January 2008 - tproxy - lists.balabit.hu

and error from tproxy
by Kamran Sarkary 30 Jan '08

30 Jan '08

I have installed tproxy 2.6.18 and squid 2.6.17 with tproxy enabled on my box everything is fine and look working but invalid IPs, i have should nat invalid IPs in my linux box and i have error in squid and they cant open the page. thanks for your ealest response

1 0

TPROXY_ASSIGN fails with File exists
by Pranav Desai 28 Jan '08

28 Jan '08

Hello All, I am testing with the example code foreign-tcp-connect on kernel-2.6.20.15/cttproxy-2.0.6 When I run the sample in quick successions, I get this message in /var/log/messages and program returns with errno 17 (File exists). IP_TPROXY: socket already assigned, reuse=0, e101a8c0:0f27, sr->faddr=c000010a:d007, flags=210000, sr->tv_hashed=1201103313:191693969 Is it ok to add a check to ignore this ? -- ------------------------------ http://pd.dnsalias.org

2 5

Fw: Tproxy4, fwmark and netfilter route_me_harder
by Ming-Ching Tiew 21 Jan '08

21 Jan '08

Forwarded here just in case some of you are not in netfilter-devel list. ----- Original Message ----- From: "Patrick McHardy" <kaber(a)trash.net> To: "Ming-Ching Tiew" <mingching.tiew(a)redtone.com> Cc: <netfilter-devel(a)vger.kernel.org>; <tproxy(a)lists.balabit.hu> Sent: Sunday, January 20, 2008 11:31 PM Subject: Re: Tproxy4, fwmark and netfilter route_me_harder > Ming-Ching Tiew wrote: > > I sort of just forward this to netfilter-devel. > > > > For those who in netfilter-devel but not in tproxy mail list, a little > > background here :- > > > > I discovered after applying the tproxy4 patch which allows one to spoof > > originating traffic with a foreign IP address ( for the purpose of doing > > transparent proxy ) that after doing it, traffics with foreign IP will > > not leave the system if there is a FWMARK in the mangle table OUTPUT > > chain. Any MARK will screw up the routing. > > > > And the patch above seems to be able to get the packets out of the machine > > again. > > > > So the motivation here perhaps someone here could throw some light as to > > how this situation is best handled. > > > IIRC the current TPROXY patches use a flag in the dst_entry > to indicate that the source address is non-local. So > ip_route_me_harder should probably check that flag and > use routing for foreign addresses for that case. > - -------------------------------------------- Important Warning! *************************** This electronic communication (including any attached files) may contain confidential and/or legally privileged information and is only intended for the use of the person to whom it is addressed. If you are not the intended recipient, you do not have permission to read, use, disseminate, distribute, copy or retain any part of this communication or its attachments in any form. If this e-mail was sent to you by mistake, please take the time to notify the sender so that they can identify the problem and avoid any more mistakes in sending e-mail to you. The unauthorised use of information contained in this communication or its attachments may result in legal action against any person who uses it.

