December 2003 - tproxy - lists.balabit.hu

tproxy on 2.6?
by Lennert Buytenhek 05 Jan '04

05 Jan '04

Hi, What would be needed to get the tproxy stuff to work on 2.6? thanks, Lennert

2 4

Difficulty in installing Zorp!
by Elwin Eliazer 30 Dec '03

30 Dec '03

Hi, I am trying to install Zorp in my Compaq desktop, running RedHat 9.0. Recently i upgraded the kernel to 2.4.22, from 2.4.20-6, to be able to use the TPROXY. I got most of the steps through. But i am stuck in getting the Python Ext class 1.2 installed, since there appears to be some compatibility issues, in the thread.h file. RedHat 9 comes with Python 2.2, whereas the Zorp INSTALL file suggests Python 1.5 or 2.1. Can i assume 2.2 is ok for Zorp? RedHat 9 does not come with PythonExtClass. So i downloaded the SRPM from rpmfind.net, for python-extclass-1.2_1. I am getting build problems around the ThreadLock.c and thread.h file. I also see a ThreadLock.c.orig file, and the difference between the two is the way in which thread.h is included, and some definitions. I tried copying the orig file back to .c and then also i continue to get compilation errors. Your suggestions and help will be appreciated. cheers, Elwin. ===== __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/

1 0

Re: [tproxy] tproxy on 2.6?
by KOVACS Krisztian 19 Dec '03

19 Dec '03

Hi, 2003-12-19, p keltezéssel 13:31-kor Peter Busser ezt írta: > > Not much, at least in theory. 1.2.0 should be nonlinear skb > > compatible, and Netfilter has not changed much. However, sockopt numbers > > used by tproxy has been officially allocated to the in-kernel IPSEC, so > > tproxy for 2.6 won't be binary compatible with current versions... :( > > Can't you change the sockopt numbers in the 2.4 patch, to make it binary > compatible with 2.6? Being stuck to one kernel version because of tproxy stuff > is not really a good thing IMHO. Yes, it is a really bad thing. However, we can't do much about that. We should change the sockopt numbers sooner-or-later, even in the 2.4 patch. But this breaks binary compatibility for binaries using these sockopts which were compiled for the old interface. Also note, that some software using tproxy (Zorp, for example) has its own copy of ip_tproxy.h. This is necessary to be able to compile Zorp (with transparent proxying support) even on machines which were not patched with the tproxy patch. When changing those numbers, these distributions need to be updated as well. So, welcome to binary incompatibility hell. :( > Also note that the latest Debian unstable 2.4 kernels contain a backport of > the 2.6 IPSEC stack. Does it v1.2.0 conflict with the sockopt numbers in that > kernel too? Yes, I know that. And yes, of course it means it conflicts with those kernels, too... :( -- Regards, Krisztian KOVACS

1 0

Need TPROXY for 2.4.20-6 kernel
by Elwin Eliazer 18 Dec '03

18 Dec '03

Hi all: I am trying to install Zorp in my Linux desktop PC, running RedHat 9.0, which has Linux kernel 2.4.20-6. This requires installation of TPROXY, but i could not find a compatible version of TPROXY in the following link. The old link, shows only 2.4.20.12, etc. But could not find any 2.4.20-6 there. http://www.balabit.com/downloads/tproxy/linux-2.4/ I am not planning to upgrade my linux kernel to a newer version as of now, and your suggestions would be appreciated. cheers, Elwin. ===== __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/

3 2

tproxy 1.2.0 for Linux 2.4.22
by KOVACS Krisztian 10 Dec '03

10 Dec '03

Hi, I've created a tproxy 1.2.0 release for Linux 2.4.22. It's almost the same as the 2.4.23 patch released yesterday, the only changes are a few extra lines of code in conjunction with the NAT core changes between 2.4.22 and 2.4.23. As always, the tarball is available from: http://www.balabit.com/downloads/tproxy/linux-2.4/ MD5 checksum of cttproxy-2.4.22-1.2.0.tar.gz: c44929bb23fd87a7b4ad4072708a46c6 -- Regards, Krisztian KOVACS

1 0

tproxy version 1.2.0 released
by KOVACS Krisztian 09 Dec '03

09 Dec '03

Hi, TProxy 1.2.0 has been released. This is the first the release of the 1.2 stable branch, with substantial changes since 0.25. From the API standpoint, it is compatible with 0.25. There are no new features, only bugfixes and internal changes. More important internal changes: - new connection tracking entry deletion code, which does not require scanning the whole connection tracking hash - a completely rewritten /proc/net/tproxy interface - hooks into the network stack at more appropriate points (right after TCP/UDP unhash) NOTE: this release is strictly for Linux 2.4.23, it is _not_ compatible with 2.4.22 (and earlier). Even though the patch may apply without problems, it _will_not_work_. If you really need it, please let me know. The experimental NAT entry reuse patch is also in the package, however, please do not use it unless you really have to. (You may try it if you have a lot of TCP traffic and you see "failed to apply NAT mapping" messages. It causes the NAT core drop clashing transparently proxied TCP connections in the TIME_WAIT state, which may help a lot in certain cases.) As always, the package is available from http://www.balabit.com/downloads/tproxy/linux-2.4/ MD5 checksum of cttproxy-2.4.23-1.2.0.tar.gz: 12e8730a95640be3b73f0a05758f08c0 -- Regards, Krisztian KOVACS

2 1