September 2007 - tproxy - lists.balabit.hu

missing ip_tproxy.h header file
by Sunday A. Idajili [ITClick Lagos] 23 Sep '07

23 Sep '07

Hi I need help with tproxy. Am trying to get it to work with squid-2.6.STABLE16 but I get the popular missing ip_tproxy.h header file error while compiling: "checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ " I run Debian with kernel 2.6.22 compiled with tproxy 4.0.3 support already. I followed the instruction for patching the kernel and iptables-1.3.8. I can load the iptable_tproxy module: candy:~# modprobe iptable_tproxy candy:~# lsmod Module Size Used by iptable_tproxy 6404 0 ip_tables 11592 1 iptable_tproxy ipv6 225508 12 dm_snapshot 16416 0 dm_mirror 19712 0 dm_mod 50624 2 dm_snapshot,dm_mirror 8021q 18952 0 xt_tproxy 2048 0 x_tables 14084 2 ip_tables,xt_tproxy reiserfs 216832 1 loop 16260 0 pcspkr 2944 0 rtc 11672 0 i2c_piix4 8460 0 i2c_core 23696 1 i2c_piix4 ext3 118792 1 jbd 49832 1 ext3 sd_mod 27280 5 aic7xxx 160600 3 scsi_transport_spi 23296 1 aic7xxx scsi_mod 134540 3 sd_mod,aic7xxx,scsi_transport_spi tulip 47776 0 candy:~# dmesg | grep TPROX IP_TPROXY: Transparent proxy support initialized, version 4.0.0 IP_TPROXY: Copyright (c) 2002-2007 BalaBit IT Ltd. I can add iptables rule with tproxy without any problem: candy:~# iptables -t tproxy -A PREROUTING -j TPROXY --on-port 3128 candy:~# iptables -t tproxy -L Chain PREROUTING (policy ACCEPT) target prot opt source destination TPROXY all -- anywhere anywhere TPROXY redirect 0.0.0.0:3128 candy:~# My problem is the missing ip_tproxy.h file. Its not anywhere in my /usr/src/linux. I have searched everywhere for a solution the past 7 days with no luck. Please help me as am flat out of ideas! Thanks in advance. Sonny.

3 2

Stunnel 4 on linux 2.6.22
by Mike Mattice 20 Sep '07

20 Sep '07

This strace shows my (albeit hacked up) work attempting to get stunnel to play with tproxy support. strace obviously doesn't know how to interpret the IP_FREEBIND passed to setsockopt, but other than that, it's not throwing an error there. Stunnel uses the EINPROGRESS error as a signal to attempt the next ip in the list (if it has one) so it just ends up resetting a perfectly good connection every time. We're using tproxy 4.0.2-2.6.22 Do we _have_ to patch iptables and set up the tproxy stuff there in order to do the tproxy freebind stuff? Thanks... 779 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 8 779 fcntl64(8, F_GETFL) = 0x2 (flags O_RDWR) 779 fcntl64(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0 779 setsockopt(8, SOL_IP, 0xf /* IP_??? */, [1], 4) = 0 779 bind(8, {sa_family=AF_INET, sin_port=htons(60413), sin_addr=inet_addr("172.16.200.249")}, 16) = 0 779 connect(8, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress)

2 1

iptables 1.3.8 problem
by Vects 20 Sep '07

20 Sep '07

Hello there, I have some problem with iptables 1.3.8, please point me out where's my error is. I took latest tproxy patches, applied them on kernel 2.6.22.6 and iptables 1.3.8 according to README, I used iptables-1.3.8.diff for iptables-1.3.8.diff but can't add any iptables rules with TPROXY for some reasons. Here's some details about my set up module is loaded # dmesg | grep TPROX IP_TPROXY: Transparent proxy support initialized, version 4.0.0 IP_TPROXY: Copyright (c) 2002-2007 BalaBit IT Ltd. module is loaded # lsmod | grep proxy iptable_tproxy 7620 0 ip_tables 20840 3 iptable_nat,iptable_tproxy,iptable_filter list of rules # iptables -t tproxy -L -n Chain PREROUTING (policy ACCEPT) target prot opt source destination iptables has failed # iptables -t tproxy -A PREROUTING -j TPROXY --on-port 80 iptables: No chain/target/match by that name I guess I missed something, please advise. Thanks, Alexc

2 3

tproxy4 future
by Balazs Scheidler 18 Sep '07

18 Sep '07

Hi, As some of you might know, the 5th Netfilter Developer's Workshop took place last week in Karlsruhe, Germany. Krisztian Kovacs (hidden) and me attended the workshop and tried to merge the somewhat diverged work on tproxy4. The fork of the tproxy code was caused by a change of maintenance, thus some of the latest work of Krisztian was left out from the latest 4.0.x patches released by Panther. (more exactly the "socket" match and the mark based diversion code). On the workshop we merged our efforts again in order to get acceptance of the Linux net/netfilter maintainers. (DaveM and Patrick McHardy). This will again change the way tproxy should be used. Sorry for breaking compatibility again, and the whole confusion, hopefully the results will be a tproxy functionality merged in the Linux kernel. :) The most important changes relative to the current 4.0.x patches are: * the tproxy table is gone, TPROXY targets need to be added to the mangle table instead * the tproxy match is gone, a new "socket" match is introduced * instead of using a separate routing trick to divert packets to the local IP stack inside the TProxy target, we are now using stock routing decisions, and need a bit in the packet MARK field, and perform diversion by using an advanced routing rule. * instead of IP_FREEBIND we are using a setsockopt named IP_TRANSPARENT which requires CAP_NET_ADMIN privilege * in previous patches the output routing decision was commented out, it is now correctly decided whether a packet belongs to a tproxied connection or not. These are the major changes, now here's a script that demonstrates TProxy usage: 1) create advanced routing rules We are using the lowest bit of the packet MARK value to indicate that the packet was diverted by the TProxy code. The exact bit value can be changed. Commands to set this up: ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 2) create TProxy rules in the mangle table # create a chain named DIVERT iptables -t mangle -N DIVERT # everything that matches "-m socket" should go to the local stack iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT # connections to be redirected should use the TPROXY target, which sets # up redirection, and marks the packet according to its 'tproxy-mark' # argument iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 # DIVERT chain: mark packets and accept iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT The ruleset would be much simpler if iptables would support ebtables like multiple targets, which it is going to. In that case the rules would become: iptables -t mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1 -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 j MARK --set-mark 1 -j TPROXY --on-port 50080 Hopefully this will also be implemented soon. I have done some functionality testing on the patchset, and things like redirection did work. We'll start some more testing this week, however more tests never hurt. We'd appreciate if someone could help us with testing. The latest patchset is available at: http://home.sch.bme.hu/~piglet/netfilter/tproxy/ Some documentation and manual pages are still missing, but we are working on that issue as well. -- Bazsi

