February 2009 - tproxy - lists.balabit.hu

tproxy4 + cacheboy (lusca) .. non gateway
by Alexandre Correa 18 Feb '09

18 Feb '09

Hails !!! tproxy4 works when squid are not gateway of clients ? gateway "DNATing" to proxy server ... -- Sds. Alexandre J. Correa Onda Internet / OPinguim.net http://www.ondainternet.com.br http://www.opinguim.net

2 1

TProxy4 and Squid 3.1.0.5 client address spoofing problem !
by Hamid Hashemi 17 Feb '09

17 Feb '09

Hi, Here is my situation : - CentOS 5.2 ( my own built kernel 2.6.25.11-TProxy-ReiserFS with this patch : http://www.balabit.com/downloads/files/tproxy/tproxy-kernel-2.6.25-20080519… ) - iptables v1.4.3-rc1( ftp://ftp.netfilter.org/pub/iptables/snapshot/iptables-20090206.tar.bz2 ) - squid 3.1.0.5 RC ( http://www.squid-cache.org/Versions/v3/3.1/squid-3.1.0.5.tar.bz2 ) and compiled with these options : "'--enable-poll' '--enable-storeio=aufs,diskd,ufs' '--with-pthreads' '--enable-removal-policies=heap,lru' '--enable- linux-netfilter' '--enable-useragent-log' '--enable-referer-log' '--enable-underscores' '--disable-dependency-tracking' '--disable-ident-lookups' '--with-large-files' '--enable-follow-x-forwarded-for' '--enable-cache-digests' '--enable-delay-pools' '--enable-truncate' '--prefix=/usr' '--localstatedir=/var' '--sysconfdir=/etc/squid' '--with-logdir=/var/log/squid' '--enable-wccpv2' '--enable-wccp' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--libexecdir=/usr/lib/squid' '--with-filedescriptors=8192' --with-squid=/usr/src/squid-3.1.0.5 --enable-ltdl-convenience\" - with following iptables rules : [root@CACHE1 squid-3.1.0.5]# service iptables status Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Table: mangle Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 DIVERT tcp -- 0.0.0.0/0 0.0.0.0/0 socket 2 TPROXY tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain FORWARD (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination Chain DIVERT (1 references) num target prot opt source destination 1 MARK all -- 0.0.0.0/0 0.0.0.0/0 MARK xset 0x1/0xffffffff 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 [root@CACHE1 squid-3.1.0.5]# - With following iproute2 rules : [root@CACHE1 squid-3.1.0.5]# ip ru list 0: from all lookup 255 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default [root@CACHE1 squid-3.1.0.5]# ip ro list table 100 local default dev lo scope host [root@CACHE1 squid-3.1.0.5]# - with following http_port line in squid : http_port 3129 tproxy everything seems to be working and squid run with these messages in cache.log : 2009/02/07 22:22:43| Accepting spoofing HTTP connections at 0.0.0.0:3129, FD 16. my requests seems to be redirected to port 3129 as I expected and the pages are loading propertly. But the problem is that when I go to site http://myipaddress.co.uk/ it gives me the cache ip address instead of my own client ip address. here is the tethereal output for one of my requests : [root@CACHE1 squid-3.1.0.5]# tethereal host 85.247.162.18 -n Running as user "root" and group "root". This could be dangerous. Capturing on eth1 0.000000 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=1969980 TSER=0 WS=2 0.000024 213.171.218.15 -> 85.247.162.18 TCP 80 > 57226 [SYN, ACK] Seq=0 Ack=1 Win=5792 Len=0 MSS=1460 TSV=10639608 TSER=1969980 WS=7 0.002265 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=1 Ack=1 Win=5840 Len=0 TSV=1969981 TSER=10639608 0.004521 85.247.162.18 -> 213.171.218.15 HTTP GET / HTTP/1.1 0.004529 213.171.218.15 -> 85.247.162.18 TCP 80 > 57226 [ACK] Seq=1 Ack=386 Win=6912 Len=0 TSV=10639612 TSER=1969981 0.402945 213.171.218.15 -> 85.247.162.18 HTTP HTTP/1.0 200 OK (text/html) 0.402950 213.171.218.15 -> 85.247.162.18 HTTP Continuation or non-HTTP traffic 0.412859 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=386 Ack=1449 Win=8736 Len=0 TSV=1970084 TSER=10640007 0.412867 213.171.218.15 -> 85.247.162.18 HTTP Continuation or non-HTTP traffic 0.413273 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=386 Ack=1579 Win=8736 Len=0 TSV=1970084 TSER=10640007 0.418901 85.247.162.18 -> 213.171.218.15 TCP 57226 > 80 [ACK] Seq=386 Ack=2213 Win=11632 Len=0 TSV=1970085 TSER=10640017 Where my client ip address is 85.247.162.18 and my cache server ip address is 85.247.162.2. This means that the client ip spoofing is not working with tproxy4. Can any guide me ? -- Regards Hamid Hashemi

