August 2006 - tproxy - lists.balabit.hu

tproxy performance issues on different 2.6 kernels
by ferents zvika 06 Sep '06

06 Sep '06

Hi, I'm working on a firewall (reveresed-proxy) that needs to provide the "foreign connection" feature , my firewall read the requests from clients, and passes on the requests to the server , so i'm using the foreign-connect so that the server sees the real client's IP It seems that i have some performance problems: - On kernel 2.6.15 , even without the TPROXY patches i get lousy performance , it seems that this is a well known bug with E1000 drivers , so i can't use this kernel - On kernel 2.6.10 + tproxy 2.0.1 , i got nice results without the tproxy patch, but when i added the tproxy - i got lousy performance - On kernel 2.6.14.7 + tproxy 2.0.3 , i got great results without the tproxy patch (4500 trans/sec) , but when i added the tproxy - it was 3 times slower (1500 trans/sec) with many "failed to create a socket" errors Now, since i would like to stick with the (almost) latest versions, i believe that 2.6.14.7 is enough for me, but i would appreciate to know : 1. are there any knows performance issues with the 2.6.14.7 kernel or with the tproxy-2.0.3 ? 2. my "kernel config" uses the following settings: CONFIG_NETFILTER=y CONFIG_IP_NF_CONNTRACK=y CONFIG_IP_NF_TPROXY=y CONFIG_IP_NF_IPTABLES=y CONFIG_IP_NF_NAT=y CONFIG_IP_NF_NAT_NEEDED=y do i need all these settings to get the "foreign-connect" or can i skip some and gain better results ? thank you very much, zvi ferents

3 5

FW: kernel panic with cttproxy-2.6.14-2.0.3
by eric_chao＠trend.com.tw 17 Aug '06

17 Aug '06

Hi All, I have two problems with cttproxy-2.6.14-2.0.3. Please help if you can. Thanks. 1. I have not applied 04-nat_delete.diff to 2.6.14 since I always encounter some errors with it. According to the README, I also have to apply 00-tcp_window_tracking.diff but I did not since it also states that it is included in Linux 2.6.9. I assume 2.6.14 also has it. Apply patch 04-nat_delete.diff patching file include/linux/netfilter_ipv4/ip_conntrack.h patching file net/ipv4/netfilter/ip_conntrack_proto_tcp.c patching file net/ipv4/netfilter/ip_conntrack_standalone.c patching file net/ipv4/netfilter/ip_nat_core.c Hunk #3 FAILED at 295. 1 out of 6 hunks FAILED -- saving rejects to file net/ipv4/netfilter/ip_nat_core.c.rej patching file net/ipv4/netfilter/ip_conntrack_core.c 2. Using 2.6.14 with tproxy patch, I encountered kernel panic under stress testing. I'm wondering if anyone had encountered this before and how I can solve this problem? I have turned on the tproxy options: CONFIG_IP_NF_TPROXY=y CONFIG_IP_NF_MATCH_TPROXY=y CONFIG_IP_NF_TARGET_TPROXY=y CONFIG_IP_NF_NAT_NRES=y divide error: 0000 [#1] SMP Modules linked in: pgroup ipmi_watchpig ipmi_keypad ipmi_core ipmi_devintf ipmi_si ipmi_msghandler e1000 CPU: 2 EIP: 0060:[<c0274397>] Tainted: P VLI EFLAGS: 00010246 (2.6.14.IWSA-2.5.1000) EIP is at find_best_ips_proto+0xae/0xbd eax: b5e2f426 ebx: c0a80106 ecx: 00000000 edx: 00000000 esi: b5e2f426 edi: ffffffff ebp: e88279a4 esp: e8827934 ds: 007b es: 007b ss: 0068 Process iwssd (pid: 2969, threadinfo=e8826000 task=d2b4fa50) Stack: c039805c e88279a4 c039805c e88279b4 00000000 c027440c e88279a4 c039805c e1c758f0 00000000 e1c758f0 e88279b4 e1c758f0 e1c75980 00000000 c02744d9 e88279a4 e88279b4 c039805c e1c758f0 00000000 e88279b4 e1c759d4 00000000 Call Trace: [<c027440c>] get_unique_tuple+0x66/0xc2 [<c02744d9>] ip_nat_setup_info+0x71/0x1aa [<c028a7af>] do_replace+0x35c/0x6d2 [<c028a7af>] do_replace+0x35c/0x6d2 [<c027633d>] ip_tproxy_setup_nat_bidir+0xd1/0x152 [<c0276532>] ip_tproxy_setup_nat+0x31/0x4c [<c027676d>] ip_tproxy_fn+0x1d5/0x30c [<c0274691>] ip_nat_manip_pkt+0x7f/0xb6 [<c027473a>] ip_nat_packet+0x72/0x89 [<f88639eb>] e1000_xmit_frame+0x6df/0xc86 [e1000] [<c0283fc8>] br_dev_queue_push_xmit+0x0/0xdf [<c027dafa>] nf_iterate+0x3f/0x5f [<c0283fc8>] br_dev_queue_push_xmit+0x0/0xdf [<c027db61>] nf_hook_slow+0x47/0xcb [<c0283fc8>] br_dev_queue_push_xmit+0x0/0xdf [<c0288d46>] br_nf_post_routing+0x11c/0x138 [<c0283fc8>] br_dev_queue_push_xmit+0x0/0xdf [<c0283fc8>] br_dev_queue_push_xmit+0x0/0xdf [<c027dafa>] nf_iterate+0x3f/0x5f ... ... ... [<c022dcb5>] release_sock+0xf/0x4f [<c024cb78>] tcp_recvmsg+0x65c/0x693 [<c026819f>] inet_addr_type+0x63/0x92 [<c02640ca>] inet_stream_connect+0x89/0x14b [<c022bb93>] sys_connect+0x5a/0x76 [<c022ddf4>] sock_common_setsockopt+0x1e/0x22 [<c022bf1c>] sys_setsockopt+0x58/0x70 [<c01bfeba>] copy_from_user+0x34/0x5a [<c022c3b3>] sys_socketcall+0x78/0x180 [<c0102439>] syscall_call+0x7/0xb Code: 05 31 ce 89 f1 29 f2 29 f0 c1 e9 03 31 ca 89 d1 29 d0 29 d6 c1 e1 0a 31 c8 29 c6 c1 e8 0f 29 df 8d 57 01 31 c6 89 d1 89 f0 31 d2 <f7> f1 01 d3 0f cb 89 5d 00 5b 5b 5e 5f 5d c3 55 57 56 53 50 8b <0>Kernel panic - not syncing: Fatal exception in interrupt Best Regards, Eric Chao TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

