January 2009 - tproxy - lists.balabit.hu

Transparent proxying - different approach - NAT on demand.
by NTPT 11 Feb '09

11 Feb '09

Hi all. I have some proposition about squid and tproxy. I call it "NAT ON DEMAND". I am not really a good C programmer or kernel hacker, but... AFAIK in early tproxy days a dynamically created SNAT and DNAT rules, was considered but this idea was abandon as unfeasible. My idea is to allow "setting nat on application explicit demand". To create a infrastructure in with userspace application (squid for example) can send a "demand" for source address to witch their outgoing connections should be natted to - on per socket basis.Usage in transparent proxying of all kind. Especially useful for SQUID and realy transparent proxy scenario. The idea is roughly inspired and is analogic to "setting FWMARK from userspace", an old kernel patch that implement ioctl for setting fwmark on local originated packets on per socket basis. See http://oss.sgi.com/archives/netdev/2001-12/msg00053.html 1:applications should be able to explicitly set on per socket basis, on wich IP address they need outgoin connection to be SNATed. Probably add one 32bit item to skbuff and appropriate mechanizm for setting it from userspace 2: change netfilter / iptables to allow "-j SNAT --to-demand" option to witch set a source of the connection to address that application demanded 3: add "-m natdemand" iptables match to find if local originator of this connection demand NAT for it (ie if the additional field in skbuff is not 0x0 ). 4: patch squid to request a nat for its outgoing connections. Only thing that it should to take a client ip address and "demand it" Usage like this in squid conf acl src 192.168.1.0/24 transparent_clients # set ACL for clients network that we need handled transparently nat_on_demand transparent_clients # demand specific SNAT for all outgoing connections (ie connections that fetching content) it made on proxying clients from this network. ie take IP of the squid client and demand SNAT to this IP for outgoing sockets that fetching data for that client on cache miss (sorry my bad english) in iptables: iptables -t nat -I OUTPUT (or POSTROUTING ?) -m natdemand -j SNAT --to-demand # to tell netfilter to SNAT source address of that connection to what application demanded. ie copy address stored in additional skbbuff field >From that point, all the hard work for us is done automatically by netfilter.No need to worry about fancy routing setup etc. No need additional overhead for socket match. Does not interfer with connection tracking as tproxy afaik does. Should work for related (icmp etc) packets as well. Should instantly work for every protocol that have nat helper too. Should be easy to implement and less intrusive (afaik most of tproxy patch is to circumvent some kernel safety measurements and control checks on various places) Or miss I some point ? PS: excuse my wrong english, that limit severally my ability to express this idea.

3 2

ip_tproxy.h problem
by sonu chouhan 29 Jan '09

29 Jan '09

hi all, i am getting a problem! my setup is - Redhat el5 kernel 2.6.28.2 with support of tproxy iptables v1.4.3-rc1 with support of tproxy squid 3.0STABLE12 with support of tproxy squid config : ./configure --prefix=/squid/3.0.12 --enable-linux-netfilter --enable-linux-tproxy kernel and iptables are compile and work fine, but when i am going to compile squid it's show transparent proxy support enable automaticly but after some line it show ip_tproxy.h no. after compile when i put line "http_port 3128 tproxy" in squid.conf it again show error. i install all header from kernel source but error is same and when i search for file ip_tproxy.h there is no file in my system. i have try many thing change kernel, iptables but no succcess, then i compile squid-2.6STABLE18 with patch "tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch" and it's working fine and no error. so please help me in compiling squid 3.0. Thanks in advance sonu...

3 2

patch for iptables 1.4.1.1
by sonu chouhan 26 Jan '09

26 Jan '09

hi all, i am new for tproxy, i have compile kernel 2.6.28 with tproxy support and i have squid 2.7.5 and both have already support tproxy. my question is where can i get patch for iptables-1.4.1.1 bcoz iptables not support tproxy yet, and there is no patch on official download site (i.e. http://www.balabit.com/downloads/files/tproxy/) for iptables-1.4.1.1, please guide me thanks in advance sonu..

2 1

Re: [tproxy] TPROXY-4 and ip contract
by elyasaf 20 Jan '09

20 Jan '09

Not "ip contract" but "ip conntrack" ("connection tracking support"). _____ From: tproxy-request(a)lists.balabit.hu Sent: Tuesday, January 20, 2009 11:06 AM To: 'tproxy(a)lists.balabit.hu' Subject: TPROXY-4 and ip contract Why do i need "ip contract" for using getsockopt with the option SO_ORIGINAL_DST?

2 1

IP_TRANSPARENT - cause to very slow connect
by elyasaf 20 Jan '09

20 Jan '09

When i'm not using "IP_TRANSPARENT", the connect takes something near 4 miliseconds. With the "IP_TRANSPARENT", the first run of the client is fast, but the second and more takes more than 2 seconds (sometimes even 10)! What takes for the "connect" so much time?

2 1

TPROXY-4 and ip contract
by elyasaf 20 Jan '09

20 Jan '09

Why do i need "ip contract" for using getsockopt with the option SO_ORIGINAL_DST?

1 0

TPROXY4 and Squid-2/Cacheboy support
by Adrian Chadd 16 Jan '09

16 Jan '09

G'day, I've coded up some basic TPROXY4 support for my Squid-2 derivative, Cacheboy. The HEAD version of Cacheboy should support both TPROXY2, TPROXY4 and the FreeBSD-current tproxy-like functionality. The TPROXY4 support will make it back into Squid-2 at some point. I unfortunately don't have any local setup here to properly test the TPROXY2 or TPROXY4 support; would someone on this list be able to give me a hand in verifying that the code does as advertised? (The TPROXY2 code is based on the TPROXY2 support from Squid-2.HEAD, but I've tried modularising it somewhat so it can be easily replaced by other transproxy implementations, such as the FreeBSD and OpenBSD variants. This is why I'd also like some help testing the legacy code. :) Thanks! Adrian

2 2