November 2007 - tproxy - lists.balabit.hu

Re: [tproxy] tproxy4, kernel 2.6.22 and squid-2.6.stable13
by Ming-Ching Tiew 17 Dec '07

17 Dec '07

From: "Ming-Ching Tiew" <mingching.tiew(a)redtone.com> > > Sorry to contradict my ownself. It seems my testing was not quite > conclusive. > I will report again as soon as I have conclusion. Please ignore my previous > posts. > OK this is my observation after modifying squid-2.6.STABLE.13 to use IP_FREEBIND :- 1. Transparent tproxy is working without NAT. 2. When SNAT is done in the nat table POSTROUTING chain, packets goes out and comes back using public IP ( tcpdump confirms it ) however, squid don't seem to be able to get the return packet. In the tproxy2 case, the packet goes out using spoofed private IP and hence unable to route back but there is a patch created by Arun which fixes this problem. In the case of tproxy4 using IP_FREEBIND, I wonder if there is someone who can work on an equivalent patch. Regards. -------------------------------------------- Important Warning! *************************** This electronic communication (including any attached files) may contain confidential and/or legally privileged information and is only intended for the use of the person to whom it is addressed. If you are not the intended recipient, you do not have permission to read, use, disseminate, distribute, copy or retain any part of this communication or its attachments in any form. If this e-mail was sent to you by mistake, please take the time to notify the sender so that they can identify the problem and avoid any more mistakes in sending e-mail to you. The unauthorised use of information contained in this communication or its attachments may result in legal action against any person who uses it.

5 17

tproxy on bridge interface
by Michael Gaisinsky 26 Nov '07

26 Nov '07

Hello. On Wed Nov 14 22:35:19 CET 2007 Cameron Schaus wrote: "I have done some previous investigation around using tproxy4 code on a bridge interface. I found that the bridge code clobbers the dst route entry added by tproxy4 during prerouting, and that packets processed by tproxy destined for the localhost need to be marked with a packet type of PACKET_HOST otherwise they are dropped higher up the stack. I don't have a patch right now, but I can get you a diff of the bridge code changes needed to make this work if you are interested. The changes are fairly minor. Cam" I would like to get an assistance in one of the following ways: 1. If exist, to get the patch for the "the bridge code changes". 2. Diff between original source code and modified one. 3. More guidance for code area(s) that need to be modified. Thanks in advance, Michael Gaisinsky <Mike(a)PineApp.Com>

3 2

tproxy4, kernel 2.6.22 and squid-2.6.stable13
by Ming-Ching Tiew 23 Nov '07

23 Nov '07

After checking the mail archive and did some testings, I noticed there are quite many different versions of the stuff floating around. Those in the netfilter web site has given me lots of headaches ( kernel version, iptable version and so on ), so I figured that I would dig more deeply into the version on balabit website, ie tproxy-4.0.3-2.6.22.tgz since they seems to only has minor incompatibility with squid. After installing the patch to a 2.6.22 kernel and compiling iptables 1.3.8, everything went on smoothly. And I testing a version of squid-2.6.stable13 with has been previously working with tproxy2 ( and I did modprobe iptable_tproxy tproxy_any=1 ), I noticed that squid is able to receive the redirected traffic. It's positive so far ! However upon checking the traffic, I noticed that the spoofing is not working, even though the http has been cached by squid. The squid cache.log says :- tproxy ip=192.168.1.5,0x576e4c0,port=0 ERROR ASSIGN That would be quite understandable, because the binary for squid has been compiled with ( ~/src/forward.c ) :- itp.v.addr.faddr.s_addr = fwdState->src.sin_addr.s_addr; itp.v.addr.fport = 0; itp.op = TPROXY_ASSIGN; if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { debug(20, 1) ("tproxy ip=%s,0x%x,port=%d ERROR ASSIGN\n", inet_ntoa(itp.v.addr.faddr), itp.v.addr.faddr.s_addr, itp.v.addr.fport); } else { itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) debug(20, 1) ("tproxy ip=%x,port=%d ERROR CONNECT\n", itp.v.addr.faddr.s_addr, itp.v.addr.fport); } The tproxy-4.0.3-2.6.22.tgz did not mention how a source should be changed to use the new tproxy, I did try using IP_FREEBIND ( using #define IP_FREEBIND 15 ) and the error goes away, but the spoofing has not been done. Any suggestion where else should I check to convince squid to using the new spoofing mechanism ? Best regards. -------------------------------------------- Important Warning! *************************** This electronic communication (including any attached files) may contain confidential and/or legally privileged information and is only intended for the use of the person to whom it is addressed. If you are not the intended recipient, you do not have permission to read, use, disseminate, distribute, copy or retain any part of this communication or its attachments in any form. If this e-mail was sent to you by mistake, please take the time to notify the sender so that they can identify the problem and avoid any more mistakes in sending e-mail to you. The unauthorised use of information contained in this communication or its attachments may result in legal action against any person who uses it.

