October 2006 - tproxy - lists.balabit.hu

New Linux 2.6 tproxy snapshots
by KOVACS Krisztian 05 Dec '06

05 Dec '06

Hi, Yesterday we've finally found the cause of a serious problem in TProxy, which occasionally led to connections being NAT-ted to bogus addresses on SMP hardware. It was a really nasty problem with a dead-simple solution: the removal of a single 'static' keyword... Yeah, it was a typical bang-your-head-against-the-wall problem. :) Because of this and a few other (less significant) changes made in the last months I'm goint to publish a new "official" release next week. For the impatient, I've created new tproxy snapshot tarballs: http://people.balabit.hu/hidden/tproxy2-2.6.16_20060908.tar.bz2 http://people.balabit.hu/hidden/tproxy2-2.6.17_20060908.tar.bz2 http://people.balabit.hu/hidden/tproxy2-2.6.18_20060908.tar.bz2 -- Regards, Krisztian Kovacs

3 6

Re: Request: including tproxy patch to official iptables/kernel.
by KOVACS Krisztian 17 Oct '06

17 Oct '06

Hi, On Monday 16 October 2006 07:48, Patrick McHardy wrote: > > So, I would like to suggest to include tproxy patch to official > > iptables/kernel release. > > These look quite old (2.4). The TPROXY developers were working on > a new approach last year at the netfilter workshop, but I don't > know if there was any further progress. Please talk to them directly > and ask them if they want to merge it upstream, and if so to submit > patches. Yes, there was significant progress since then, we're testing the patches at the moment. There still are a couple of problems with the new approach, but it certainly looks promising. I'll post the patches on netfilter-devel for review and comments as soon as things have settled down a bit. Instead of trying to get the 2.0 branch of tproxy merged into mainline we're concentrating our efforts on getting the new code working. As the maintainer of the current tproxy patchset, I do not consider it clean and safe enough to have it merged upstream. Moreover, I think there's no general consensus between networking maintainers whether or not the features tproxy provides are worth the hassles. Transparent proxying features have been removed during the 2.3 development as there seemed little interest in those. Of course there are a handful of companies interested in having the feature in mainline, but let's face the facts: the majority of users do not care about tproxy. That's why I don't even try to get it merged. -- Regards, Krisztian Kovacs

3 2

Merging tproxy patch to official netfilter/kernel release ?
by Yoshioka Tsuneo 16 Oct '06

16 Oct '06

Hello TProxy patch is very convenience patch to make transparent proxy keeping source IP address. I think that tproxy is almost only solution to keep source IP address, at now. So, I hope that tproxy patch is included to the official netfilter/kernel release. I have asked to include tproxy to official netfilter/kernel release. But, they want that developer submit the patch like following. http://lists.netfilter.org/pipermail/netfilter-devel/2006-October/025812.ht… How do you think about merging tproxy patch to official netfilter/kernel release ? And, can you submit the patch to netfilter team, if possible ? Thank you ! -- Nihon F-Secure Corporation (Yoshioka Tsuneo) E-MAIL: Tsuneo.Yoshioka(a)f-secure.com

1 0