521.tar.bz2
--13:39:59-- http://ftp.netfilter.org/pub/patch-o-matic-ng/snapshot/patch-o-matic-ng-20080521.tar.bz2
Resolving ftp.netfilter.org… 213.95.27.115, 2001:780:45:1d:20d:93ff:fe9b:e443
Connecting to ftp.netfilter.org|213.95.27.115|:80… connected.
HTTP request sent, awaiting response… 200 OK
Length: 137310 (134K) [application/x-tar]
Saving to: `patch-o-matic-ng-20071231.tar.bz2' 100%[====================================================================================>] 137,310 84.2K/s in 1.6s 13:40:02 (84.2 KB/s) - `patch-o-matic-ng-20080521.tar.bz2' saved [137310/137310]
[root@localhost src]# tar xvfj patch-o-matic-ng-20080521.tar.bz2
rpm으로 설치된 iptables에 geoip extension을 추가하려면 iptables srpm을 받아 patch-o-matic-ng를 적용하고 리빌드하여 설치해야 합니다.
아래 링크 참고하여 iptables srpm을 받습니다.
http://free4u.wo.tc/weblog/10440
srpm을 받았으면 일단 설치합니다.
[root@localhost ~]# rpm -ivh iptables-1.3.5-5.3.el5.src.rpm
/usr/src/redhat/SOURCES 디렉토리로 이동해보면 iptables 소스가 고스란히 위치해 있는 것을 확인할 수 있습니다.
[root@localhost ~]# cd /usr/src/redhat/SOURCES
[root@localhost SOURCES]# ls -l
합계 256
-rw-r--r-- 1 root root 560 9월 9 2004 iptables-1.2.10-counters.patch
-rw-r--r-- 1 root root 254 9월 9 2004 iptables-1.2.8-nolibnsl.patch
-rw-r--r-- 1 root root 359 9월 9 2004 iptables-1.2.9-netlink.patch
-rw-r--r-- 1 root root 378 2월 22 2005 iptables-1.3.0-autoload.patch
-rw-r--r-- 1 root root 2286 11월 18 2005 iptables-1.3.0-cleanup.patch
-rw-r--r-- 1 root root 398 3월 19 2005 iptables-1.3.0-no_root.patch
-rw-r--r-- 1 root root 1082 2월 22 2005 iptables-1.3.0-selinux.patch
-rw-r--r-- 1 root root 5794 5월 5 00:57 iptables-1.3.5-DSCPv6.patch
-rw-r--r-- 1 root root 732 5월 5 00:57 iptables-1.3.5-ICMP6_reject_types.patch
-rw-r--r-- 1 root root 631 1월 15 2008 iptables-1.3.5-dscp_max.patch
-rw-r--r-- 1 root root 2933 1월 15 2008 iptables-1.3.5-headers.patch
-rw-r--r-- 1 root root 1407 5월 5 00:57 iptables-1.3.5-restore_opts.patch
-rw-rw-r-- 1 root root 191820 2월 2 2006 iptables-1.3.5.tar.bz2
-rw-r--r-- 1 root root 1740 1월 20 2007 iptables-config
-rwxr-xr-x 1 root root 7460 5월 13 01:00 iptables.init
[root@localhost SOURCES]# ls -l
합계 256
-rw-r--r-- 1 root root 560 9월 9 2004 iptables-1.2.10-counters.patch
-rw-r--r-- 1 root root 254 9월 9 2004 iptables-1.2.8-nolibnsl.patch
-rw-r--r-- 1 root root 359 9월 9 2004 iptables-1.2.9-netlink.patch
-rw-r--r-- 1 root root 378 2월 22 2005 iptables-1.3.0-autoload.patch
-rw-r--r-- 1 root root 2286 11월 18 2005 iptables-1.3.0-cleanup.patch
-rw-r--r-- 1 root root 398 3월 19 2005 iptables-1.3.0-no_root.patch
-rw-r--r-- 1 root root 1082 2월 22 2005 iptables-1.3.0-selinux.patch
-rw-r--r-- 1 root root 5794 5월 5 00:57 iptables-1.3.5-DSCPv6.patch
-rw-r--r-- 1 root root 732 5월 5 00:57 iptables-1.3.5-ICMP6_reject_types.patch
-rw-r--r-- 1 root root 631 1월 15 2008 iptables-1.3.5-dscp_max.patch
-rw-r--r-- 1 root root 2933 1월 15 2008 iptables-1.3.5-headers.patch
-rw-r--r-- 1 root root 1407 5월 5 00:57 iptables-1.3.5-restore_opts.patch
-rw-rw-r-- 1 root root 191820 2월 2 2006 iptables-1.3.5.tar.bz2
-rw-r--r-- 1 root root 1740 1월 20 2007 iptables-config
-rwxr-xr-x 1 root root 7460 5월 13 01:00 iptables.init
iptables-1.3.5.tar.bz2 파일의 압축을 풀고 난 뒤…
[root@localhost SOURCES]# tar xfj iptables-1.3.5.tar.bz2
patch-o-matic-ng 패치를 가하기 위해 아래와 같이 kernel 소스와 iptables 소스가 위치한 곳을 심볼릭링크해 줍니다.
patch-o-matic-ng가 default로 찾는 커널과 iptables의 경로가 /usr/src 이기 때문에 하는 작업이죠.
