December 2008 - tproxy - lists.balabit.hu

tproxy target implementation problem on kernel-2.6.22
by kudiejlq 18 Dec '08

18 Dec '08

hi, I have being modified linux-kernel-2.6.22 to support the function as tproxy dose to linux-kernel-2.6.24 these week. And now, the socket match can work well, while the TPROXY target meet some problems. kernel's panic info was shown in the slave file picture. iptables rule was as bellow: iptables -t mangle -A PREROUTING -p tcp --dport 1080 -j TPROXY --on-port 2080 As you see, I didn't specify the --tproxy-mark option, that's say the kernel panic info were produced during find the target listenning socket. when recv a remote syn pkt preduced by command telnet 10.24.38.28 1080, tproxy kernel die. Any suggestions to solve this problem, thank you! regards! ----------------------------- kudiejlq

1 0

socket match can't work with DNAT rules
by Dong Wei 17 Dec '08

17 Dec '08

Hi, all I use the latest tproxy kernel.But I find that, tproxy can't work with DNAT mode. network topology: Web Server(192.168.1.10)----(192.168.1.1)TPROXY Server(202.0.0.1)---(202.0.0.10)Client For TPROXY Server eth0 192.168.1.1 eth1 202.0.0.1 When Client visit TPROXY Server(202.0.0.1) 80 port, we will redirect it to Web Server. There is a DNAT rule for it. iptables -t nat -i eth1 -d 202.0.0.1 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10 tproxy APP listen on port 50080, and the TPROXY target also set --on-port 50080 for HTTP. Here is the problem: 1. Client send SYN to 202.0.0.1:80 2. TPROXY Server receive it, and TPROXY target will redirect this packet to the socket which is listening on port 50080 3. TPROXY Server send SYN,ACK to the Client 4. Client receive SYN,ACK and send ACK 5. TPROXY Server receive ACK, TPROXY target will redirect this packet to the socket listening on port 50080 6. With DNAT rule, the established socket is 202.0.0.10:port -> 192.168.1.10:80 7. Client send "GET " request to TPROXY Server 8. socket match find this packet doesn't match any socket. For its sip, sport, dip,dport is 202.0.0.10:port -> 202.0.0.1:80, while the established socket is 202.0.0.10:port -> 192.168.1.10:80 So in this case, match can't work correctly for DNAT rules. Anyone has good ideas? Thanks in advance! -- Thanks BR. Wei Dong

3 5

about coding details of tproxy
by kudiejlq 15 Dec '08

15 Dec '08

hello, all: I have been reseach on tproxy(for kernel-2.6.24) these days. And I found that Tproxy sets skb->mark and skb->sk first (both the TPROXY target and socket match do the same), then hand packets to non-local sockets rely on policy routing. Today I saw that Tproxy has modified ip_route_me_harder, it inserted lines of code to ip_route_me_harder like following: so, what does ip_route_me_harder used for, why Tproxy modified those codes. thanks very much! /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) { const struct iphdr *iph = ip_hdr(skb); struct rtable *rt; struct flowi fl = {}; struct dst_entry *odst; unsigned int hh_len; unsigned int type; type = inet_addr_type(iph->saddr); if (skb->sk && inet_sk(skb->sk)->transparent) //TPROXY ADDED type = RTN_LOCAL; if (addr_type == RTN_UNSPEC) addr_type = type; /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook. */ if (addr_type == RTN_LOCAL) { fl.nl_u.ip4_u.daddr = iph->daddr; if (type == RTN_LOCAL) fl.nl_u.ip4_u.saddr = iph->saddr; fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; fl.mark = skb->mark; fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; //TPROXY ADDED if (ip_route_output_key(&rt, &fl) != 0) return -1; /* Drop old route. */ dst_release(skb->dst); skb->dst = &rt->u.dst; } else { /* non-local src, find valid iif to satisfy * rp-filter when calling ip_route_input. */ fl.nl_u.ip4_u.daddr = iph->saddr; if (ip_route_output_key(&rt, &fl) != 0) return -1; odst = skb->dst; if (ip_route_input(skb, iph->daddr, iph->saddr, RT_TOS(iph->tos), rt->u.dst.dev) != 0) { dst_release(&rt->u.dst); return -1; } dst_release(&rt->u.dst); dst_release(odst); } if (skb->dst->error) return -1; #ifdef CONFIG_XFRM if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && xfrm_decode_session(skb, &fl, AF_INET) == 0) if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0)) return -1; #endif /* Change in oif may mean change in hh_len. */ hh_len = skb->dst->dev->hard_header_len; if (skb_headroom(skb) < hh_len && pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC)) return -1; return 0; } regards.

