--- Ovidiu Lixandru <ovidiu@xxxxxxxxxxx> wrote: > Hello. > I've got a RedHat Linux 9 router which provides net > for a LAN via DNAT. > On this machine I plan to use layer 7 filtering in > order to get rid of > some unwanted instant messaging and p2p protocols > for some of the > internal IP's. So far, I've found l7-filter which > seems to provide what > I need. > I've rebuilt the iptables-1.2.9-2.3.1 srpm including > the l7-filter patch > and it worked nicely. > The ugly part comes with the kernel (2.4.20-8). I've > deployed the srpm > and modified the spec to include the l7-filter > patch. However, when it > comes to rebuilding the rpm (rpmbuild -bb --clean > --target i686 > kernel-2.4.spec), I get: > > Connection state match support > (CONFIG_IP_NF_MATCH_STATE) [M/n/?] > Connection tracking match support > (CONFIG_IP_NF_MATCH_CONNTRACK) [M/n/?] > Unclean match support (EXPERIMENTAL) > (CONFIG_IP_NF_MATCH_UNCLEAN) [M/n/?] > Owner match support (EXPERIMENTAL) > (CONFIG_IP_NF_MATCH_OWNER) [M/n/?] > Layer 7 match support (EXPERIMENTAL) > (CONFIG_IP_NF_MATCH_LAYER7) > [N/m/?] (NEW) Buffer size for application layer > data (256-65536) > (CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN) [2048] (NEW) > CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN: > > Size of the buffer that the application layer > data is stored in. > Unless you know what you're doing, leave it at > the default of 2048 > Bytes. > Buffer size for application layer data > (256-65536) > (CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN) [2048] (NEW) > CONFIG_IP_NF_MATCH_LAYER7_MAXDATALEN: > > ...and the message keeps repeating. > At this point, I'm pondering whether to switch to a > recent RHEL 2.6 > kernel and try patching that or get some other layer > 7 filtering > software which may work nicely with the RH 2.4.20 > kernel (is there any > other?). > Any ideas and suggestions are welcome. > Thanks. > > -- Have you considered asking the dudes in the fedora-legacy-list? (Given that RH9 is now in legacy) ---------------------------------------------------------------------- Fedora Core - The power of Open Source Now! Please search the archives and fedoraforum.org as the question is likely to have been asked before. Catch me at http://members.lycos.co.uk/bubudiu/ Cheers Captain Bubudiu ___________________________________________________________ Yahoo! Messenger - NEW crystal clear PC to PC calling worldwide with voicemail http://uk.messenger.yahoo.com