[root@localhost SOURCES]# cd /usr/src
[root@localhost src]# ln -s /usr/src/redhat/SOURCES/iptables-1.3.5 /usr/src/iptables
[root@localhost src]# ln -s /usr/src/kernels/2.6.18-164.el5-i686 /usr/src/linux
[root@localhost src]# ln -s /usr/src/redhat/SOURCES/iptables-1.3.5 /usr/src/iptables
[root@localhost src]# ln -s /usr/src/kernels/2.6.18-164.el5-i686 /usr/src/linux
이제 커널과 iptables에 patch-o-matic-ng 패치를 가합니다.
[root@localhost src]# cd /usr/src/patch-o-matic-ng-20080521
[root@localhost patch-o-matic-ng-20080521]# ./runme --download
[root@localhost patch-o-matic-ng-20080521]# ./runme geoip
Welcome to Patch-o-matic ($Revision: 6736 $)! Kernel: 2.6.18, /usr/src/linux
Iptables: 1.3.5, /usr/src/iptables
Each patch is a new feature: many have minimal impact, some do not.
Almost every one has bugs, so don't apply what you don't need!
-------------------------------------------------------
Already applied:
Testing geoip… not applied
The geoip patch:
Author: Samuel Jean <jix@bugmachine.ca>; Nicolas Bouliane <nib@bugmachine.ca>
Status: Stable This patch makes possible to match a packet
by its source or destination country. GeoIP options:
[!] --src-cc, --source-country country[,country,country,…] Match packet coming from (one of)
the specified country(ies) [!] --dst-cc, --destination-country country[,country,country,…] Match packet going to (one of)
the specified country(ies) NOTE: The country is inputed by its ISO3166 code. The only extra files you need is a binary db (geoipdb.bin) & its index file (geoipdb.idx).
Take a look at http://people.netfilter.org/peejix/geoip/howto/geoip-HOWTO.html
for a quick HOWTO.
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?] y
[root@localhost patch-o-matic-ng-20080521]# ./runme --download
[root@localhost patch-o-matic-ng-20080521]# ./runme geoip
Welcome to Patch-o-matic ($Revision: 6736 $)! Kernel: 2.6.18, /usr/src/linux
Iptables: 1.3.5, /usr/src/iptables
Each patch is a new feature: many have minimal impact, some do not.
Almost every one has bugs, so don't apply what you don't need!
-------------------------------------------------------
Already applied:
Testing geoip… not applied
The geoip patch:
Author: Samuel Jean <jix@bugmachine.ca>; Nicolas Bouliane <nib@bugmachine.ca>
Status: Stable This patch makes possible to match a packet
by its source or destination country. GeoIP options:
[!] --src-cc, --source-country country[,country,country,…] Match packet coming from (one of)
the specified country(ies) [!] --dst-cc, --destination-country country[,country,country,…] Match packet going to (one of)
the specified country(ies) NOTE: The country is inputed by its ISO3166 code. The only extra files you need is a binary db (geoipdb.bin) & its index file (geoipdb.idx).
Take a look at http://people.netfilter.org/peejix/geoip/howto/geoip-HOWTO.html
for a quick HOWTO.
-----------------------------------------------------------------
Do you want to apply this patch [N/y/t/f/a/r/b/w/q/?] y
Excellent! Source trees are ready for compilation.
Recompile the kernel image (if there are non-modular netfilter modules).
Recompile the netfilter kernel modules.
Recompile the iptables binaries.
[root@localhost patch-o-matic-ng-20080521]#
srpm으로 받아놓은 iptables의 extension 디렉토리에 geoip 관련 패치파일이 생성되어 있는 것을 확인할 수 있습니다.
[root@localhost extensions]# ls -l /usr/src/iptables/extensions | grep geoip
-rw-r--r-- 1 root root 9518 10월 31 13:53 libipt_geoip.c
-rw-r--r-- 1 root root 817 10월 31 13:53 libipt_geoip.man
[root@localhost extensions]#
-rw-r--r-- 1 root root 9518 10월 31 13:53 libipt_geoip.c
-rw-r--r-- 1 root root 817 10월 31 13:53 libipt_geoip.man
[root@localhost extensions]#
/usr/src/iptables 디렉토리 안에서 make 해 준 뒤 extension 디렉토리에 들어가면 libipt_geoip.so 파일이 생성되어 있는 것을 확인할 수 있습니다.
[root@localhost extensions]# cd /usr/src/iptables
[root@localhost iptables]# make
[root@localhost iptables]# cd extensions
[root@localhost extensions]# ls -l | grep libipt_geoip.so
-rwxr-xr-x 1 root root 7470 10월 31 13:55 libipt_geoip.so
[root@localhost extensions]#
[root@localhost iptables]# make
[root@localhost iptables]# cd extensions
[root@localhost extensions]# ls -l | grep libipt_geoip.so
-rwxr-xr-x 1 root root 7470 10월 31 13:55 libipt_geoip.so
[root@localhost extensions]#
libipt_geoip.so 파일을 /lib/iptables 디렉토리 안에 복사해 넣어주면 iptables 관련 작업은 끝납니다.
