ipac-ng-developer — Developers ONLY!

[Ipac-ng-developer] ipac-ng 1.34.2 released

[Sergey M. <sm...@sm...>]

ipac-ng 1.34.2 released.

Changes in this version:

- fixed incompatibility with iptables 1.4.11 - 1.4.12.1.
- improved configure/build scripts. Now both dynamic (with iptables dynamic 
libraries) and static (with iptables source) compilation is compatible with 
iptables 1.4.3 - 1.4.12.1.
- updated documentation.


Sergey Merzlikin 

[Ipac-ng-developer] ipac-ng 1.34.1 released

[Sergey M. <sm...@sm...>]

ipac-ng 1.34.1 released.

Changes in this version:

- fixed incompatibility of configure script with some Linux distributions 
which include iptables 1.4.10 and later. In these systems most entry points 
of the library libiptc.so was moved to another file - libip4tc.so. Now 
configure script searches both library files.

This version is able to work with iptables versions from 1.3 to 1.4.11.1 and 
maybe later, but it is true only if it was compiled 
without --with-iptables-src option.
Static compilation with iptables source files is available up to iptables v. 
1.4.9.1. Some Linux distributions contain patched header files which lead to 
compilation errors even with older iptables versions, so it is recommended 
to avoid static compilation with iptables source.

Sergey Merzlikin 

[Ipac-ng-developer] ipac-ng 1.34 released

[Sergey M. <sm...@sm...>]

ipac-ng 1.34 released.

Changes in this version:

- ported to iptables 1.4.9.1, works with iptables 1.4.3 - 1.4.9.1, and maybe 
later;
- removed a lot of unused code from iptables.c ;
- removed xtables.c, libiptc.c, libip4tc.c and corresponding header files, 
but instead added dependency on iptables libraries: libxtables.so and 
libiptc.so;
- added option to configure script: "--with-iptables-src=" which allows to 
compile fetchipac statically with iptables source code (as it was in 
previous versions, see BUILD-with-iptables-source file for more 
information);
- added ipacsumdaily/monthly perl scripts to contrib directory;
- updated documentation.

Sergey Merzlikin

 

[Ipac-ng-developer] patch for iptables 1.3.8 interoperation

[Mark S. <ma...@di...>]

hi
I have a patch which works with iptables 1.3.8 if anyone is interested.
http://www.digivation.com.au/files/ipac-ng-1.31.for.iptables-1.3.8.patch.bz2

it has all the patches found on http://wjd.nu/notes/2007

2 problems.
- dynamic lib didnt call the init function (renamed to my_init)
- parse_ports function didnt exist.

Mark

[Ipac-ng-developer] patch for iptables 1.3.8 interoperation

[Mark S. <ma...@di...>]

hi
I have a patch which works with iptables 1.3.8 if anyone is interested.
http://www.digivation.com.au/files/ipac-ng-1.31.for.iptables-1.3.8.patch.bz2

it has all the patches found on http://wjd.nu/notes/2007

2 problems.
- dynamic lib didnt call the init function (renamed to my_init)
- parse_ports function didnt exist.

Mark 

[Ipac-ng-developer] multiple hosts stats into one database

[xjezdi00 <xje...@se...>]

Hello all,

I am using ipac-ng on two machines. I use it against PgSQL database.
I had a problem with inserting into the logs table from two hosts at same time. I got this error:

/usr/local/sbin/fetchipac : SQL command (INSERT INTO logs (rule_name, bytes, pkts, that_time, hostname) VALUES ('outgoing to inside', '25212', '135', '1201685101', 'myhost.mydomain.tld')) failed
Error: ERROR:  duplicate key violates unique constraint "logs_rule_time"

I found the solution in changing the index (which is created by postgres-db.sql script in default) to this:
CREATE UNIQUE INDEX "logs_rule_time" on "logs" using btree ( "rule_name" "varchar_ops", "that_time" "int4_ops" , "host_name" "varchar_ops");

I hope this might help someone.

Does anybody know why this project is not updated? I had really taught time ti find the patch for iptables 1.31.

Cheers and thanks for nice project.
M.

