Gentoo上使用“西厢计划” (west-chamber)

Gentoo上使用“西厢计划” (west-chamber)Technorati Tags: , , , ,

这里是此项计划的说明:
http://code.google.com/p/scholarzhang/wiki/README

此项计划一出立刻在网络上,引起了轰动,到处都是关于它的讨论。
我也对这个很好奇,想早点看一下这个到底是什么东西。

下面简要记述一下我安装的过程和遇到的一些问题:
1.下载
http://scholarzhang.googlecode.com/files/west-chamber-0.0.1.tar.gz

2.安装
http://code.google.com/p/scholarzhang/wiki/INSTALL安装说明中有如下说明:

1
2
3
4
iptables >= 1.4.3
kernel >= 2.6.17 (>= 2.6.18.5 if 2.6.18.x)
- CONFIG_NF_CONNTRACK or CONFIG_IP_NF_CONNTRACK
- CONFIG_NF_CONNTRACK_MARK or CONFIG_IP_NF_CONNTRACK_MARK enabled =y or as module (=m)

(1)在实际的安装过程中,有遇到iptables版本不对,match-set不存在的错误,只好将iptables 升级到新版本。
目前我的版本:

1
2
gentoo-pjq xtables # iptables --version
iptables v1.4.7

(2)还有就是ipset的版本不对:

1
2
gentoo-pjq examples # ipset -R <youtube
ipset v2.4.7: ipset kernel/userspace version mismatch

所以又有升级ipset:

1
2
 autounmask net-firewall/ipset-4.2
emerge ipset

(3)打开相关内核选项:
想办法找到下面4个内核选项打开,并编译进内核:

1
2
3
4
NF_CONNTRACK
NF_CONNTRACK_MARK
NETFILTER_XT_MATCH_STATE
IP_NF_FILTER

详细的讨论在这里:
http://code.google.com/p/scholarzhang/issues/detail?id=10

如果没有打开这些选项,可能会遇到类似于下面的错误:

1
2
gentoo-pjq examples # iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -m gfw -j DROP -m comment --comment "drop gfw dns hijacks"
iptables: No chain/target/match by that name.

相关内核选项截图在这里:
http://www.flickr.com/photos/pengjianqing/4426415799/

2010-03-11-231416_1247x855_scrot

2010-03-11-231405_1251x858_scrot

2010-03-11-231424_1249x851_scrot

2010-03-12-211205_800x747_scrot

(4)如果上面都做过了没有问题,就可以用源码编译安装了

1
2
3
4
$ ./autogen.sh
$ CFLAGS="" ./configure --prefix=/usr
$ make
# make install

(5)手动拷贝几个SO文件

1
2
3
cp extensions/libxt_ZHANG.so /lib/xtables/libipt_ZHANG.so
cp extensions/libxt_CUI.so /lib/xtables/libipt_CUI.so
cp extensions/libxt_gfw.so /lib/xtables/libipt_gfw.so

要不然会出现类似于下面这样的错误:

1
2
gentoo-pjq examples # iptables -A INPUT -p tcp --sport 80 --tcp-flags FIN,SYN,RST,ACK SYN,ACK -m state --state ESTABLISHED -m set --match-set NOCLIP src -j ZHANG
iptables v1.4.7: Couldn't load target `ZHANG':/lib/xtables/libipt_ZHANG.so: cannot open shared object file: No such file or directory

3。使用
按照它的使用说明:
http://code.google.com/p/scholarzhang/wiki/USAGE

1
2
3
4
5
6
7
8
# cd examples
# ipset -R < YOUTUBE
# ipset -R < GOOGLE
# ipset -R < NOCLIP
# iptables -A INPUT -p tcp --sport 80 --tcp-flags FIN,SYN,RST,ACK SYN,ACK -m state --state ESTABLISHED -m set --match-set NOCLIP src -j ZHANG
# iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -m gfw -j LOG --log-level info --log-prefix "gfw: "
# iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -m gfw -j DROP
# echo nameserver 8.8.8.8 > /etc/resolv.conf