[root@localhost extensions]# cp libipt_geoip.so /lib/iptables
[root@localhost extensions]# ls -l /lib/iptables | grep geoip
-rwxr-xr-x 1 root root 7470 10월 31 13:57 libipt_geoip.so
[root@localhost extensions]#
[root@localhost extensions]# ls -l /lib/iptables | grep geoip
-rwxr-xr-x 1 root root 7470 10월 31 13:57 libipt_geoip.so
[root@localhost extensions]#
커널 작업은 아래와 같습니다.
[root@localhost extensions]# cd /usr/src/linux
[root@localhost extensions]# make oldconfig
geoip match support (IP_NF_MATCH_GEOIP) [N/m/?] (NEW)
[root@localhost linux]# make modules_prepare
scripts/kconfig/conf -s arch/i386/Kconfig
CHK include/linux/version.h
CHK include/linux/utsrelease.h
HOSTCC scripts/genksyms/genksyms.o
HOSTCC scripts/genksyms/lex.o
HOSTCC scripts/genksyms/parse.o
HOSTLD scripts/genksyms/genksyms
CC scripts/mod/empty.o
MKELF scripts/mod/elfconfig.h
HOSTCC scripts/mod/file2alias.o
HOSTCC scripts/mod/modpost.o
HOSTCC scripts/mod/sumversion.o
HOSTLD scripts/mod/modpost
[root@localhost linux]#
[root@localhost linux]# mv net/ipv4/netfilter/Makefile net/ipv4/netfilter/Makefile.orig
[root@localhost linux]# vim net/ipv4/netfilter/Makefile
[root@localhost extensions]# make oldconfig
geoip match support (IP_NF_MATCH_GEOIP) [N/m/?] (NEW)
[root@localhost linux]# make modules_prepare
scripts/kconfig/conf -s arch/i386/Kconfig
CHK include/linux/version.h
CHK include/linux/utsrelease.h
HOSTCC scripts/genksyms/genksyms.o
HOSTCC scripts/genksyms/lex.o
HOSTCC scripts/genksyms/parse.o
HOSTLD scripts/genksyms/genksyms
CC scripts/mod/empty.o
MKELF scripts/mod/elfconfig.h
HOSTCC scripts/mod/file2alias.o
HOSTCC scripts/mod/modpost.o
HOSTCC scripts/mod/sumversion.o
HOSTLD scripts/mod/modpost
[root@localhost linux]#
[root@localhost linux]# mv net/ipv4/netfilter/Makefile net/ipv4/netfilter/Makefile.orig
[root@localhost linux]# vim net/ipv4/netfilter/Makefile
obj-m := ipt_geoip.o
KDIR := /lib/modules/$(shell uname -r)/build
PWD := $(shell pwd)
default:
$(MAKE) -C $(KDIR) M=$(PWD) modules
[root@localhost linux]# make M=net/ipv4/netfilter
[root@localhost linux]# cp net/ipv4/netfilter/ipt_geoip.ko /lib/modules/2.6.18-164.el5/kernel/net/ipv4/netfilter/
[root@localhost linux]# chmod 744 /lib/modules/2.6.18-164.el5/kernel/net/ipv4/netfilter/ipt_geoip.ko
[root@localhost linux]# depmod -a
[root@localhost linux]# ls -l /lib/modules/2.6.18-164.el5/kernel/net/ipv4/netfilter | grep geoip
-rwxr--r-- 1 root root 139757 10월 31 14:02 ipt_geoip.ko
[root@localhost linux]# modprobe ipt_geoip
[root@localhost linux]# lsmod | grep geoip
ipt_geoip 7684 0
x_tables 17349 5 ipt_geoip,ipt_REJECT,xt_state,xt_tcpudp,ip_tables
[root@localhost linux]#
[root@localhost linux]# cp net/ipv4/netfilter/ipt_geoip.ko /lib/modules/2.6.18-164.el5/kernel/net/ipv4/netfilter/
[root@localhost linux]# chmod 744 /lib/modules/2.6.18-164.el5/kernel/net/ipv4/netfilter/ipt_geoip.ko
[root@localhost linux]# depmod -a
[root@localhost linux]# ls -l /lib/modules/2.6.18-164.el5/kernel/net/ipv4/netfilter | grep geoip
-rwxr--r-- 1 root root 139757 10월 31 14:02 ipt_geoip.ko
[root@localhost linux]# modprobe ipt_geoip
[root@localhost linux]# lsmod | grep geoip
ipt_geoip 7684 0
x_tables 17349 5 ipt_geoip,ipt_REJECT,xt_state,xt_tcpudp,ip_tables
[root@localhost linux]#
※ CentOS 커널에 geoip 붙이는 건 김정균님이 배포하고 계신 스크립트로 간단하게 해결 가능합니다.
http://my.oops.org/117
CentOS 5.x kernel & iptables rpm에 GeoIP 모듈 리빌드하기