1 0

Re: [tproxy] [RFC][PATCH] [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple
by Balazs Scheidler 10 Dec '08

10 Dec '08

On Wed, 2008-12-10 at 00:57 -0800, David Miller wrote: > From: Balazs Scheidler <bazsi(a)balabit.hu> > Date: Wed, 10 Dec 2008 09:52:22 +0100 > > > I understand. Here are the alternatives I considered: > > 1) the patch above, by extending the socket structures > > 2) expand skb, of course I felt this is worse than the patch I posted > > 3) call inet_twsk_deschedule() from the prerouting hook > > > > The 3rd one does not require any expansion of the related structures, > > however it'd mean that the TCP state is not only looked up, but also > > changed from the TPROXY target. I felt this ugly, but the ugliness would > > be constrained to the tproxy code. Shall I post a patch implementing > > option #3 above? > > It would be interesting to see what it looks like, so if you > don't mind then yes please toss that together so we can have > a look. > Updated patch below. The SYN validation could still be improved to match the one in tcp_timewait_state_process(), the current one is very simplistic, but the approach is already visible. [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple Without tproxy redirections an incoming SYN kicks out conflicting TIME_WAIT sockets, in order to handle clients that reuse ports within the TIME_WAIT period. The same mechanism didn't work in case TProxy is involved in finding the proper socket, as the time_wait processing code looked up the listening socket assuming that the listener addr/port matches those of the established connection. This is not the case with TProxy as the listener addr/port is possibly changed with the tproxy rule. An earlier version of this patch used expanded inet_sock and inet_timewait_sock structs in order to store the original listener address. This time, the TIME_WAIT socket is removed from the hashes right in the TPROXY target so by the time the packet reaches the TCP stack, the TIME_WAIT socket will not be there. This patch is currently only a draft, I'm still thinking about changing the prototype of nf_tproxy_get_sock_v4(), so please do NOT apply. --- include/net/inet_timewait_sock.h | 2 +- include/net/netfilter/nf_tproxy_core.h | 6 +++++- net/netfilter/nf_tproxy_core.c | 29 +++++++++++++++++++++-------- net/netfilter/xt_TPROXY.c | 29 ++++++++++++++++++++++++----- net/netfilter/xt_socket.c | 2 +- 5 files changed, 52 insertions(+), 16 deletions(-) diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h index 4b8ece2..2f579f4 100644 --- a/include/net/inet_timewait_sock.h +++ b/include/net/inet_timewait_sock.h @@ -130,7 +130,7 @@ struct inet_timewait_sock { /* And these are ours. */ __u8 tw_ipv6only:1, tw_transparent:1; - /* 15 bits hole, try to pack */ + /* 14 bits hole, try to pack */ __u16 tw_ipv6_offset; unsigned long tw_ttd; struct inet_bind_bucket *tw_tb; diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h index 208b46f..b3a8942 100644 --- a/include/net/netfilter/nf_tproxy_core.h +++ b/include/net/netfilter/nf_tproxy_core.h @@ -8,12 +8,16 @@ #include <net/inet_sock.h> #include <net/tcp.h> +#define NFT_LOOKUP_ANY 0 +#define NFT_LOOKUP_LISTENER 1 +#define NFT_LOOKUP_ESTABLISHED 2 + /* look up and get a reference to a matching socket */ extern struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening); + const struct net_device *in, int lookup_type); static inline void nf_tproxy_put_sock(struct sock *sk) diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c index cdc97f3..1858da0 100644 --- a/net/netfilter/nf_tproxy_core.c +++ b/net/netfilter/nf_tproxy_core.c @@ -22,21 +22,34 @@ struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening_only) + const struct net_device *in, int lookup_type) { struct sock *sk; /* look up socket */ switch (protocol) { case IPPROTO_TCP: - if (listening_only) - sk = __inet_lookup_listener(net, &tcp_hashinfo, - daddr, ntohs(dport), - in->ifindex); - else + switch (lookup_type) { + case NFT_LOOKUP_ANY: sk = __inet_lookup(net, &tcp_hashinfo, saddr, sport, daddr, dport, in->ifindex); + break; + case NFT_LOOKUP_LISTENER: + sk = inet_lookup_listener(net, &tcp_hashinfo, + daddr, dport, + in->ifindex); + break; + case NFT_LOOKUP_ESTABLISHED: + sk = inet_lookup_established(net, &tcp_hashinfo, + saddr, sport, daddr, dport, + in->ifindex); + break; + default: + WARN_ON(1); + sk = NULL; + break; + } break; case IPPROTO_UDP: sk = udp4_lib_lookup(net, saddr, sport, daddr, dport, @@ -47,8 +60,8 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, sk = NULL; } - pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, listener only: %d, sock %p\n", - protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), listening_only, sk); + pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n", + protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk); return sk; } diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 1340c2f..92a911e 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -29,7 +29,7 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par) { const struct iphdr *iph = ip_hdr(skb); const struct xt_tproxy_target_info *tgi = par->targinfo; - struct udphdr _hdr, *hp; + struct tcphdr _hdr, *hp; struct sock *sk; hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); @@ -37,10 +37,29 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par) return NF_DROP; sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, - iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, - hp->source, tgi->lport ? tgi->lport : hp->dest, - par->in, true); - + iph->saddr, iph->daddr, + hp->source, hp->dest, + par->in, NFT_LOOKUP_ESTABLISHED); + + if (sk->sk_state == TCP_TIME_WAIT && hp->syn && !hp->rst && !hp->ack && !hp->fin) { + struct sock *sk2; + + sk2 = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, + iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, + hp->source, tgi->lport ? tgi->lport : hp->dest, + par->in, NFT_LOOKUP_LISTENER); + if (sk2) { + inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); + inet_twsk_put(inet_twsk(sk)); + sk = sk2; + } + } + else if (!sk) { + sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, + iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, + hp->source, tgi->lport ? tgi->lport : hp->dest, + par->in, NFT_LOOKUP_LISTENER); + } /* NOTE: assign_sock consumes our sk reference */ if (sk && nf_tproxy_assign_sock(skb, sk)) { /* This should be in a separate target, but we don't do multiple diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 1d521a5..ae8233d 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -142,7 +142,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par) #endif sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, - saddr, daddr, sport, dport, par->in, false); + saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); if (sk != NULL) { bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0); -- Bazsi