2 2

yahoo and hotmail never open
by sonu chouhan 11 Feb '09

11 Feb '09

hi, i am getting one more thing with the related problem, my local server where tproxy setup is 172.16.1.1 and i have run apache on it, normaly when i open 172.16.1.1 in browser it's open el5 default page and webserver works, but when i apply tproxy rules this page never open. and the same time normal website like google, orkut work fine. and if i use normal proxy it's open smoothly. i am using following iptables rules for tproxy. /sbin/ip rule add fwmark 0x1/0x1 lookup 100 /sbin/ip route add local 0.0.0.0/0 dev lo table 100 /iptables/sbin/iptables -t mangle -N DIVERT /iptables/sbin/iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT /iptables/sbin/iptables -t mangle -A DIVERT -j MARK --set-mark 0x1/0x1 /iptables/sbin/iptables -t mangle -A DIVERT -j ACCEPT /iptables/sbin/iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3128 hi all, i am getting a problem with tproxy when i run a normal website it's working fine but when i login in yahoo or hotmail, sedond page never open and it's says following error's message Zero Sized Reply, server is too busy, timeout and when i run with normal tansparent proxy like redirect rule it's work fine, i am giving my setup below. rhel 5 with kernel 2.6.28.2 with patch of julian's routing patch (http://www.ssi.bg/~ja/) iptables-1.4.3rc1 squid-2.6.18 with tproxy patch of tproxy version2 and also check squid-3.1.0.4 with tproxy version4 i am using a server with 4 outgoing connection for internet and 1 internal connection for local network. please help me thanks in advance sonu...

2 1

Transparent proxying - different approach - NAT on demand.
by NTPT 11 Feb '09

11 Feb '09

Hi all. I have some proposition about squid and tproxy. I call it "NAT ON DEMAND". I am not really a good C programmer or kernel hacker, but... AFAIK in early tproxy days a dynamically created SNAT and DNAT rules, was considered but this idea was abandon as unfeasible. My idea is to allow "setting nat on application explicit demand". To create a infrastructure in with userspace application (squid for example) can send a "demand" for source address to witch their outgoing connections should be natted to - on per socket basis.Usage in transparent proxying of all kind. Especially useful for SQUID and realy transparent proxy scenario. The idea is roughly inspired and is analogic to "setting FWMARK from userspace", an old kernel patch that implement ioctl for setting fwmark on local originated packets on per socket basis. See http://oss.sgi.com/archives/netdev/2001-12/msg00053.html 1:applications should be able to explicitly set on per socket basis, on wich IP address they need outgoin connection to be SNATed. Probably add one 32bit item to skbuff and appropriate mechanizm for setting it from userspace 2: change netfilter / iptables to allow "-j SNAT --to-demand" option to witch set a source of the connection to address that application demanded 3: add "-m natdemand" iptables match to find if local originator of this connection demand NAT for it (ie if the additional field in skbuff is not 0x0 ). 4: patch squid to request a nat for its outgoing connections. Only thing that it should to take a client ip address and "demand it" Usage like this in squid conf acl src 192.168.1.0/24 transparent_clients # set ACL for clients network that we need handled transparently nat_on_demand transparent_clients # demand specific SNAT for all outgoing connections (ie connections that fetching content) it made on proxying clients from this network. ie take IP of the squid client and demand SNAT to this IP for outgoing sockets that fetching data for that client on cache miss (sorry my bad english) in iptables: iptables -t nat -I OUTPUT (or POSTROUTING ?) -m natdemand -j SNAT --to-demand # to tell netfilter to SNAT source address of that connection to what application demanded. ie copy address stored in additional skbbuff field >From that point, all the hard work for us is done automatically by netfilter.No need to worry about fancy routing setup etc. No need additional overhead for socket match. Does not interfer with connection tracking as tproxy afaik does. Should work for related (icmp etc) packets as well. Should instantly work for every protocol that have nat helper too. Should be easy to implement and less intrusive (afaik most of tproxy patch is to circumvent some kernel safety measurements and control checks on various places) Or miss I some point ? PS: excuse my wrong english, that limit severally my ability to express this idea.

3 2

question about tproxy on bridgy mode
by Junyong Jiang 06 Feb '09

06 Feb '09

Hi all, I read some one have the expirence on tproxy and squid using in bridgy mode on internet. So I met some problems of this case, I think you can give me some important information. Thanks in advance. When I configure the tproxy and squid in tproxy mode, and run the client requesting. The tproxy target can be called and redirecting the packet, but the request packet is also directly passed to the server. The server gave the reply correctly. But the local host process never client tcp SYN packet. I did not know what's the real problem, I think it is about the routing policy. Could you offer me some help please! Thank you! Alex 2009-02-05

1 0

yahoo and hotmail never open
by sonu chouhan 02 Feb '09

02 Feb '09

hi all, i am getting a problem with tproxy when i run a normal website it's working fine but when i login in yahoo or hotmail, sedond page never open and it's says following error's message Zero Sized Reply, server is too busy, timeout and when i run with normal tansparent proxy like redirect rule it's work fine, i am giving my setup below. rhel 5 with kernel 2.6.28.2 with patch of julian's routing patch (http://www.ssi.bg/~ja/) iptables-1.4.3rc1 squid-2.6.18 with tproxy patch of tproxy version2 and also check squid-3.1.0.4 with tproxy version4 i am using a server with 4 outgoing connection for internet and 1 internal connection for local network. please help me thanks in advance sonu...

1 0