2 1

tproxy newbie question
by Sergei Lavrov 13 Aug '06

13 Aug '06

Hi, When I take a closer at the patch file, I noticed two directory structures: There are: linux-2.6.10/... in the 01-nat_reservations.diff and 02_nat_reservations_tproxy_exports.diff linux-2.6.10-tproxy2/... in the 03-tproxy.diff Why are there two different directory structures ? Thanks, Sergei __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

2 1

cttproxy-2.6.15-2.0.4 patch error
by Sergei Lavrov 13 Aug '06

13 Aug '06

I am trying to do a tproxy patch on linux-2.6.15 Why is it complaining ?? ------------------------------------------------------ linux:/home/lavrov 104 >ls -d linux-2.6.15 linux-2.6.15 linux:/home/lavrov 105 >ls -d cttproxy-2.6.15-2.0.4 cttproxy-2.6.15-2.0.4 linux:/home/lavrov 106 >cat patchscript #!/bin/sh for i in patch_tree/0{0,1,2,3}*.diff; do cat $i | patch -p1; done linux:/home/lavrov 107 >./patchscript cat: patch_tree/00*.diff: No such file or directory can't find file to patch at input line 8 Perhaps you used the wrong -p or --strip option? The text leading up to this was: -------------------------- |NAT reservations | |%patch |Index: linux-2.6.15/include/linux/netfilter_ipv4/ip_conntrack.h |=================================================================== |--- linux-2.6.15.orig/include/linux/netfilter_ipv4/ip_conntrack.h 2006-01-09 21:54:02.000000000 +0100 |+++ linux-2.6.15/include/linux/netfilter_ipv4/ip_conntrack.h 2006-01-09 23:29:43.000000000 +0100 -------------------------- File to patch: __________________________________________________ Do You Yahoo!? Tired of spam? Yahoo! Mail has the best spam protection around http://mail.yahoo.com

1 0

Whitespace
by Jan Engelhardt 09 Aug '06

09 Aug '06

Hm, did I actually send this request? Fix all trailing whitespace! Today: tproxy2_2.6.18 Warning: trailing whitespace in line 1346 of net/ipv4/netfilter/iptable_tproxy.c Regs, Jan Engelhardt --

1 0

Tproxy with 2.6.15.2 --on-port-80 error
by Sunil K.P. 08 Aug '06

08 Aug '06

Hi, I have installed Tproxy patch on Fedora core 2.6.15.2 kernel. In lsmod I can see the following. ipt_TPROXY 2432 0 ipt_tproxy 2048 0 ipt_REDIRECT 2560 1 ip_conntrack_netbios_ns 3328 0 iptable_nat 7812 1 ip_nat 23340 2 ipt_REDIRECT,iptable_nat iptable_mangle 3200 0 ipt_REJECT 5760 1 ipt_state 2432 4 ip_conntrack 51416 4 ip_conntrack_netbios_ns,iptable_nat,ip_nat,ipt_state nfnetlink 6808 2 ip_nat,ip_conntrack iptable_filter 3328 1 ip_tables 19840 8 ipt_TPROXY,ipt_tproxy,ipt_REDIRECT,iptable_nat,iptable_mangle,ipt_REJECT,ipt_state,iptable_filter But when I try to put the redirection it gives the following error [root@cache netfilter]# iptables -t tproxy -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 iptables v1.3.5: Unknown arg `--on-port' Pls. suggest. Regards Sunny

2 10

Tproxy on the brigde
by Zharovtsev, Anton 07 Aug '06

07 Aug '06

Hi people. Is any possibility to set tproxy on the linux box witch is bridge only ? Bridge has no its own ip-address. There is no other network interfaces on this box or there is interface wich is used for management only (fake address space) and has no default gateway. The bridge is needed to save network configuration unchanged. May be there is a mini-mini-howto how to make this?

2 1

To overcome firewall reject rule
by eric_chao＠trend.com.tw 03 Aug '06

03 Aug '06

Hi All, I have a problem with my firewall settings. Currently, tproxy cannot work with with FTP in active mode. In my firewall settings, I have ............ # Allow packets that belong to tproxy pass. iptables -A INPUT -m tproxy -j ACCEPT # Accept all traffic for tproxy?? #### Default Drop everything in INPUT chain iptables -P INPUT DROP # NOTE the default DROP policy iptables -P OUTPUT ACCEPT ......... For Active FTP, my proxy server is listening on behalf of the connected client but somehow the FTP server cannot connect back due to the firewall DROP policy on INPUT. What I want is to accept all tproxy traffic even with the default DROP policy. Will "iptables -A INPUT -m tproxy -j ACCEPT" impose any security concerns? Thanks very much for any help. TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

1 0