You are not logged in.

Pages: 1

#1 2014-08-17 16:01:48

qinohe
Member
From: Netherlands
Registered: 2012-06-20
Posts: 1,599

3.17-rc1 AIF fails to start

Hi archers, I have installed mainline3.17-rc1. Everything is working as intended, almost.
This is my laptop, and for ease I installed AIF (arno-iptables-firewall}
After installing the new kernel, it failed to start. I got this error:

Aug 17 12:54:02 nymph arno-iptables-firewall[364]: /usr/bin/iptables -A INPUT -m limit --limit 1/s -j LOG --log-level info --log-prefix AIF:Dropped INPUT packet:
Aug 17 12:54:02 nymph arno-iptables-firewall[364]: ERROR (1): iptables: No chain/target/match by that name.
Aug 17 12:54:02 nymph arno-iptables-firewall[364]: Security is ENFORCED for external interface(s) in the FORWARD chain
Aug 17 12:54:02 nymph arno-iptables-firewall[364]: Logging of dropped FORWARD packets enabled
Aug 17 12:54:02 nymph arno-iptables-firewall[364]: /usr/bin/iptables -A FORWARD -m limit --limit 1/m --limit-burst 3 -j LOG --log-level info --log-prefix AIF:Dropped FORWARD packet:
Aug 17 12:54:02 nymph arno-iptables-firewall[364]: ERROR (1): iptables: No chain/target/match by that name.
Aug 17 12:54:02 nymph arno-iptables-firewall[364]: Aug 17 12:54:02 WARNING: Not all firewall rules are applied.
Aug 17 12:54:02 nymph systemd[1]: arno-iptables-firewall.service: main process exited, code=exited, status=1/FAILURE
Aug 17 12:54:02 nymph systemd[1]: Failed to start A secure stateful firewall for both single and multi-homed machine.
Aug 17 12:54:02 nymph systemd[1]: Unit arno-iptables-firewall.service entered failed state.

I did add some new things to my config, though, I don't think they matter, here are some:

Verify kernel signature during kexec_file_load() syscall (KEXEC_VERIFY_SIG) [N/y/?] (NEW) y
ARP packet logging (NF_LOG_ARP) [N/m/y] (NEW) y
IPv4 packet logging (NF_LOG_IPV4) [N/m/y] (NEW) y

I tried to disable both lines in AIF, but when I do, new ones arise, all in the LOG part, so far...
So I stopped continuing, since that ain't a solution, something changed in the logging of Netfilter, though, I need info to get further, but can't seem to find what it is I'm looking for..
Now I hope someone can shed a light and a way to patch this.
Thanks .

edit:forgot to mention, this was a working setup.

Last edited by qinohe (2014-08-17 16:03:02)

Offline

#2 2014-08-18 13:37:52

qinohe
Member
From: Netherlands
Registered: 2012-06-20
Posts: 1,599

Re: 3.17-rc1 AIF fails to start

After doing some more research, comparing diff of a running and a disabled AIF (output below) a lot of rules are skipped.
Then I checked the diff of '/proc/config' stable and mainline and this is the line I'm missing and can't add because it's removed auto.
I also think this line is (very) important in this process.

CONFIG_NETFILTER_XT_TARGET_LOG=m

part of diff skipped rules:

pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
    
    2   768 pgl_in     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! ctstate RELATED,ESTABLISHED mark match ! 0x14
    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 1/sec burst 5 LOG flags 0 level 6 prefix "AIF:Dropped INPUT packet: "

    0     0 ACCEPT     all  --  *      virbr0  0.0.0.0/0            192.168.122.0/24     ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  virbr0 *       192.168.122.0/24     0.0.0.0/0           
    0     0 ACCEPT     all  --  virbr0 virbr0  0.0.0.0/0            0.0.0.0/0           
    0     0 REJECT     all  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 REJECT     all  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable
    0     0 pgl_fwd    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! ctstate RELATED,ESTABLISHED mark match ! 0x14

    0     0 LOG        all  --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 1/min burst 3 LOG flags 0 level 6 prefix "AIF:Dropped FORWARD packet: "

    0     0 ACCEPT     udp  --  *      virbr0  0.0.0.0/0            0.0.0.0/0            udp dpt:68
    9   671 pgl_out    all  --  *      *       0.0.0.0/0            0.0.0.0/0            ! ctstate RELATED,ESTABLISHED mark match ! 0x14