3 6

Re: [tproxy] Fwd: Tproxy changes for performing dual NAT
by KOVACS Krisztian 20 Nov '07

20 Nov '07

Hi, On Mon, Oct 15, 2007 at 04:30:03PM +0530, Arun S wrote: > I am not aware of this. I have tried tproxy4.0.3 and > Squid-2.6-STABLE14. But real transparency was not happening. Does it > require support from the application too? Yes, and the modifications it requires are different compared to those of required by tproxy2. > Could you please throw some light on this? I don't have a patch for squid at the moment but creating one should be quite straigtforward. I'll try to come up with one once I find the time to do so. A very brief README: http://marc.info/?l=linux-netdev&m=119229721212273&w=2 As an example, here's the patch necessary to make netcat work: http://people.netfilter.org/hidden/tproxy/netcat-ip_transparent-support.pat… -- KOVACS Krisztian

8 35

tproxy on bridge interface
by Ondrej Kraus 14 Nov '07

14 Nov '07

Hello there, we have working machine with kernel 2.6.17.14, tproxy-4.0.1 and zorp 3.0.8. Network configuration of this router is: eth0: 192.168.0.1/24 eth1.10: 192.168.1.1/24 (eth1 vlan 10) eth1.11: 192.168.2.1/24 (eth1 vlan 11) dummy0: 192.168.3.1/32 Testing client is at 192.168.0.2 and testing http server at 192.168.2.2 (on vlan 11). When I load tproxy module with tproxy_any=1 and configure zorp for transparent proxying, everything works fine. But when I bind eth1.10 and eth1.11 to a bridge (br1): brctl addbr br1 brctl addif br1 eth1.10 brctl addif br1 eth1.11 ifconfig br1 192.168.1.1 netmask 255.255.255.0 ifconfig br1:0 192.168.2.1 netmask 255.255.255.0 then I can reach 192.168.2.2 from the route and from client, but zorp cannot. Communication flows from the client to the router, is redirected to zorp, zorp catches it, binds to clients ip address and sends SYN packet to the http server. But communication from the http server passes thru tproxy box without being catched by tproxy mechanisms. In the other words - client sees responses from zorp and responses from http server to zorp. Zorp never gets a packet from http server. I don't know what is wrong. Is it known issue? Is there any workaround for this problem? Thank you for any idea Ondrej Kraus

2 1

Redirect to proxy via TPROXY target didn't work.
by Mohamed Badri 09 Nov '07

09 Nov '07

Hi, I'm running Linux 2.6.22, Iptables 1.3.8, with Tproxy 4.0.3 patches I've added the following rules in iptables : iptables -t tproxy -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j TPROXY --on-port 50080 iptables -t tproxy -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j TPROXY --on-port 50080 but nothing happens, connexions to port 80 are not redirected to local port 50080. Can I use NETMAP target in nat table while using tproxy ? Did I miss something ? thank you.

2 2

Content rewrite.
by Mohamed Badri 07 Nov '07

07 Nov '07

HI, I'm currently installing tproxy on a server with iptables and squid patched. I'm going to use a redirector with squid to rewrite Urls requested by web clients, then I wanted to know if it's possible to parse the html responses from servers to modify urls in it transparently ? any patch to squid who can do that ? use apache ? thank's for any information. ----

1 0

Re: [tproxy] Fwd: Tproxy changes for performing dual NAT
by Siumafua Moala 05 Nov '07

05 Nov '07

Hello, How did you compile squid with linux 2.6.22. I tried but it complains about ip_tproxy.h, etc. I'm going back to earlier version until I saw your post that you are able to do this. Regards, S. Moala -----Original Message----- From: tproxy-bounces(a)lists.balabit.hu [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of Arun S Sent: Saturday, October 27, 2007 2:06 AM To: Tóth László Attila; KOVACS Krisztian Cc: tproxy(a)lists.balabit.hu Subject: Re: [tproxy] Fwd: Tproxy changes for performing dual NAT Hi Kovacs/Attila, I have successfully applied your patches tproxy4-2.6.22_20070622.tar.bz2 on linux-2.6.22 and got all the modules compiled. Also iptables-1.4.0rc1 is applied with the patch iptables-tproxy-200710091749.diff. But I get error while adding the following rule: [root@Arun-FC6-SQUID linux-tproxy4-RnD]# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark iptables v1.4.0rc1: Unknown arg `--tproxy-mark' Try `iptables -h' or 'iptables --help' for more information. [root@Arun-FC6-SQUID linux-tproxy4-RnD]# iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 iptables: Invalid argument Am I missing anything? TIA. Regards, Arun S. On 23/10/2007, Arun S <hi2arun(a)gmail.com> wrote: > Hi, > > Thank you. I will get this downloaded and try to tweak Squid to work > for the latest tproxy4 changes. > > Will let you know the changes in Squid once I manage to get Squid > compiled for tproxy4. > > > > On 22/10/2007, Tóth László Attila <panther(a)elte.hu> wrote: > > Hello, > > > > On 2007.10.22., at 18:51, Arun S wrote: > > > > > Hi Attila / Krisztian, > > > > > > Could you please tell me which version of linux kernel shall I use to > > > try the latest tproxy4 changes and from where shall I get the latest > > > tproxy4 patches? > > > > > > > 2.6.23 should be ok with both version: at www.balabit.com and at > > http://people.netfilter.org/hidden/tproxy/ > > The first one is tested for 2.6.22 only. > > > > How can it enabled in squid: I don't know the source code but it > > requires no secial code with TProxy4 except set the IP_TRANSPARENT > > socket option for lisening socket. It is a new option: > > #define IP_TRANSPARENT 19 > > > > HTH, > > Attila > > > > > > > > > > > -- > Regards, > Arun S. > -- Regards, Arun S. _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy

2 1