[Ipac-ng-developer] [wjd.nu] success with ipac-ng (Debian etch / SuSE-10.3, 2.6 kernel)

[Martin N. <ne...@ga...>]

[Too bad that ipac-ng on its sourceforge home is apparently orphaned for
some years now.  Nevertheless, I'm including a Cc: to the mailing
list there, perhaps this gets somebody else jumpstarted a bit quicker.]

Dear Walter,

thanks for your notes and work on ipac-ng, resolving the "calloc failed"
problem current Linuxens, and providing the multiple patch source kit,
all that on http://wjd.nu/notes/2007 -- t really saved my day!

FWIW, a small change to a hard-wired path was all what was needed
to get it running under SuSE-10.3:

	agents/iptables/iptables.c:
	< char *lib_dir = "/lib/iptables";
	> char *lib_dir = "/usr/lib/iptables";

Because life wouldn't be too boring, there is yet another location
suggested in agents/iptables/libiptc.c:

	#ifndef IPT_LIB_DIR
	#define IPT_LIB_DIR "/usr/local/lib/iptables"
	#endif

Actually, configure is able to correctly pre#define IPT_LIB_DIR
so I ended up using the macro in agents/iptables/iptables.c now, too.

							Thanks again,
							Martin

Re: [Ipac-ng-developer] patch for iptables 1.3.1

[Peter W. <pe...@en...>]

hi

people reading the list archives on sourceforge have problems with the 
patch, since it will be truncated.

i posted the same patch to the ipcop project, too. here is the link to 
the tracker item:
http://sourceforge.net/tracker/index.php?func=detail&aid=1193721&group_id=40604&atid=428516

peter

-- 
:: e n d i a n
:: open source - open minds

:: peter warasin
:: http://www.endian.it   :: pe...@en...

[Ipac-ng-developer] ipac-ng v1.31 and iptables time extension problem/bug

[Declan M. <de...@mu...>]

Hi,

I've found a problem with using ipac-ng (v1.31) with the iptables 
(v1.2.11) "Time" extension on Debian Sarge(386).

Within the ipac-ng "agents/iptables.c" file the

   m->parse(c - m->option_offset,
            d->extension, invert,
            &m->mflags,
            &fw, &fw.nfcache, &m->m)

function call (see line 1367,in "prepare_entry()") seems to be 
incorrectly setting the contents of "m->m->data[]". This could be because

  - I am not using the correct compile options for ipac-ng.
  - There is a bug in ipac-ng.
  - There is a bug in the Time extension.
  - There is a bug in iptables.
  - Something else I haven't thought of.

I would much appreciate it, if you would let me know your thoughts on 
the problem and any suggestions on how to fix it. See below for more 
details.

Many thanks,
Declan


Problem details:

For the Time extension, "m->m->data[]" has a data structure of

   struct ipt_time_info {
           u_int8_t  days_match;
           u_int16_t time_start;
           u_int16_t time_stop;
           u_int8_t  kerneltime;
           time_t    date_start;
           time_t    date_stop;
   };

When "m->parse()" is called with a "d->extension" of

   "fetchipac", "-m", "time", "--timestart", "1:0",
   "--timestop", "7:0", "--days", "Mon"

and a first parameter of 49 (ie c=305 and m->option_offset=256) to 
process the "--timestart" "1:0"

   "time_start" is set to zero and "time_stop" is set to 1439,
   however "m->flags" is correctly set to 1

and when "m->parse()" is next called with a first parameter of 50 (ie 
c=306 and m->option_offset=256) to process the "--timestop" "7:0"

   "time_start" is set to zero and "time_stop" is set to zero,
   however "m->mflags" is correctly set to 3

and when "m->parse()" is next called with a first parameter of 51 (ie 
c=307 and m->option_offset=256) to process the "--days" "Mon"

   "time_start" is still set to zero and "time_stop" is still set to
   zero, however "m->mflags" is correctly set to 3 and "days_match"
   is correctly set to 0x20

I've built ipac-ng with a "configure" of

   ./configure \
   --enable-default-storage=postgre \
   --enable-debug-ipacsum=no  \
   --enable-debug-database=no \
   --with-postgresql-inc=/usr/include/postgresql

The CFLAGS within the resultant Makefile are

   -g -O2 -Wall -I/usr/include/postgresql

The debian iptables package is version "1.2.11-8". Its iptables command 
is able to correctly use the Time extension. Eg

   iptables -A INPUT -m time --timestop 7:0

works as expected and produces the following "iptables -L" line:

   all  --  anywhere   anywhere  TIME to 7:0 on all days

The kernel is built from Debian's "2.4.27-8" source code, patched with 
the Time extension by using the iptables patch-o-matic that comes with 
the iptables version "1.2.11-8" source code package.