    0     0 LOG        all  -f  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 3/min burst 5 LOG flags 0 level 6 prefix "AIF:Fragment packet: "

    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix "AIF:PRIV TCP broadcast: "
    2   768 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:0:1023 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix "AIF:PRIV UDP broadcast: "
    0     0 LOG        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpts:1024:65535 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix "AIF:UNPRIV TCP broadcast: "
    0     0 LOG        udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpt:1024 limit: avg 6/min burst 2 LOG flags 0 level 6 prefix "AIF:UNPRIV UDP broadcast: "

    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 3 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP-unreachable flood: "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 11 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP-time-exceeded fld: "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 12 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP-param-problem fld: "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 8 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP-request(ping) fld: "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 0 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP-reply(pong) flood: "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            icmptype 4 limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP-source-quench fld: "
    0     0 LOG        icmp --  *      *       0.0.0.0/0            0.0.0.0/0            limit: avg 12/hour burst 1 LOG flags 0 level 6 prefix "AIF:ICMP(other) flood:

What am I supposed to do next, wait, file a bug, and if I do, on who's account?
I'm not that much a specialist,  but I like to make an effort.

Offline

#3 2014-08-18 15:11:59

ewaller
Administrator
From: Pasadena, CA
Registered: 2009-07-13
Posts: 20,701

Re: 3.17-rc1 AIF fails to start

Moving to AUR issues, Discussion and PKGBUILD requests.

Nothing is too wonderful to be true, if it be consistent with the laws of nature -- Michael Faraday
The shortest way to ruin a country is to give power to demagogues.— Dionysius of Halicarnassus
---
How to Ask Questions the Smart Way

Offline

#4 2014-08-18 15:16:37

qinohe
Member
From: Netherlands
Registered: 2012-06-20
Posts: 1,599

Re: 3.17-rc1 AIF fails to start

I didn't build from AUR, it's build with ABS.
Not that it matters that much, it will 'feel' fine here too I guess wink

Last edited by qinohe (2014-08-18 15:16:55)

Offline

#5 2014-08-18 15:27:44

falconindy
Developer
From: New York, USA
Registered: 2009-10-22
Posts: 4,111
Website

Re: 3.17-rc1 AIF fails to start

qinohe wrote:

I didn't build from AUR, it's build with ABS.
Not that it matters that much, it will 'feel' fine here too I guess wink

You couldn't possibly have taken these PKGBUILDS from ABS. Neither package involved here exists in the tree.

blog | ±github

Offline

#6 2014-08-18 15:30:54

qinohe
Member
From: Netherlands
Registered: 2012-06-20
Posts: 1,599

Re: 3.17-rc1 AIF fails to start

By your reaction, I understand, as soon as you tweak a PKGBUILD from ABS it becomes an 'AUR' package.

Offline

#7 2014-08-18 15:52:17

Scimmia
Fellow
Registered: 2012-09-01
Posts: 13,729

Re: 3.17-rc1 AIF fails to start

for some definitions of "tweak".

Offline

#8 2014-08-18 15:57:43

qinohe
Member
From: Netherlands
Registered: 2012-06-20
Posts: 1,599

Re: 3.17-rc1 AIF fails to start

Yes, like using a version not present in the 'home' repo's.

Offline

#9 2014-08-19 16:31:28

qinohe
Member
From: Netherlands
Registered: 2012-06-20
Posts: 1,599

Re: 3.17-rc1 AIF fails to start

Figured it out, I 'can't' build a new 'major' mainline kernel while still living of a config from a 3.16.

This is what I use, but when there's a major bump, this ain't the way to go I guess:

  zcat /proc/config.gz > ~/tbp/core/linux/src/${_srcname}/.config
  make LSMOD=~/.config/modprobed.db localmodconfig
  make oldconfig
  make nconfig

What I did is install mainline full, not trimmed/stripped.
After that, I trimmed/stripped it the way I had it before.
But this takes a long time, a least an hour or two.
For all small version bumps I will use the config I created for 3.17-rc1.
I have a fully working 3.17 right now, no errors, AIF is also started.

Should I use a different way of doing this?
How do you proceed when there's a major bump?

Offline

Pages: 1

Board footer

Powered by FluxBB