3 6

TProxy version 4.0.3 released
by Laszlo Attila Toth 17 Sep '07

17 Sep '07

Hello, TProxy version 4.0.3 has been released for Linux 2.6.22 The release tarball is available here: http://www.balabit.com/downloads/files/tproxy/ MD5 checksum: c4d9808a205160575945db47da8d75c5 tproxy-4.0.3-2.6.22.tgz It contains diff for iptables-1.3.8 and iptables-svn r7047. The iptables-svn.diff patch doesn't work with the old version of iptables (1.3.8) beceause it doesn't yet support xtables. -- Panther

1 0

libxt_TPROXY.c not compiling on iptables-1.3.8
by Romie Djapri 17 Sep '07

17 Sep '07

Hi, I'm a new member in this list. I want to try to use TPROXY. And I downloaded iptables-1.3.8 and patch it against tproxy-4.0.2-2.6.22 from balabit download website. It patched successfully, but it will not compile the libxt_TPROXY.c. I've read the archive and Laszlo attached the fixed for Lachlan about the same question as mine. Can I get the patch too ? Thank you. Best regards, Romie Djapri

2 1

Re: [tproxy] tproxy Digest, Vol 27, Issue 7
by last 17 Sep '07

17 Sep '07

I have the same question! where is the patch? last 2007-09-17 发件人： tproxy-request(a)lists.balabit.hu 发送时间： 2007-09-16 18:00:22 收件人： tproxy(a)lists.balabit.hu 抄送：主题： tproxy Digest, Vol 27, Issue 7 Send tproxy mailing list submissions to tproxy(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/tproxy or, via email, send a message with subject or body 'help' to tproxy-request(a)lists.balabit.hu You can reach the person managing the list at tproxy-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of tproxy digest..." Today's Topics: 1. libxt_TPROXY.c not compiling on iptables-1.3.8 (Romie Djapri) ---------------------------------------------------------------------- Message: 1 Date: Sat, 15 Sep 2007 17:48:21 +0700 From: Romie Djapri <rmdjapri(a)tokolinux.com > Subject: [tproxy] libxt_TPROXY.c not compiling on iptables-1.3.8 To: tproxy(a)lists.balabit.hu Message-ID: <46EBB875.3060606(a)tokolinux.com > Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi, I'm a new member in this list. I want to try to use TPROXY. And I downloaded iptables-1.3.8 and patch it against tproxy-4.0.2-2.6.22 from balabit download website. It patched successfully, but it will not compile the libxt_TPROXY.c. I've read the archive and Laszlo attached the fixed for Lachlan about the same question as mine. Can I get the patch too ? Thank you. Best regards, Romie Djapri ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 27, Issue 7 *************************************

1 0

TPROXY VER4 doesn't work wih squid
by ogeb 10 Sep '07

10 Sep '07

hi, i have problem with tproxy version 4 squid -z FATAL: Bungled squid.conf line 1: http_port 3128 transparent tproxy Squid Cache (Version 2.6.STABLE16-20070906): Terminated abnormally. [ 230.176831] IP_TPROXY: Transparent proxy support initialized, version 4.0.0 [ 230.176835] IP_TPROXY: Copyright (c) 2002-2007 BalaBit IT Ltd. please advice. best regards ogeb ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

2 1

libipt_TPROXY.so not compiled
by Lachlan Bowes 05 Sep '07

05 Sep '07

Have any of you seen this before? I followed instructions in README, but to no avail. Apologies if this is obvious but I am from a FreeBSD background, linux is not my normal OS so environment is foreign to me. Regards, Lachlan root@syd-log01:/root/tproxy-4.0.1-2.6.22# uname -a Linux syd-log01 2.6.22.3 #1 SMP Tue Aug 28 21:54:20 EST 2007 i686 GNU/Linux root@syd-log01:/root/tproxy-4.0.1-2.6.22# root@syd-log01:/root/tproxy-4.0.1-2.6.22# iptables -t tproxy -A PREROUTING -j TPROXY --on-port 3128 iptables v1.3.8: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. root@syd-log01:/root/tproxy-4.0.1-2.6.22# iptables -t tproxy -A PREROUTING -j TPROXY iptables v1.3.8: Couldn't load target `TPROXY':/usr/local/lib/iptables/libipt_TPROXY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. root@syd-log01:/root/tproxy-4.0.1-2.6.22# lsmod | grep iptable iptable_filter 3104 0 iptable_tproxy 6468 0 ip_tables 12420 2 iptable_filter,iptable_tproxy root@syd-log01:/root/tproxy-4.0.1-2.6.22#

2 7