1 0

Re: [tproxy] [RFC][PATCH] [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple
by Balazs Scheidler 10 Dec '08

10 Dec '08

On Tue, 2008-12-09 at 22:18 -0800, David Miller wrote: > From: Balazs Scheidler <bazsi(a)balabit.hu> > Date: Tue, 09 Dec 2008 08:51:35 +0000 > > > Hi, > > > > I'd like to get some guidance regarding the following patch. There's a > > severe performance limitation related to TIME_WAIT sockets and TProxy rules. > > The patch below is the 'nice' approach, but it adds 6 bytes to > > inet_sock and inet_timewait_sock. The 'ugly' approach would be to schedule the > > removal of the affected TIME_WAIT sockets at PREROUTING time. > > > > This post is meant to get some review, but please do not apply this patch this time. > > I have no general objection to this, but people seem to be > experts at making various parts of the TCP socket structures > larger and larger :-( > I understand. Here are the alternatives I considered: 1) the patch above, by extending the socket structures 2) expand skb, of course I felt this is worse than the patch I posted 3) call inet_twsk_deschedule() from the prerouting hook The 3rd one does not require any expansion of the related structures, however it'd mean that the TCP state is not only looked up, but also changed from the TPROXY target. I felt this ugly, but the ugliness would be constrained to the tproxy code. Shall I post a patch implementing option #3 above? -- Bazsi

1 0

[RFC][PATCH] [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple
by Balazs Scheidler 09 Dec '08