1 0

Tproxy4, fwmark and netfilter route_me_harder
by Ming-Ching Tiew 17 Jan '08

17 Jan '08

KOVACS Krisztian wrote: > Hi, > > On szo, jan 12, 2008 at 11:47:44 +0800, Ming-Ching Tiew wrote: > >> 2 ) IP FREEBIND packets spoofed with foreign source address will not >> leave the system when there is a FWMARK in the mangle table OUTPUT >> chain. This patch is created by me based on the information given by >> Kovacs, code quality is highly questionable as I barely understood >> what's it is all about, but it seems to work. >> >> --- linux-2.6.22-org/net/ipv4/netfilter.c 2007-12-13 >> 20:55:45.000000000 +0800 >> +++ linux-2.6.22-new/net/ipv4/netfilter.c 2007-12-13 >> 20:55:03.000000000 +0800 >> @@ -24,7 +24,7 @@ >> /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause >> * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook. >> */ >> - if (addr_type == RTN_LOCAL) { >> +// if (addr_type == RTN_LOCAL) { >> fl.nl_u.ip4_u.daddr = iph->daddr; >> if (type == RTN_LOCAL) >> fl.nl_u.ip4_u.saddr = iph->saddr; >> @@ -37,10 +37,10 @@ >> /* Drop old route. */ >> dst_release((*pskb)->dst); >> (*pskb)->dst = &rt->u.dst; >> - } else { >> +// } else { >> /* non-local src, find valid iif to satisfy >> * rp-filter when calling ip_route_input. */ >> - fl.nl_u.ip4_u.daddr = iph->saddr; >> +/* fl.nl_u.ip4_u.daddr = iph->saddr; >> if (ip_route_output_key(&rt, &fl) != 0) >> return -1; >> >> @@ -53,7 +53,7 @@ >> dst_release(&rt->u.dst); >> dst_release(odst); >> } >> - >> +*/ >> if ((*pskb)->dst->error) >> return -1; >> > > We should probably first ask on netfilter-devel@ why this whole route > lookup thing is necessary... > > I sort of just forward this to netfilter-devel. For those who in netfilter-devel but not in tproxy mail list, a little background here :- I discovered after applying the tproxy4 patch which allows one to spoof originating traffic with a foreign IP address ( for the purpose of doing transparent proxy ) that after doing it, traffics with foreign IP will not leave the system if there is a FWMARK in the mangle table OUTPUT chain. Any MARK will screw up the routing. And the patch above seems to be able to get the packets out of the machine again. So the motivation here perhaps someone here could throw some light as to how this situation is best handled. Regards.

1 0

Problem with Tproxy more kernel 2.6.22.9
by Welisson 15 Jan '08

15 Jan '08

Hi all, Somebody it would know to say because of this error in the compilation of kernel 2.6.22.9, in system x86_64 net/netfilter/xt_tproxy.c:48: warning: initialization from incompatible pointer type net/netfilter/xt_tproxy.c:56: warning: initialization from incompatible pointer type I applied patch tproxy-4.0.3-2.6.22, in this kernel, iptables iptables-1-3.8.diff, and compiled squid-2.6STABLE17, and in going up of squid it returns. "Missing needed capability support. Will continue without tproxy support" Parameter of compiled squid Squid Cache: Version 2.6.STABLE17-20080108 configure options: '--sysconfdir=/etc/squid' '--enable-storeio=aufs,coss ,diskd,ufs' '--enable-poll' '--enable-delay-pools' '--enable-linux-tproxy' '--enable-htcp' '--enable-carp' '--with-pthreads' '--enable-underscores' '--enable-external--enable-arp-acl' '--enable-follow-x-forwarded-for' Regards Welisson

5 15

Problem with Tproxy more kernel 2.6.22.9
by Welisson Thiago das Merces Tome 10 Jan '08

10 Jan '08

Hi all I would like help of you. Somebody here compile the version kernel 2.6.22.9, iptables-1.3.8 and squid 2.6STABLE17. Which was patch applied in iptables-1.3.8 iptables-svn.diff or iptables-1.3.8.diff. It would like to also know if the Tproxy is compatible with architecture 64Bits X86_64 in set with technology EM64T of the Intel, or only 32Bits.

2 2

Tproxy on bridge interface
by Ming-Ching Tiew 02 Jan '08

02 Jan '08

Cameron Schaus wrotte :- > > >I think you're not the only one interested in these changes. > > > >Cam, could you post your patch implementing the necessary changes to make > >bridged tproxy work? > > > > > Sure. I'll post them soon. I have to find the code I wrote. I wasn't > able to use tproxy4 due to some other issues I wasn't able to solve, so > I'm not sure where the code went. Any luck on this item ? -------------------------------------------- Important Warning! *************************** This electronic communication (including any attached files) may contain confidential and/or legally privileged information and is only intended for the use of the person to whom it is addressed. If you are not the intended recipient, you do not have permission to read, use, disseminate, distribute, copy or retain any part of this communication or its attachments in any form. If this e-mail was sent to you by mistake, please take the time to notify the sender so that they can identify the problem and avoid any more mistakes in sending e-mail to you. The unauthorised use of information contained in this communication or its attachments may result in legal action against any person who uses it.

3 9