August 2007 - tproxy - lists.balabit.hu

libipt_TPROXY.so not compiled
by Lachlan Bowes 05 Sep '07

05 Sep '07

Have any of you seen this before? I followed instructions in README, but to no avail. Apologies if this is obvious but I am from a FreeBSD background, linux is not my normal OS so environment is foreign to me. Regards, Lachlan root@syd-log01:/root/tproxy-4.0.1-2.6.22# uname -a Linux syd-log01 2.6.22.3 #1 SMP Tue Aug 28 21:54:20 EST 2007 i686 GNU/Linux root@syd-log01:/root/tproxy-4.0.1-2.6.22# root@syd-log01:/root/tproxy-4.0.1-2.6.22# iptables -t tproxy -A PREROUTING -j TPROXY --on-port 3128 iptables v1.3.8: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. root@syd-log01:/root/tproxy-4.0.1-2.6.22# iptables -t tproxy -A PREROUTING -j TPROXY iptables v1.3.8: Couldn't load target `TPROXY':/usr/local/lib/iptables/libipt_TPROXY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. root@syd-log01:/root/tproxy-4.0.1-2.6.22# lsmod | grep iptable iptable_filter 3104 0 iptable_tproxy 6468 0 ip_tables 12420 2 iptable_filter,iptable_tproxy root@syd-log01:/root/tproxy-4.0.1-2.6.22#

2 7

tproxy4 and bridge
by Cameron Schaus 23 Aug '07

23 Aug '07

I have managed to resolve the problems that prevented trpoxy4 from working on a bridged interface. There were 2 issues: a) bridge netfilter code was clobbering the skb->dst added by tproxy prerouting b) changed bridge ingress packet handling routing to inspect skb->ip_tproxy flag, and if set, change dest mac to that of bridge and set skb->pkt_type to PACKET_HOST With these changes, the foreign-connect and foreign-listen test programs are working correctly. I'll post patches against the bridge code once I've validated the changes I've made -- there are a couple of things I'm still not sure about. However, I have once concern with tproxy4 and what I'm ultimately trying to accomplish. Here is the setup: Proxy application bound to a bridge interface (192.168.0.73, port 8180). Traffic destined to port 80 is redirected to the bridge IP, port 8180 with iptables. So, if a client, 192.168.0.139, connects to a server, 192.168.0.121 (all the traffic passes through the proxy bridge), the proxy application will then: - create a socket - setsockopt(sock, IP_FREEBIND) - bind(CLIENT_IP, CLIENT_SOURCE_PORT) - connect(SERVER_IP, port 80) However, the connect does not work. Syn packets are sent from the bridge to the server, the server responds with Syn-Ack, but the Syn-Ack packet triggers an ip_rt_bug message: ip_rt_bug: 192.168.0.139 -> 192.168.0.73, ? Firstly, is it possible to do what I am trying to do with tproxy4? I suspect that there may be some confusion when the routing code tries to lookup the socket, since it is using the source IP, dest IP and interface to find the socket in the hash. Won't the client and server socket look similar in this regard? How would the routing code know which of the 2 sockets an incoming packet is destined for, since all packets arrive on the bridge interface? Thanks, Cam

2 2

doing SNAT after tproxy doing IP spoofing
by Kannan Sampath 22 Aug '07

22 Aug '07

Hi, I am looking for a solution, where I want to use TPROXY to do the IP spoofing, followed by SNAT. When I tried to add a rule in POSTROUTE nat iptable for my SNAT, it is never hit. In my case, the user machine's IP addr is 10.0.0.1 <http://80.0.0.1/_>, and the IP address of the Squid machine on user side is 10.0.0.99<http://80.0.0.99/_>. User's http packet arrives Squid machine. I have already applied tproxy patch. The IP address of Squid machine's physical interface on internet side is 90.0.0.99 <http://90.0.0.99/_>. When the Squid establishes connection with internet server, lets say google.com <http://google.com/_> (IP address is 150.0.0.1 <http://150.0.0.1/_> example), then the packet has to go with SourceIP address as 70.0.0.1 I have a static SNAT for the user IP address as follows in POSTROUTE nat iptable as "10.0.0.1 <http://80.0.0.1/_> <---> 70.0.0.1 <http://70.0.0.1/_> ". i.e, After doing the IP Spoofing, we need to apply static NAT. With TPROXY, it is not working as I expected. Instead, it is sending the packet with source IP addr as 10.0.0.1. How do we resolve this issue? Thanks in advance, and sorry for the big email. Regards, Kannan.