Due to the above incorrect setting of "m->m->data", a "rules.conf" file of

   offpeak|ipac~o|ppp0|all|||time --timestop 7:0|

doesn't produce the expected results and instead produces the following 
"iptables -L" line:

   all  --  anywhere   anywhere  TIME to 0:0 on all days

Any suggestions would be much appreciated.

Regards,
Declan

[Ipac-ng-developer] patch for iptables 1.3.1

[Peter W. <pe...@en...>]

hi

ipac-ng leads in a segmentation fault if you try to run ipac-ng on a 
system with the new iptables.

the attached patch for ipac-ng 1.31 updates the libiptc relevant source 
code to the new libiptc library (iptables 1.3.1).

the patch works for me, but needs some cleanup

if you apply this patch, ipac-ng does not work anymore with older 
versions of iptables (such as 1.2.11)

peter

Re: [Ipac-ng-developer] patch for sorting index.html

[Friedrich L. <fl...@fl...>]

Hi!

xavier wrote on 08.11.2004 16:31 MET:
> here is a small patch to allow
> sorting.
> 
> use :
> 
> --png-sort-by-bytes
> --png-sort-by-pkts
> --png-sort-by-max
> 
> bytes is working great.
> 
> i guess pkts is working, but no proof (pkts are not written to the index.html
> nor to the png img)
> 
> max is broken ; $prog_bytes_max does not seems to hold what i'm expecting.

Accpted into 1.32 but the option "--png-sort-by-max" has been dropped from the 
patch.

> i believe $max  is calculated at draw time ?

Read the source luke ;-) I'd have to do the same.

> i was wondering if i should write a patch
> to write index.html, index-sort-by-bytes.html, index-sort-by-max.html,
> and write them by default. maybe just the sort option by bytes is 
> enough.

If you wish and if it doesn't effect normal use I can accept your patch into the 
code. But please take care to always use tabs for intentions in all places if 
the original file did so ;-)

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Ipac-ng-developer] Problems with new iptables snapshots

[Dominik R. <d-...@ro...>]

Hi there,

as  already  posted  on the common list, I'll repost my problem
here because I think it's the more appropriate list:

I'm having problem using ipac-ng 1.33 cvs with a new version of
iptables. I'm using a current iptables snapshot:

# iptables -V
iptables v1.3.0-20050114

and fetchipac -S unfortunately results in:

# ./fetchipac -S
 calloc failed
: Cannot allocate memory

but worked before with iptables 1.2.11.

ipac.conf  and rules.conf are vanilla from the doc directory of
cvs.

./fetchipac -R
runs without problems.


I  started  tracing the calloc problem and found out that it is
caused in iptables.c prepare_entry()

The code beginning in iptables.c, line 1276 is:
   /* Loading target /if any/ */
   target = find_target(IPT_STANDARD_TARGET, LOAD_MUST_SUCCEED);
   size = sizeof(struct ipt_entry_target) + target->size;
   target->t = xcalloc(1, size);

Obviously  find_target  doesn't  work  properly,  the returning
target size is a bit too big :-)

gdb output:

   Starting program: /usr/src/ipac-ng-1.33/fetchipac -S
   [Thread debugging using libthread_db enabled]
   [New Thread -1211723648 (LWP 9796)]
   [Switching to Thread -1211723648 (LWP 9796)]

   Breakpoint 2, prepare_entry (d=0x80700d0, e=0x745b0) at iptables.c:1279
   1279            target->t = xcalloc(1, size);
   (gdb) print target->size
   $4 = 3083105344

Maybe this helps to fix the problem. Thanks!

Dominik

-- 

Dominik Roettsches
d-...@ro...