09 Dec '08

Hi, I'd like to get some guidance regarding the following patch. There's a severe performance limitation related to TIME_WAIT sockets and TProxy rules. The patch below is the 'nice' approach, but it adds 6 bytes to inet_sock and inet_timewait_sock. The 'ugly' approach would be to schedule the removal of the affected TIME_WAIT sockets at PREROUTING time. This post is meant to get some review, but please do not apply this patch this time. Thanks in advance. Without tproxy redirections an incoming SYN kicks out conflicting TIME_WAIT sockets, in order to handle clients that reuse ports within the TIME_WAIT period. The same mechanism didn't work in case TProxy is involved in finding the proper socket, as the time_wait processing code looks up the listening socket assuming that the listener addr/port matches those of the established connection. This is not the case with TProxy as the listener addr/port is possibly changed with the tproxy rule. This patch extends struct inet_timewait_sock and inet_sock with 6 bytes causing a 112->118 bytes increase in case of inet_timewait_sock, and 680->686 bytes in the case of struct inet_sock on 64 bit platforms. Neither of these cause another cacheline to be used. This patch is currently only a draft, I'm still thinking about changing the prototype of nf_tproxy_get_sock_v4(), so please do NOT apply. --- include/net/inet_sock.h | 3 +++ include/net/inet_timewait_sock.h | 5 ++++- include/net/netfilter/nf_tproxy_core.h | 6 +++++- net/ipv4/inet_connection_sock.c | 2 ++ net/ipv4/inet_timewait_sock.c | 2 ++ net/ipv4/tcp_ipv4.c | 2 +- net/netfilter/nf_tproxy_core.c | 29 +++++++++++++++++++++-------- net/netfilter/xt_TPROXY.c | 13 +++++++++---- net/netfilter/xt_socket.c | 2 +- 9 files changed, 48 insertions(+), 16 deletions(-) diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h index de0ecc7..33434b1 100644 --- a/include/net/inet_sock.h +++ b/include/net/inet_sock.h @@ -143,6 +143,9 @@ struct inet_sock { __be32 addr; struct flowi fl; } cork; + /* listener addr/port, can be different than saddr/sport in case tproxy redirection occurred */ + __be32 laddr; + __be16 lport; }; #define IPCORK_OPT 1 /* ip-options has been held in ipcork.opt */ diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h index 4b8ece2..4de70a2 100644 --- a/include/net/inet_timewait_sock.h +++ b/include/net/inet_timewait_sock.h @@ -130,11 +130,14 @@ struct inet_timewait_sock { /* And these are ours. */ __u8 tw_ipv6only:1, tw_transparent:1; - /* 15 bits hole, try to pack */ + /* 14 bits hole, try to pack */ __u16 tw_ipv6_offset; unsigned long tw_ttd; struct inet_bind_bucket *tw_tb; struct hlist_node tw_death_node; + /* listener addr/port, can be different from tw_saddr/tw_sport in case tproxy redirection occurred */ + __be32 tw_laddr; + __be16 tw_lport; }; static inline void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h index 208b46f..b3a8942 100644 --- a/include/net/netfilter/nf_tproxy_core.h +++ b/include/net/netfilter/nf_tproxy_core.h @@ -8,12 +8,16 @@ #include <net/inet_sock.h> #include <net/tcp.h> +#define NFT_LOOKUP_ANY 0 +#define NFT_LOOKUP_LISTENER 1 +#define NFT_LOOKUP_ESTABLISHED 2 + /* look up and get a reference to a matching socket */ extern struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening); + const struct net_device *in, int lookup_type); static inline void nf_tproxy_put_sock(struct sock *sk) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index fe32255..adbc509 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -520,6 +520,8 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req, inet_sk(newsk)->dport = inet_rsk(req)->rmt_port; inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port); inet_sk(newsk)->sport = inet_rsk(req)->loc_port; + inet_sk(newsk)->laddr = inet_sk(sk)->saddr; + inet_sk(newsk)->lport = inet_sk(sk)->sport; newsk->sk_write_space = sk_stream_write_space; newicsk->icsk_retransmits = 0; diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index 8554d0e..0e0e844 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -126,6 +126,8 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat tw->tw_substate = state; tw->tw_sport = inet->sport; tw->tw_dport = inet->dport; + tw->tw_laddr = inet->laddr; + tw->tw_lport = inet->lport; tw->tw_family = sk->sk_family; tw->tw_reuse = sk->sk_reuse; tw->tw_hash = sk->sk_hash; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 26b9030..d858ec7 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1645,7 +1645,7 @@ do_time_wait: case TCP_TW_SYN: { struct sock *sk2 = inet_lookup_listener(dev_net(skb->dev), &tcp_hashinfo, - iph->daddr, th->dest, + inet_twsk(sk)->tw_laddr, inet_twsk(sk)->tw_lport, inet_iif(skb)); if (sk2) { inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c index cdc97f3..1858da0 100644 --- a/net/netfilter/nf_tproxy_core.c +++ b/net/netfilter/nf_tproxy_core.c @@ -22,21 +22,34 @@ struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening_only) + const struct net_device *in, int lookup_type) { struct sock *sk; /* look up socket */ switch (protocol) { case IPPROTO_TCP: - if (listening_only) - sk = __inet_lookup_listener(net, &tcp_hashinfo, - daddr, ntohs(dport), - in->ifindex); - else + switch (lookup_type) { + case NFT_LOOKUP_ANY: sk = __inet_lookup(net, &tcp_hashinfo, saddr, sport, daddr, dport, in->ifindex); + break; + case NFT_LOOKUP_LISTENER: + sk = inet_lookup_listener(net, &tcp_hashinfo, + daddr, dport, + in->ifindex); + break; + case NFT_LOOKUP_ESTABLISHED: + sk = inet_lookup_established(net, &tcp_hashinfo, + saddr, sport, daddr, dport, + in->ifindex); + break; + default: + WARN_ON(1); + sk = NULL; + break; + } break; case IPPROTO_UDP: sk = udp4_lib_lookup(net, saddr, sport, daddr, dport, @@ -47,8 +60,8 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, sk = NULL; } - pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, listener only: %d, sock %p\n", - protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), listening_only, sk); + pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n", + protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk); return sk; } diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 1340c2f..5d66613 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -37,10 +37,15 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par) return NF_DROP; sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, - iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, - hp->source, tgi->lport ? tgi->lport : hp->dest, - par->in, true); - + iph->saddr, iph->daddr, + hp->source, hp->dest, + par->in, NFT_LOOKUP_ESTABLISHED); + if (!sk) { + sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, + iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, + hp->source, tgi->lport ? tgi->lport : hp->dest, + par->in, NFT_LOOKUP_LISTENER); + } /* NOTE: assign_sock consumes our sk reference */ if (sk && nf_tproxy_assign_sock(skb, sk)) { /* This should be in a separate target, but we don't do multiple diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 1d521a5..ae8233d 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -142,7 +142,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par) #endif sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, - saddr, daddr, sport, dport, par->in, false); + saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); if (sk != NULL) { bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0); -- 1.5.6.3

