November 2004 - tproxy - lists.balabit.hu

ICMP and tproxy
by Javier Govea 25 Nov '04

25 Nov '04

Hi, Thank you for your prompt response. I was planning to use raw sockets from the begining. But I got a little problem. This is my setup: Client ----------- Proxy --------- Server If I run a raw socket server in my Proxy box and I ping the Proxy from my Client, then my raw socket server can get all the pings. But if I ping the Server from my Client, then my my raw server in the Proxy does not capture anything, because (I'm guessing) it is not inteded for the Proxy box. So, somehow I need to pass that ping to my raw server. I cannot use tproxy and the iptables REDIRECT target because REDIRECT requires a port number, and there are no ports for ICMP packets. So, is there any alternative solution? Am I missing something? Below is the code I am using for my raw server. Thanks in advance. Xavier int main() { int sockfd; if ((sockfd = socket(AF_INET, SOCK_RAW, IPPROTO_ICMP)) < 0) { perror("Socket:"); return -1; } struct sockaddr_in srcaddr; socklen_t srclen = sizeof(struct sockaddr_in); unsigned char buffer [2000]; int len = 2000; int bytes; struct icmphdr *icmphdr; while(1) { printf ("Waiting for pings...\n"); if ( (bytes = recvfrom(sockfd, buffer, len, 0, (struct sockaddr *)&srcaddr, &srclen)) < 0) perror("rcvfrom"); else { icmphdr = (struct icmphdr *)(buffer + sizeof(struct iphdr)); printf ("Received %d bytes from %s:%d ICMP header: type %d code %d seq %d id %d\n", bytes, inet_ntoa(srcaddr.sin_addr), ntohs(srcaddr.sin_port), icmphdr->type, icmphdr->code, ntohs(icmphdr->un.echo.sequence), ntohs(icmphdr->un.echo.id) ); } } return 1; } ICMP is not currently supported by TProxy directly. However you can use raw sockets to achieve the same result. On Wed, 2004-11-24 at 23:53, Javier Govea wrote: > Hi, > > I am writing an proxy for different appliacations. So, far it's working with UDP and TCP. > All packets arriving at my proxy machine are redirected, with iptables, to the the proxy > server, which extracts the final destination of each packet. For the UDP case I am using a > tproxy rule to forward all traffic to the proxy server. The proxy server is using > something similar to redirect-udp-recv.c to exctract final destinations. > > Now, I need my proxy to support pings and thus ICMP packets. Can use the tproxy to forward > ICMP packets to my proxy??? and to extract final destination similar to > redirect-udp-recv.c??? If this is not possible, is there any alternative? > > Thanks in advance > Xavier > > > _______________________________________________ > tproxy mailing list > tproxy(a)lists.balabit.hu > https://lists.balabit.hu/mailman/listinfo/tproxy -- Bazsi

1 0

ICMP and tproxy
by Javier Govea 25 Nov '04

25 Nov '04

Hi, I am writing an proxy for different appliacations. So, far it's working with UDP and TCP. All packets arriving at my proxy machine are redirected, with iptables, to the the proxy server, which extracts the final destination of each packet. For the UDP case I am using a tproxy rule to forward all traffic to the proxy server. The proxy server is using something similar to redirect-udp-recv.c to exctract final destinations. Now, I need my proxy to support pings and thus ICMP packets. Can use the tproxy to forward ICMP packets to my proxy??? and to extract final destination similar to redirect-udp-recv.c??? If this is not possible, is there any alternative? Thanks in advance Xavier

2 1

NAT Reservation
by Tim Burress 10 Nov '04

10 Nov '04

Hello! We're using TPROXY 2.0.0 for 2.4.27 and are running into a strange issue which seems related to NAT reservation. As usual, we have a client TCP connection coming in from a given <saddr,sport> going to a particular <daddr,dport>. Netfilter rules REDIRECT this to our proxy code, which then uses TPROXY to connect out to <daddr,dport> using <saddr,sport> as the apparent source. We use the same operation sequence that appears in the test directory: first bind the socket to a local address, then do a TPROXY ASSIGN assigning <saddr,sport> to the socket, then TPROXY FLAGS to set ITP_CONNECT|ITP_ONCE, and then the actual connect(). With earlier versions of TPROXY (though I can't guarantee that kernel options haven't changed) this worked fine. Now, though, we see two problems. First, on when we make the call to ASSIGN, we get an error: IP_TPROXY: ip_tproxy_nat_reserve proto 6 foreign 10.0.0.2:32772 peer 0.0.0.0:0 IP_TPROXY: IP_TPROXY_ASSIGN cannot register NAT reservation 0200000a:0480 Apparently the NAT reservation is failing because when the initial TCP connection came in, conntrack set up a record expecting a reply to <saddr,sport>. The only way I could see to get around this was to set SO_REUSEADDR on the socket before the call to ASSIGN. However the second problem is that, if I do this, I get an error in the FLAGS call: IP_TPROXY: ip_tproxy_nat_reserve proto 6 foreign 10.0.0.2:32775 peer 0.0.0.0:0 IP_TPROXY: IP_TPROXY_FLAGS sr c660bf9c: failed to register NAT reservation I was able to work around these problems by first setting SO_REUSEADDR on the socket before the ASSIGN than clearing it before the FLAGS call, but that doesn't seem ideal. Is this how it's supposed to be done, or do I just have some basic misunderstanding about how TPROXY should be used? I have to admit I'm not clear on the purpose of NAT reservations. Thanks! Tim __________________________________ Do you Yahoo!? Check out the new Yahoo! Front Page. www.yahoo.com

2 2

Re: TPROXY and NAT
by KOVACS Krisztian 08 Nov '04

08 Nov '04

Hi, 2004-11-06, szo keltezéssel 10:18-kor Sumit Pandya ezt írta: > I'd like to know does the limitation described on following thread has been > overcame after release of 2.0.0 version? > https://lists.balabit.hu/pipermail/tproxy/2003-November/000053.html Basically it's a bad interaction between Netfilter DNAT/MASQUERADE and tproxy. Unfortunately to work around this limitation you have to modify the NAT core code. For more information see https://lists.balabit.hu/pipermail/tproxy/2003-November/000053.html -- Regards, Krisztian KOVACS

1 0

RE: [tproxy] tproxy on bridge
by eric_li＠trend.com.tw 03 Nov '04

03 Nov '04

Oh?! I didn't try it in bridge mode. When I saw the README file, the command is iptables -t tproxy -A PREROUTING -j TPROXY --on-port <proxyport> iptables won't see packets in bridge mode, unless you enable CONFIG_BRIDGE_NETFILTER option, right? So, for tproxy to work in bridge, we must enable this option? Regards, Eric Li -----Original Message----- From: Lennert Buytenhek [mailto:buytenh@wantstofly.org] Sent: Thursday, November 04, 2004 2:27 AM To: Eric Li (RD-TW) Cc: tproxy(a)lists.balabit.hu Subject: Re: [tproxy] tproxy on bridge On Thu, Nov 04, 2004 at 12:05:04AM +0800, eric_li(a)trend.com.tw wrote: > Hi, Hello, > It seems to me that tproxy works on router (IP layer). > Is there any plan to support bridge mode? It works for me quite nicely in bridge mode. If you can describe what problems you are seeing, perhaps we can fix them. TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

1 0

tproxy on bridge
by eric_li＠trend.com.tw 03 Nov '04

03 Nov '04

Hi, It seems to me that tproxy works on router (IP layer). Is there any plan to support bridge mode? Or do there exist some similar buddy of tproxy in ebtables ?? Regards, Eric Li TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

2 1