March 2009 - tproxy - lists.balabit.hu

IPv6 support
by Harry Mason 26 Mar '09

26 Mar '09

I'm interested in using TPROXY with IPv6, for transparent HTTP proxying and TRT. Before I start hacking: Is anyone already working on v6 support? Is there any fundamental reason why it isn't possible? Should I branch from Linus's tree, or is there more up to date TPROXY code I should use? Thanks Harry -- Harry Mason SmoothWall Ltd. - http://www.smoothwall.net/ SmoothWall Limited 1 John Charles Way Leeds LS12 6QA United Kingdom Phone: 1 800 959 3760 (USA, Canada and North America) 0870 1 999 500 (United Kingdom) +44 870 1 999 500 (all other countries) Fax: +44 870 1 991 399 SmoothWall Limited is registered in England, Company Number: 4298247 This email and any attachments transmitted with it are confidential to the intended recipient(s) and may not be communicated to any other person or published by any means without the permission of SmoothWall Limited. Any opinions stated in this message are solely those of the author. See: http://smoothwall.net/company/email.php for the full text of this notice.

2 1

squid TPROXY empty access.log
by Jack Daniels 24 Mar '09

24 Mar '09

Hello, I've a problem to log client request activities when Squid is in TPROXY mode. In squid.conf I have 'access_log /var/log/squid/access.log squid', this file is correctly created but results empty. # ls -la /var/log/squid/ -rw-r----- 1 proxy proxy 0 24 mar 16:09 access.log -rw-r----- 1 proxy proxy 413659 24 mar 16:09 cache.log -rw-r----- 1 proxy proxy 0 24 mar 16:09 referer.log -rw-r--r-- 1 root proxy 6 24 mar 16:09 squid.pid -rw-r----- 1 proxy proxy 0 24 mar 16:09 store.log If I remove 'tproxy' option from http_port in squid.conf it seems work but I lose the TPROXY Ip spoofing feature. Is this a bug? There is a way to log client request activities in tproxy mode? I need this feature to use Sarg in this environment. Thanks in advance. Here some details: # uname -r 2.6.28.8 # squid -v Squid Cache: Version 3.1.0.6 configure options: '--enable-linux-tproxy' '--enable-linux-netfilter' '--enable-ssl' '--with-openssl=/usr/include/openssl/' '--enable-err-languages=EnglisItalian' '--enable-default-err-language=Italian' '--disable-htcp' '--with-large-files' '--prefix=/usr' '--exec_prefix=/usr' '--bindir=/usr/sbin' '--sbindir=/usr/sbin' '--libdir=/usr/lib/squid' '--libexecdir=/usr/lib/squid' '--docdir=/usr/share/doc/squid' '--datarootdir=/usr/share/squid' '--datadir=/usr/share/squid' '--sysconfdir=/etc/squid' '--localstatedir=/var/spool/squid' '--mandir=/usr/share/man' '--with-logdir=/var/log/squid' '--enable-inline' '--enable-async-io=8' '--with-pthreads' '--enable-storeio=ufs,aufs,diskd' '--enable-removal-policies=lru,heap' '--enable-snmp' '--enable-delay-pools' '--enable-cache-digests' '--enable-underscores' '--enable-icap-client' '--enable-referer-log' '--enable-useragent-log' '--enable-follow-x-forwarded-for' '--enable-auth=basic,digest,ntlm' '--enable-basic-auth-helpers=NCSA' '--enable-digest-auth-helpers=password' '--enable-external-acl-helpers=ip_user,unix_group' '--with-filedescriptors=65536' '--with-default-user=proxy' --with-squid=/usr/src/squid-3.1.0.6 --enable-ltdl-convenience # iptables -V iptables v1.4.3-rc1 # iptables -t mangle -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3128 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff ACCEPT all -- anywhere anywhere # cat /etc/squid/squid.conf acl manager proto cache_object acl localhost src 127.0.0.1/32 acl to_localhost dst 127.0.0.0/8 acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access allow manager localhost http_access deny manager http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access allow localnet http_access deny all http_port 3128 tproxy #http_port 3128 transparent hierarchy_stoplist cgi-bin ? refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 coredump_dir /var/spool/squid/cache cache_effective_user proxy cache_effective_group proxy access_log /var/log/squid/access.log squid cache_store_log /var/log/squid/store.log referer_log /var/log/squid/referer.log log_access allow all cache allow all # squid -X -d1 -N 2009/03/24 16:04:06.955| command-line -X overrides: ALL,7 2009/03/24 16:04:06.955| CacheManager::registerAction: registering legacy mem 2009/03/24 16:04:06.955| CacheManager::findAction: looking for action mem 2009/03/24 16:04:06.955| Action not found. 2009/03/24 16:04:06.955| CacheManager::registerAction: registered mem 2009/03/24 16:04:06.955| CacheManager::registerAction: registering legacy squidaio_counts 2009/03/24 16:04:06.955| CacheManager::findAction: looking for action squidaio_counts 2009/03/24 16:04:06.955| Action not found. 2009/03/24 16:04:06.955| CacheManager::registerAction: registered squidaio_counts 2009/03/24 16:04:06.955| CacheManager::registerAction: registering legacy diskd 2009/03/24 16:04:06.955| CacheManager::findAction: looking for action diskd 2009/03/24 16:04:06.955| Action not found. 