3 2

Re: [tproxy] TPROXY + Arp Table
by Jojy Varghese 22 Aug '07

22 Aug '07

Thanks Bazsi. In a real life scenario, where my proxy server will be inside a firewall how can the proxy server make the routing decision? The trafic is always going to flow through the firewall/router and then come to the subnet having the proxy server. On Wed, 2007-08-15 at 11:01 -0700, Jojy Varghese wrote: > Hi > I was trying the example code given with the patch and couldnt get > it to work. Upon tcpdump'ing the packets, I found out that my > firewall(Cisco) sends out a ARP request for the FOREIGN IP address i > am masquerading the request as and after that the packet is dropped. > How do I get around this problem? I am sure this is nothing unusual > setting and I might be missing something fundamental here. > > Any help is much appreciated. the masquaraded IP address must be routed through the TProxy box. -- Bazsi Need a vacation? Get great deals to amazing places on Yahoo! Travel. ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

2 1

Re: [tproxy] Issue with iptables 1.3.8
by Marco Aurelio da Silva 21 Aug '07

21 Aug '07

Hello, Did you set KERNEL_DIR to your kernel source (/usr/src/linux)? Only with it can you compile libxt_TROXY, libxt_tproxy and some other modules (see extensions/.tproxy-testx) Yes, I used make KERNELDIR=/usr/src/linux, and nothing. Then I edit .tproxy-testx and point to my kernel (/usr/src/linux-2.6.22.4) and nothing. Thanks for help. Marco.

2 6

Re: [tproxy] TPROXY + Arp Table
by Jojy Varghese 21 Aug '07

21 Aug '07

Thanks Bazsi. Does it mean that the patch wont work in a WCCP configuration? Because with WCCP, the proxy cannot be the router nor can it be inline with the router. Googling on this problem led me to this link : http://wiki.squid-cache.org/ConfigExamples/FullyTransparentWithTPROXY. I am unable to figure out how Squid in WCCP mode can work with the patch. What I am trying to do is something similar. thanks again Jojy ----- Original Message ---- From: Balazs Scheidler <bazsi(a)balabit.hu> To: Jojy Varghese <jojygv(a)yahoo.com> Cc: tproxy(a)lists.balabit.hu Sent: Friday, August 17, 2007 12:14:13 AM Subject: Re: [tproxy] TPROXY + Arp Table On Thu, 2007-08-16 at 13:21 -0700, Jojy Varghese wrote: > Thanks Bazsi. In a real life scenario, where my proxy server will be > inside a firewall how can the proxy server make the routing decision? > The trafic is always going to flow through the firewall/router and > then come to the subnet having the proxy server. In order for tproxy to work the traffic must flow through the tproxy box. Either install the proxy on the firewall, or put it in-line with the firewall. That's the only way to do it. With Zorp you could script a different scenario, but I guess you are not using Zorp as a firewall. -- Bazsi ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

2 1

Issue with iptables 1.3.8
by Marco Aurelio da Silva 21 Aug '07

21 Aug '07

Hy, I'm using the new version o tproxy 4.0.1 for kernel 2.6.22 and iptables 1.3.8. The patches are applyed correctly both in kernel and iptables. The modules of kernel are compiled correctly but I cant compile the library for iptables. Dont generate the .so file. Can someone help me please. Thanks, Marco.