1 0

Squid doesn't seem to spoof client ip address.
by Przemysław Kudyba 04 Dec '08

04 Dec '08

Hello. I have set up fully transpatent http proxy, my problem is: squid sends requests with ip:port of te box running squid instead of clients ip. Here's my config: kernel patch: tproxy4-2.6.26-200809262032 iptables patch: tproxy-iptables-1.4.0-20080521-113954-1211362794 squid: squid-3.HEAD-20081127 iptables & iproute rules: > > iptables -t mangle -N DIVERT > iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT > > > iptables -t mangle -A DIVERT -j MARK --set-mark 1 > iptables -t mangle -A DIVERT -j ACCEPT > > iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j TPROXY > --on-port 3128 --tproxy-mark 0x1/0x1 > > ip rule add fwmark 1 lookup 100 > ip route add local 0.0.0.0/0 dev lo table 100 > squid conf: > http_port 192.168.250.2:3128 tproxy 217.97.174.18 - my laptop 212.77.100.101 - some www page tcpdump : 19:06:01.736342 IP 217.97.174.18.53401 > 192.168.250.2.80: S 2658655945:2658655945(0) win 5840 <mss 1440,sackOK,timestamp 6961615 0,nop,wscale 5> 19:06:01.736597 IP 192.168.250.2.80 > 217.97.174.18.53401: S 2655745023:2655745023(0) ack 2658655946 win 5792 <mss 1460,sackOK,timestamp 2617146 6961615,nop,wscale 7> 19:06:01.745935 IP 217.97.174.18.53401 > 192.168.250.2.80: . ack 1 win 183 <nop,nop,timestamp 6961619 2617146> 19:06:15.648614 IP 217.97.174.18.53401 > 192.168.250.2.80: P 1:29(28) ack 1 win 183 <nop,nop,timestamp 6975524 2617146> 19:06:15.648681 IP 192.168.250.2.80 > 217.97.174.18.53401: . ack 29 win 46 <nop,nop,timestamp 2620624 6975524> 19:06:17.130355 IP 217.97.174.18.53401 > 192.168.250.2.80: P 29:31(2) ack 1 win 183 <nop,nop,timestamp 6977004 2620624> 19:06:17.130447 IP 192.168.250.2.80 > 217.97.174.18.53401: . ack 31 win 46 <nop,nop,timestamp 2620994 6977004> 19:06:17.131289 IP 192.168.250.2.59447 > 212.77.100.101.80: S 2887325147:2887325147(0) win 5840 <mss 1460,sackOK,timestamp 2620994 0,nop,wscale 7> 19:06:17.353255 IP 217.97.174.18.34317 > 192.168.250.2.80: S 2917413960:2917413960(0) win 5840 <mss 1440,sackOK,timestamp 6977231 0,nop,wscale 5> 19:06:17.353338 IP 192.168.250.2.80 > 217.97.174.18.34317: S 2895521199:2895521199(0) ack 2917413961 win 5792 <mss 1460,sackOK,timestamp 2621050 6977231,nop,wscale 7> 19:06:17.357848 IP 217.97.174.18.34317 > 192.168.250.2.80: . ack 1 win 183 <nop,nop,timestamp 6977235 2621050> 19:06:17.358077 IP 217.97.174.18.34317 > 192.168.250.2.80: P 1:360(359) ack 1 win 183 <nop,nop,timestamp 6977235 2621050> 19:06:17.358133 IP 192.168.250.2.80 > 217.97.174.18.34317: . ack 360 win 54 <nop,nop,timestamp 2621051 6977235> 19:06:17.358230 IP 192.168.250.2.39336 > 217.97.173.21.80: S 2890323424:2890323424(0) win 5840 <mss 1460,sackOK,timestamp 2621051 0,nop,wscale 7> 19:06:17.358467 IP 217.97.173.21.80 > 192.168.250.2.39336: S 3189038941:3189038941(0) ack 2890323425 win 5792 <mss 1460,sackOK,timestamp 117140974 2621051,nop,wscale 7> 19:06:17.358530 IP 192.168.250.2.39336 > 217.97.173.21.80: . ack 1 win 46 <nop,nop,timestamp 2621051 117140974> 19:06:17.358671 IP 192.168.250.2.39336 > 217.97.173.21.80: P 1:462(461) ack 1 win 46 <nop,nop,timestamp 2621051 117140974> 19:06:17.358958 IP 217.97.173.21.80 > 192.168.250.2.39336: . ack 462 win 54 <nop,nop,timestamp 117140975 2621051> 19:06:17.427512 IP 217.97.173.21.80 > 192.168.250.2.39336: . 1:1449(1448) ack 462 win 54 <nop,nop,timestamp 117140992 2621051>

2 2

Latest tproxy patch for kernel, iptables and squid
by Eduardo Schoedler 04 Dec '08

04 Dec '08

Hi list. I'm installing a box with linux with squid and I'm a little bit confuse. First of all, sorry my bad english... I'm brazilian. =) I need to now where I can found the latest version for: - kernel 2.6.27 (or can I use kernel 2.8.x ?); - iptables 1.4.2; - squid. I have some questions: - Which kernel is better to use in a production box? 2.6.27 or 2.6.28 ? - Which squid is better to use in a production box? 2.7 or 3.0 ? - Where I can found a documentation to install and configure tproxy patches ? Thanks in advance! Regards, Eduardo Schoedler.

3 5