[Ipac-ng-developer] patch for sorting index.html

[xavier <lis...@na...>]

Hi, 

here is a small patch to allow
sorting.

use :

--png-sort-by-bytes
--png-sort-by-pkts
--png-sort-by-max


bytes is working great.

i guess pkts is working, but no proof (pkts are not written to the index.html
nor to the png img)

max is broken ; $prog_bytes_max does not seems to hold what i'm expecting.

i believe $max  is calculated at draw time ?


thanks.

i was wondering if i should write a patch
to write index.html, index-sort-by-bytes.html, index-sort-by-max.html,
and write them by default. maybe just the sort option by bytes is 
enough.




-- 
xavier

[Ipac-ng-developer] Re: [Ipac-ng-common] ipac-ng an dsqlite 3.0x

[Friedrich L. <fl...@fl...>]

robert wrote on 07.10.2004 18:44 MET:
> I recently discovered ipac-ng and I think it's great :-)

Nice to hear that.

> First I tried gdbm for storage, which wasn't so good, because of 
> corrupted databases after one hour (read the archives). So I use 
> plain-file now.

I think I am rather going to drop gdbm altogether before people get disappointed 
again.

> Now I installed sqlite, which seems to work, but ipac-ng just doesn't 
> want to compile with it. It always get this error:
> 
> running subst on files: ipacsum fetchipac.8 ipacsum.8 ipac-convert.8...
> ipacsum: unchanged
> fetchipac.8: unchanged
> ipacsum.8: unchanged
> ipac-convert.8: unchanged
> chmod +x ipacsum ipac-convert ipactest
> touch dosubst
> Making all in storage
> make[1]: Entering directory `/home/server/ipac-ng/ipac-ng-1.30/storage'
> Making all in gdbm
> make[2]: Entering directory 
> `/home/server/ipac-ng/ipac-ng-1.30/storage/gdbm'
> make[2]: Nothing to be done for `all'.
> make[2]: Leaving directory `/home/server/ipac-ng/ipac-ng-1.30/storage/gdbm'
> Making all in sqlite
> make[2]: Entering directory 
> `/home/server/ipac-ng/ipac-ng-1.30/storage/sqlite'
> gcc -c -I. -I../.. -DHAVE_CONFIG_H -g -O2 -Wall sqlite.c -o sqlite.o
> sqlite.c: In function `sql_execute_query':
> sqlite.c:103: parse error before `int'
> sqlite.c:104: `resultCode' undeclared (first use in this function)
> sqlite.c:104: (Each undeclared identifier is reported only once
> sqlite.c:104: for each function it appears in.)
> make[2]: *** [sqlite.o] Error 1
> make[2]: Leaving directory 
> `/home/server/ipac-ng/ipac-ng-1.30/storage/sqlite'
> make[1]: *** [all-recursive] Error 1
> make[1]: Leaving directory `/home/server/ipac-ng/ipac-ng-1.30/storage'
> make: *** [all-recursive] Error 1
> 
> I use sqlite 3.0x, is this a Problem? I'll go and try one of the 2.x 
> series, maybe they will work.

Seems like something has changed from version 2 to version 3 of sqlite.
Simon if you read this, you might want to check on this. Thanks.

> Is ipac-ng still under Development? And is it right, that you guys come 
> from Germany?

As every open source project there is always development going on. Sometimes 
faster sometimes slower.

About the origin of the people, I can tell you that the orginal author of 
ipac-ng, Al Zakharov, comes from russia. I myself am from Austria. Other 
contributors are listed in the CHANGELOG file, but their origin is not always clear.

The audience here is definitely international, so you can not change to German 
so we stay with English. Just to make sure ;-)

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

Re: [Ipac-ng-developer] mysql backend for ipac-ng

[Friedrich L. <fl...@fl...>]

Denis O.Philippov wrote on 17.08.2004 16:19 MET:
> 
> I've just ported postgresql backend to mysql.
> I test it. It works. May be it needs some cleanup.
> Please look.

The mailinglist does not seem to allow attachments of type .tgz or you forgot to 
attach the file. But I got your file in an extra private mail too, so I see no 
need to post it again to the list.

Thanks for your contribution. I will try to include your work into CVS this weekend.

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Ipac-ng-developer] mysql backend for ipac-ng

[Denis O.P. <in...@li...>]

Hi!