2 1

Re: [tproxy] TPROXY + Arp Table
by Balazs Scheidler 17 Aug '07

17 Aug '07

On Thu, 2007-08-16 at 13:21 -0700, Jojy Varghese wrote: > Thanks Bazsi. In a real life scenario, where my proxy server will be > inside a firewall how can the proxy server make the routing decision? > The trafic is always going to flow through the firewall/router and > then come to the subnet having the proxy server. In order for tproxy to work the traffic must flow through the tproxy box. Either install the proxy on the firewall, or put it in-line with the firewall. That's the only way to do it. With Zorp you could script a different scenario, but I guess you are not using Zorp as a firewall. -- Bazsi

1 0

Re: [tproxy] TPROXY + Cisco Firewall
by Jojy Varghese 16 Aug '07

16 Aug '07

Hi I thought some more info might be helpful for someone following this thread. In my code, when I call "setsockopt" to set the TPROXY_ASSIGN and TPROXY_FLAGS options, I get an error. Please see the code below. Any ideas why this might be? Also, if I set the local address port to 0 or the foreign address port to 0, how does that matter? IN other words, how important is the port assignment? thanks in advance Jojy ##### Code Begins ######################### struct in_tproxy itp; struct sockaddr_in sin; itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if(setsockopt(handle,SOL_IP,IP_TPROXY,&itp,sizeof(itp)) == -1 ) { __log(LOG_ERROR, L"Error Setting version"); } sin.sin_family=AF_INET; inet_aton("192.168.1.74", &sin.sin_addr); sin.sin_port=htons(9999); if(bind(handle, (struct sockaddr*)&sin, sizeof(sin)) == -1) { __log(LOG_ERROR, L"Error Binding"); } itp.op = TPROXY_ASSIGN; inet_aton("192.168.1.75", (struct in_addr *)&itp.v.addr.faddr); itp.v.addr.fport=htons(2000); if(setsockopt(handle,SOL_IP,IP_TPROXY,&itp,sizeof(itp)) == -1 ) { __log(LOG_ERROR, L"Error Setting Assign Option "); } itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; if(setsockopt(handle,SOL_IP,IP_TPROXY,&itp,sizeof(itp)) == -1 ) { __log(LOG_ERROR, L"Error Setting Flags Option "); } // Code to connect follows ### Code ends #### #### Message: 1 Date: Mon, 13 Aug 2007 10:13:15 +0200 From: Laszlo Attila Toth <panther(a)balabit.hu> Subject: Re: [tproxy] TPROXY + Cisco Firewall To: tproxy(a)lists.balabit.hu Message-ID: <200708131013.16001.panther(a)balabit.hu> Content-Type: text/plain; charset="utf-8" On Sunday 12 August 2007 00.28.07 Jojy Varghese wrote: > Hi all > 3. > I have verified my changes by creating a REDIRECTION rule in the tproxy > chain (can list my iptable changes by doing "iptables -t tproxy -L") Hello, For instance a client try to connect to a webserver somewhere on the Internet listening on port 80, and your proxy is listening on port 50080. The iptables rule that redirects packets to that port is the following: iptables -t tproxy -p tcp --dport 80 -j TPROXY --on-port 50080 The next one is to allow incomming traffic on that port. Because the TPROXY target marks the packet, the following rule accepts these packets: iptables -t filter -A INPUT -m tproxy -j ACCEPT A tutorial is available here: http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/ -- Regards, Laszlo Attila Toth ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 26, Issue 11 ************************************** Shape Yahoo! in your own image. Join our Network Research Panel today! ____________________________________________________________________________________ Shape Yahoo! in your own image. Join our Network Research Panel today! http://surveylink.yahoo.com/gmrs/yahoo_panel_invite.asp?a=7

3 4

TPROXY + Arp Table
by Jojy Varghese 16 Aug '07

16 Aug '07

Hi I was trying the example code given with the patch and couldnt get it to work. Upon tcpdump'ing the packets, I found out that my firewall(Cisco) sends out a ARP request for the FOREIGN IP address i am masquerading the request as and after that the packet is dropped. How do I get around this problem? I am sure this is nothing unusual setting and I might be missing something fundamental here. Any help is much appreciated. thanks, Jojy ____________________________________________________________________________________Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV. http://tv.yahoo.com/

2 1