July 2006 - tproxy - lists.balabit.hu

Trailing whitespace
by Jan Engelhardt 30 Jul '06

30 Jul '06

Hi, `quilt refresh` barfs at me: 00:32 shanghai:/J/kernel/linux-2.6.17.7 > quilt push && quilt refresh --sort; Applying patch patches/01-nat_reservations.patch patching file include/linux/netfilter_ipv4/ip_conntrack.h patching file include/linux/netfilter_ipv4/ip_nat.h patching file net/ipv4/netfilter/Kconfig patching file net/ipv4/netfilter/ip_conntrack_core.c patching file net/ipv4/netfilter/ip_conntrack_standalone.c patching file net/ipv4/netfilter/ip_nat_core.c patching file net/ipv4/netfilter/ip_nat_proto_gre.c patching file net/ipv4/netfilter/ip_nat_proto_icmp.c patching file net/ipv4/netfilter/ip_nat_proto_tcp.c patching file net/ipv4/netfilter/ip_nat_proto_udp.c Now at patch patches/01-nat_reservations.patch Warning: trailing whitespace in lines 144,350 of net/ipv4/netfilter/ip_nat_core.c Refreshed patch patches/01-nat_reservations.patch You might want to fix the cosmetics :) Jan Engelhardt --

2 1

is there a release plan of tproxy patch for kernel 2.6.16 or 2.6.17
by Zhuang Yuyao 28 Jul '06

28 Jul '06

Hi, I'm currently using cttproxy-2.6.15-2.0.4.tar.gz for my 2.6.15 kernel and I'm planing to upgrade my kernel to 2.6.16 or 2.6.17, but I will not do so until the tproxy patch is ready for the new kernel. So, would anyone tell me whether there is a release plan of tproxy patch for kernel 2.6.16 or 2.6.17? The last 2.0.4 was released about 5 months ago. Thanks very much. Best regards, Zhuang Yuyao

3 9

Re: [tproxy] tproxy in newer 2.6 kernels
by Jan Engelhardt 26 Jul '06

26 Jul '06

Hi Lennert, >We do it in POSTROUTING and that seems to work fine? Indeed. I just tried and it looks like I could replace tproxy by a simple SNAT and finally upgrade to a newer kernel. Of course, it's not giving the real IP address, but at least some address that remains the same over time. Jan Engelhardt --

3 7

tproxy kernel panic
by Sai Bathina 23 Jul '06

23 Jul '06

I am using a 2.6.14 kernel with the 2.0.3 patch. I am using a proxy server to connect transparently using tproxy. While the traffic is flowing I did a cat /proc/net/tproxy and I saw a kernel panic. The trace I could see was: pipe_writev pipe_write vfs_write sys_write syscall_call Sorry I do not get better informtion. But I was wondering if this is a known issue or something that is new. Thanks Sai

2 2

tproxy non-root access
by eric_chao＠trend.com.tw 20 Jul '06

20 Jul '06

Hi, Is it true that my program needs to have root access in order to change socket options with tproxy? If so, is there a workaround for it? Currently, I have a program running under a non-root user and needs to use tproxy but it keeps getting "Operation not permmited" error when trying to set socket option using tproxy. I'm using 2.6.14 kernel and its corresponding tproxy patch. Eric TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

3 2

tproxy in newer 2.6 kernels
by Lennert Buytenhek 13 Jul '06

13 Jul '06

Hi, Having to very suddenly (due to hardware failure) upgrade an old 2.4 tproxy box to a stock 2.6 distro kernel box, I was faced with the problem of the upstream 2.6 kernel (and thus, the distro kernel) not supporting tproxy. REDIRECT functionality does work upstream, but TCP source address spoofing can only be achieved with iptables SNAT. So, I implemented a small module that can insert SNAT rules into nat/POSTROUTING, and our proxy (in-house program) now uses that instead of tproxy. This works well for us since we don't need all the other functionality that tproxy provides, but of course, YMMV. I've attached the code we use. It uses libiptc, and may look kind of weird since it was chainsawed from a (much) bigger piece of code, but you'll get the idea. (It flushes and inserts rules in POSTROUTING by default, if that's not appropriate, make a new chain and add a rule to POSTROUTING to jump to that chain.) It's not been tested incredibly extensively, but since the proxy has been processing 4000-5000 concurrent connections at 200-300 connections per second without a hitch for about 12 hours now, it's at least not completely broken. cheers, Lennert

2 5