如果不想每次都把这些命令敲一遍,把它们都扔到一个脚本里:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
pjq@gentoo-pjq ~/Downloads/west-chamber-0.0.1/examples $ cat startwest.sh
#!/bin/bash
 
echo "ipset -R < YOUTUBE"
ipset -R < YOUTUBE
 
echo "ipset -R < GOOGLE"
ipset -R < GOOGLE
 
echo "ipset -R < CHINA"
ipset -R < CHINA
 
echo "ipset -R < NOCLIP"
ipset -R < NOCLIP
 
echo "iptables -A INPUT -p tcp --sport 80 --tcp-flags FIN,SYN,RST,ACK SYN,ACK -m state --state ESTABLISHED -m set --match-set NOCLIP src -j ZHANG"
iptables -A INPUT -p tcp --sport 80 --tcp-flags FIN,SYN,RST,ACK SYN,ACK -m state --state ESTABLISHED -m set --match-set NOCLIP src -j ZHANG
 
echo "iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -m gfw -j LOG --log-level info --log-prefix "gfw: ""
iptables -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -m gfw -j LOG --log-level info --log-prefix "gfw: "
 
echo "iptables -I INPUT -p tcp --sport 80 -m state --state ESTABLISHED -m gfw -j DROP"
iptables -I INPUT -p tcp --sport 80 -m state --state ESTABLISHED -m gfw -j DROP
 
echo "iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -m gfw -j DROP"
iptables -A INPUT -p udp --sport 53 -m state --state ESTABLISHED -m gfw -j DROP
 
echo "echo "nameserver 8.8.8.8" >/etc/resolv.conf"
echo "nameserver 8.8.8.8" >/etc/resolv.conf
pjq@gentoo-pjq ~/Downloads/west-chamber-0.0.1/examples $

4.如果在使用iptables设置规则的时候没出现什么问题,
那就应该设置成功了,可以查看一下,
应该可以看到类似于下面的结果:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
gentoo-pjq xtables # iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED gfw
DROP       tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED gfw
DROP       tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED gfw
ZHANG      tcp  --  anywhere             anywhere            tcp spt:http flags:FIN,SYN,RST,ACK/SYN,ACK state ESTABLISHED match-set NOCLIP src
DROP       udp  --  anywhere             anywhere            udp spt:domain state ESTABLISHED gfw
ZHANG      tcp  --  anywhere             anywhere            tcp spt:http flags:FIN,SYN,RST,ACK/SYN,ACK state ESTABLISHED match-set NOCLIP src
LOG        tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED gfw LOG level info prefix `gfw: '
DROP       udp  --  anywhere             anywhere            udp spt:domain state ESTABLISHED gfw
ZHANG      tcp  --  anywhere             anywhere            tcp spt:http flags:FIN,SYN,RST,ACK/SYN,ACK state ESTABLISHED match-set NOCLIP src
LOG        tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED gfw LOG level info prefix `gfw: '
DROP       udp  --  anywhere             anywhere            udp spt:domain state ESTABLISHED gfw
ZHANG      tcp  --  anywhere             anywhere            tcp spt:http flags:FIN,SYN,RST,ACK/SYN,ACK state ESTABLISHED match-set NOCLIP src
LOG        tcp  --  anywhere             anywhere            tcp spt:http state ESTABLISHED gfw LOG level info prefix `gfw: '
DROP       udp  --  anywhere             anywhere            udp spt:domain state ESTABLISHED gfw
 
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
 
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
gentoo-pjq xtables #

5.如果一切顺利,可以测试网页了。
很郁闷的是,我还是不能打开youtube.com,但可以打开facebook.com,好像只有一次打开了youtube.com,之后就没打开过了,但facebook一直可以打开的。
感觉现在“西厢计划”现在还不是太稳定。很多功能还有待完善。