I've just ported postgresql backend to mysql.
I test it. It works. May be it needs some cleanup.
Please look.

-- 
With best regards, Denis O.Philippov

www.LinuxCenter.ru
mailto:in...@li...

[Ipac-ng-developer] [ ipac-ng-Feature Requests-1001666 ] fetchipac should warn if it finds a lockfile

[SourceForge.net <no...@so...>]

Feature Requests item #1001666, was opened at 2004-08-01 23:37
Message generated for change (Tracker Item Submitted) made by Item Submitter
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=393578&aid=1001666&group_id=28513

Category: fetchipac
Group: Future
Status: Open
Resolution: None
Priority: 5
Submitted By: Friedrich Lobenstock (friedl)
Assigned to: Nobody/Anonymous (nobody)
Summary: fetchipac should warn if it finds a lockfile

Initial Comment:
fetchipac should warn if it finds a lockfile of another
currently running fetchipac.

http://sourceforge.net/mailarchive/forum.php?thread_id=5234463&forum_id=11655

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=393578&aid=1001666&group_id=28513

[Ipac-ng-developer] ipac-ng 1.30 released

[Friedrich L. <fl...@fl...>]

ipac-ng version 1.30
####################

Release focus:
   major bugfixes with regards to chain creation
   with "%chain% name" and the configure script

Notes:
    When updating from a version before 1.28 please remove the
    options "classic mode" and "access agent" from
    /etc/ipac-ng/ipac.conf
    MySQL support still queued up for the next release.

Changelog:
   http://sourceforge.net/project/shownotes.php?release_id=245799

Download:
   http://sourceforge.net/project/shownotes.php?group_id=28513&release_id=239067

Please report bugs and problems to this list.

Have fun!

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Ipac-ng-developer] ipac-ng 1.29 released

[Friedrich L. <fl...@fl...>]

*Sorry for the double post, but I forgot to change the version number*

ipac-ng version 1.29
####################

Release focus:
    major improvements in the sql database backend

Notes:
    When updating from a version before 1.28 please remove the
    options "classic mode" and "access agent" from
    /etc/ipac-ng/ipac.conf
    MySQL support still queued up for the next release.

Changelog:
   http://sourceforge.net/project/shownotes.php?release_id=245799

Download:
   http://sourceforge.net/project/showfiles.php?group_id=28513&release_id=245799

Please report bugs and problems to this list.

Have fun!

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Ipac-ng-developer] ipac-ng 1.29 released

[Friedrich L. <fl...@fl...>]

ipac-ng version 1.28
####################

Release focus:
    major improvements in the sql database backend

Notes:
    When updating from a version before 1.28 please remove the
    options "classic mode" and "access agent" from
    /etc/ipac-ng/ipac.conf
    MySQL support still queued up for the next release.

Changelog:
   http://sourceforge.net/project/shownotes.php?release_id=245799

Download:
   http://sourceforge.net/project/showfiles.php?group_id=28513&release_id=245799

Please report bugs and problems to this list.

Have fun!

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

[Ipac-ng-developer] reyes@kzumba.com removed because of excessive automatic postings

[Friedrich L. <fl...@fl...>]

FYI, re...@kz... has been removed from the list because of excessive 
automatic postings. So please don't report this. It's already fixed ;-)

-- 
MfG / Regards
Friedrich Lobenstock
____________________________________________________________________
Friedrich Lobenstock                       Linux Services Lobenstock
URL: http://www.lsl.at/                         Email: fl...@fl...
____________________________________________________________________

Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: [Ipac-ng-developer] sqlite backend

[<re...@kz...>]

this i got your email and I'll reply ASAP

Re: Re: Re: Re: Re: Re: Re: Re: Re: Re: [Ipac-ng-developer] sqlite backend

[<re...@kz...>]

this i got your email and I'll reply ASAP

Re: Re: Re: Re: Re: Re: Re: Re: Re: [Ipac-ng-developer] sqlite backend

[<re...@kz...>]

this i got your email and I'll reply ASAP

Re: Re: Re: Re: Re: Re: Re: Re: [Ipac-ng-developer] sqlite backend

[<re...@kz...>]

this i got your email and I'll reply ASAP