# l7-filter-userspace: iptables-restore Segfaults

## Kenji Miyamoto

I just recently installed l7-filter-userspace-0.11 with iptables-1.4.4 and libnetfilter_conntrack-0.0.99, and iptables-restore segfaults whenever I run it with a line such as: "-A INPUT -i eth1 -m layer7 --l7proto bittorrent -j ACCEPT"

I couldn't find anything about this on Google; does anyone have any ideas?

----------

## Sadako

I believe with the userspace package, any packet you want to match against one of the l7 filters you need to send to the QUEUE target, read more about it here, you can't just use them directly via iptables anymore...

Honestly, it's kind of a curse, I get why the gentoo devs dropped the kernel l7-filters, but they're so much easier and less hassle to work with...

----------

## Kenji Miyamoto

I don't see anything about "QUERY" in menuconfig, though.  Where would I find it?

----------

## Sadako

 *Kenji Miyamoto wrote:*   

> I don't see anything about "QUERY" in menuconfig, though.  Where would I find it?

 That should be QUOTE, not QUERY.

Try enabling CONFIG_NETFILTER_NETLINK_QUEUE and

CONFIG_NETFILTER_XT_TARGET_NFQUEUE, should be "Netfilter NFQUEUE over NFNETLINK interface" and '"NFQUEUE" target Support' in the netfilter configuration under menuconfig.

----------

## Kenji Miyamoto

 *Hopeless wrote:*   

>  *Kenji Miyamoto wrote:*   I don't see anything about "QUERY" in menuconfig, though.  Where would I find it? That should be QUOTE, not QUERY.
> 
> Try enabling CONFIG_NETFILTER_NETLINK_QUEUE and
> 
> CONFIG_NETFILTER_XT_TARGET_NFQUEUE, should be "Netfilter NFQUEUE over NFNETLINK interface" and '"NFQUEUE" target Support' in the netfilter configuration under menuconfig.

 They were already enabled:

```
# grep '.*NETFILTER.*QUEUE' .config

CONFIG_NETFILTER_NETLINK_QUEUE=y

CONFIG_NETFILTER_XT_TARGET_NFQUEUE=y
```

----------

## Sadako

 *Kenji Miyamoto wrote:*   

> They were already enabled

 Then just try following the guide at http://l7-filter.sourceforge.net/HOWTO-userspace, and wherever you would have used iptables rules like "-m layer7 --l7proto bittorrent -j ACCEPT" you use "-j QUEUE" instead, and all the L7 filtering is done with the l7-filter userspace tool.

Like I said though, it's not nearly as straight forward as the in-kernel l7-filter was...

----------

## Kenji Miyamoto

I already have "Connection tracking netlink interface" enabled, but what is l7-filter.conf?  I can't find any information on it.

----------

## Sadako

 *Kenji Miyamoto wrote:*   

> I already have "Connection tracking netlink interface" enabled, but what is l7-filter.conf?  I can't find any information on it.

 It's just a file the l7-filter tool needs, can be called anything you specify yourself, check the l7-filter man page.

It'd be helpfull if portage installed a default/example conf file with the l7-filter-userspace package...

----------

## Kenji Miyamoto

Do you know where I could find a decent example?

EDIT: I found one here, but l7-filter crashes:

```
# l7-filter -vv -f /etc/l7-filter.conf

Attempting to read configuration from /etc/l7-filter.conf

Attempting to load pattern from /etc/l7-protocols/protocols/ssh.pat

pattern='^ssh-[12]\.[0-9]'

eflags=0 cflags=11

Added: ssh      mark=5

Attempting to load pattern from /etc/l7-protocols/protocols/bittorrent.pat

pattern='^(\x13bittorrent protocol|azver\x01$|get /scrape\?info_hash=get /announce\?info_hash=|get /client/bitcomet/|GET /data\?fid=)|d1:ad2:id20:|\x08'7P\)[RP]'

eflags=0 cflags=11

Added: bittorrent       mark=6

error during nfq_bind_pf()
```

----------

## Sadako

Does dmesg report anything when it crashes?

----------

## Kenji Miyamoto

No, it does not.

----------

## ToeiRei

problem reproduced here with recent kernel - crash happens if ip_conntrack_netlink is loaded (which is needed)

----------