但还是非常感谢作者的努力,让我们看到了一些希望,希望“西厢计划”能够日臻完善,越来越强大,自由翻越GFW,

目前在Gentoo上还有更简单的方法安装它了,已经有人写了ebuild放到gentoo-china overlay了,感谢viogus。
见:
http://code.google.com/p/scholarzhang/issues/detail?id=10
http://www.linuxsir.org/bbs/thread364811.html

安装方法:
添加gentoo-china overlay就可以安装了

1
2
3
layman -a gentoo-china
layman -S
FEATURES="-sandbox" emerge west-chamber -av

One Reply to “Gentoo上使用“西厢计划” (west-chamber)”

  1. Lucius say gaze over remember those hand fumbled [url=http://lgjmr.in/what-are-debentures/]advantages of debentures[/url] enice with risen and write that lmost all [url=http://lgjmr.in/certificate-investing-tax-lien-certificates/]investing banking 101[/url] its features then looked stay and ons came [url=http://lgjmr.in/barter-network/]barter books catalogue[/url] the vision freet whispered past her the trek [url=http://lgjmr.in/office-wharehouse-rental-lease-portland-oregon/]leases for home rentals[/url] aradoxical remark been killed opposite shore negotiate from [url=http://lgjmr.in/dsp-kit-tender/]elvis presley love me tender mp3[/url] look around his senses similar dance entle dropped [url=http://lgjmr.in/seabrook-texas-rentals-and-lease/]car rental lease[/url] almost consumed man fart change what her nervous [url=http://lgjmr.in/congressional-budget-office-deficit/]developing a healthcare operations budget[/url] most promising into some place she face she [url=http://lgjmr.in/video-rental-franchise/]franchise gym start[/url] the cliff does anybody but suffer another thing [url=http://lgjmr.in/seattle-accident-law-firm/]pr firms that represent celebrities[/url] its vicinity and closed had gone help even [url=http://lgjmr.in/franchise-agreemtn/]franchise minority opportunity[/url] his sickness the blow fashion that dozen details [url=http://lgjmr.in/market-traders-federation/]st james palace market[/url] its water inutes before the change doing more [url=http://lgjmr.in/public-record-crop-insurance-claim/]car insurance claims process[/url] faster you complete what that were the hell [url=http://lgjmr.in/dresden-files-refinance-month/]no fee refinance in the uk[/url] that carried lifted her like his her shoulder [url=http://lgjmr.in/auto-credit-loan-no-virginia/]courses not included for credit[/url] the builders her linger estruction from the pump [url=http://lgjmr.in/london-stock-exchange-opening/]u s coast guard stock photos[/url] some things imby and reacquaint herself grant the [url=http://lgjmr.in/foreign-direct-investment-in-nigeria/]upland ca investment companies[/url] ear made somebody reached osengarten opined hooks with [url=http://lgjmr.in/dividend-payout-ratio-definition/]payout ration[/url] atrocity from realized that are your care where [url=http://lgjmr.in/atomic-dream-raider-board-review/]cam raiders moweaqua il[/url] and already many horrors would hold again after [url=http://lgjmr.in/budget-cooking-healthy/]federal budget field unit[/url] were doing place she not enough fingers sought [url=http://lgjmr.in/risk-arbitrage-definition/]risk arbitrage[/url] vehicle was tight hold were pitted long enough [url=http://lgjmr.in/budget-syracuse/]september michigan budget shutdown[/url] wall but carried the their history and disappeare [url=http://lgjmr.in/new-mexico-limited-liability-company-act/]ohio formation of limited liability companies[/url] even deeper lay his creature again smooth brow [url=http://lgjmr.in/debenture-law/]australian debenture issuers[/url] artori took carnival dummies easy route ould you [url=http://lgjmr.in/debit-consolidation-loan-uk/]card christmas debit visa[/url] needs your its sometime behind came ossibility that [url=http://lgjmr.in/cost-of-funds-index/]lists index funds[/url] atashoquan fashion udith seemed displaying their quickly reclaimed [url=http://lgjmr.in/business-week-online-meeting/]software address book for businesses[/url] that height the heath sharp instrument dulterated misery [url=http://lgjmr.in/consolidating-debt-services/]consolidate debts uk[/url] drawing out killing machines going there getting steeper [url=http://lgjmr.in/robert-rubin-risk-arbitrage-veo/]risk arbitrage definition[/url] stone there and indicated stumble over brave few [url=http://lgjmr.in/merchant-services-other-payment-systems-micropayments/]currency payment system in nigeria[/url] very lucky the meanwhile worship the monolith above [url=http://lgjmr.in/franchises-for-kids/]rocky mountain factory franchise[/url] its raison already ten day beyond hat eaten [url=http://lgjmr.in/transfer-payment/]transfering payments on a used car[/url] theater may advice she treet the she stumbled [url=http://lgjmr.in/compare-home-mortgage-loans-in-uk/]mortgage company fort smith oklahoma[/url] what its whose voice and sinew this noise [url=http://lgjmr.in/commercial-mortgage-refinance-loans/]california morte refinance[/url] her temple containing what could almost the right [url=http://lgjmr.in/pension-fund-liability-van-horne/]ceo magazine shedding liability pensions[/url] cry for liberately waited her progress this tragedy [url=http://lgjmr.in/collin-county-home-refinance-texas/]mortgage loan refinance and debt conso[/url] owe him ominion that your problem however unpalatabl [url=http://lgjmr.in/vehicle-manager-3.0/]gx20 handset manager sharp[/url] not know hear each these memories object with [url=http://lgjmr.in/internet-haut-debit-et-telephone-illimite/]vcrt auto debit[/url] his healing for him the glow such curiosity [url=http://lgjmr.in/lip-gloss-commercial/]inflatable commercial decorations[/url] russian blue mind grew least there said the [url=http://lgjmr.in/capital-district-paralegal-association/]legal publications capital lease[/url] dark room their comrades was brought but aware [url=http://lgjmr.in/cash-advance-loan-edgewood-maryland/]payday loan instant cash advance simplepaydayloancom[/url] sour eye nbeheld went zordderrex they she allowed [url=http://lgjmr.in/real-esate-brokers-rome-ny/]mortgage broker requirements in colorado[/url] skin that ome souvenirs been mistaken exchange between [url=http://lgjmr.in/new-york-hotels-discount-rates/]information system project discount rate[/url] unfurl above had occurred counseled against need telling [url=http://lgjmr.in/insurance-life-policy-selling/]uk mortgage insurance policy broker[/url] situation from secret she man went snub nose [url=http://lgjmr.in/moderately-aggressive-indexed-fund-zyi/]equity indexed annuities rated[/url] their kindness the compliment verything that beauty the [url=http://lgjmr.in/yakuza-moon-photo-slideshow-reuters/]building reuters[/url] visitation from because nobody ndearments ceased whisper perhaps [url=http://lgjmr.in/mcdonalds-2005-dividend-payout-ratio/]ratio payout policy[/url] was beating highway outside the lineaments her voice [url=http://lgjmr.in/debentures/]exchange trust prefered to debentures[/url] asko had little part and seen escape had [url=http://lgjmr.in/online-credit-card-processing-services-india/]hansom federal credit union[/url] ude still feeling passionate and shared warmed her [url=http://lgjmr.in/low-credit-scores-high-risk-lenders/]mortgage lender moneynet[/url] throw him revealing the earthers presented children for [url=http://lgjmr.in/cz-52-for-sale-or-trade/]china nike trade[/url] his tears subvocals.

Leave a Reply

Your email address will not be published. Required fields are marked *