2009/03/24 16:04:06.955| CacheManager::registerAction: registered diskd 2009/03/24 16:04:06.955| aclDestroyACLs: invoked 2009/03/24 16:04:06.955| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.955| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.955| ACL::FindByName 'all' 2009/03/24 16:04:06.955| ACL::FindByName found no match 2009/03/24 16:04:06.955| aclParseAclLine: Creating ACL 'all' 2009/03/24 16:04:06.955| ACL::Prototype::Factory: cloning an object for type 'src' 2009/03/24 16:04:06.955| aclIpParseIpData: all 2009/03/24 16:04:06.955| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.955| ACL::FindByName 'all' 2009/03/24 16:04:06.955| Processing Configuration File: /etc/squid/squid.conf (depth 0) 2009/03/24 16:04:06.957| Processing: 'acl manager proto cache_object' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type proto 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.957| ACL::FindByName 'manager' 2009/03/24 16:04:06.957| ACL::FindByName found no match 2009/03/24 16:04:06.957| aclParseAclLine: Creating ACL 'manager' 2009/03/24 16:04:06.957| ACL::Prototype::Factory: cloning an object for type 'proto' 2009/03/24 16:04:06.957| Processing: 'acl localhost src 127.0.0.1/32' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.957| ACL::FindByName 'localhost' 2009/03/24 16:04:06.957| ACL::FindByName found no match 2009/03/24 16:04:06.957| aclParseAclLine: Creating ACL 'localhost' 2009/03/24 16:04:06.957| ACL::Prototype::Factory: cloning an object for type 'src' 2009/03/24 16:04:06.957| aclIpParseIpData: 127.0.0.1/32 2009/03/24 16:04:06.957| Processing: 'acl to_localhost dst 127.0.0.0/8' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type dst 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.957| ACL::FindByName 'to_localhost' 2009/03/24 16:04:06.957| ACL::FindByName found no match 2009/03/24 16:04:06.957| aclParseAclLine: Creating ACL 'to_localhost' 2009/03/24 16:04:06.957| ACL::Prototype::Factory: cloning an object for type 'dst' 2009/03/24 16:04:06.957| aclIpParseIpData: 127.0.0.0/8 2009/03/24 16:04:06.957| Processing: 'acl localnet src 10.0.0.0/8 # RFC1918 possible internal network' 2009/03/24 16:04:06.957| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.957| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'localnet' 2009/03/24 16:04:06.958| ACL::FindByName found no match 2009/03/24 16:04:06.958| aclParseAclLine: Creating ACL 'localnet' 2009/03/24 16:04:06.958| ACL::Prototype::Factory: cloning an object for type 'src' 2009/03/24 16:04:06.958| aclIpParseIpData: 10.0.0.0/8 2009/03/24 16:04:06.958| Processing: 'acl localnet src 172.16.0.0/12 # RFC1918 possible internal network' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'localnet' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'localnet' 2009/03/24 16:04:06.958| aclIpParseIpData: 172.16.0.0/12 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 10.0.0.0/255.240.0.0 (10.0.0.0) vs 172.16.0.0-0.0.0.0/255.240.0.0 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 172.16.0.0/255.0.0.0 (172.0.0.0) vs 10.0.0.0-0.0.0.0/255.0.0.0 2009/03/24 16:04:06.958| Processing: 'acl localnet src 192.168.0.0/16 # RFC1918 possible internal network' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type src 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'localnet' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'localnet' 2009/03/24 16:04:06.958| aclIpParseIpData: 192.168.0.0/16 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 172.16.0.0/255.255.0.0 (172.16.0.0) vs 192.168.0.0-0.0.0.0/255.255.0.0 2009/03/24 16:04:06.958| aclIpAddrNetworkCompare: compare: 192.168.0.0/255.240.0.0 (192.160.0.0) vs 172.16.0.0-0.0.0.0/255.240.0.0 2009/03/24 16:04:06.958| Processing: 'acl SSL_ports port 443' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'SSL_ports' 2009/03/24 16:04:06.958| ACL::FindByName found no match 2009/03/24 16:04:06.958| aclParseAclLine: Creating ACL 'SSL_ports' 2009/03/24 16:04:06.958| ACL::Prototype::Factory: cloning an object for type 'port' 2009/03/24 16:04:06.958| Processing: 'acl Safe_ports port 80 # http' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.958| ACL::FindByName found no match 2009/03/24 16:04:06.958| aclParseAclLine: Creating ACL 'Safe_ports' 2009/03/24 16:04:06.958| ACL::Prototype::Factory: cloning an object for type 'port' 2009/03/24 16:04:06.958| Processing: 'acl Safe_ports port 21 # ftp' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.958| Processing: 'acl Safe_ports port 443 # https' 2009/03/24 16:04:06.958| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.958| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.958| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.958| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 70 # gopher' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 210 # wais' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 1025-65535 # unregistered ports' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 280 # http-mgmt' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 488 # gss-http' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 591 # filemaker' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl Safe_ports port 777 # multiling http' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type port 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.959| aclParseAclLine: Appending to 'Safe_ports' 2009/03/24 16:04:06.959| Processing: 'acl CONNECT method CONNECT' 2009/03/24 16:04:06.959| ACL::Prototype::Registered: invoked for type method 2009/03/24 16:04:06.959| ACL::Prototype::Registered: yes 2009/03/24 16:04:06.959| ACL::FindByName 'CONNECT' 2009/03/24 16:04:06.959| ACL::FindByName found no match 2009/03/24 16:04:06.959| aclParseAclLine: Creating ACL 'CONNECT' 2009/03/24 16:04:06.959| ACL::Prototype::Factory: cloning an object for type 'method' 2009/03/24 16:04:06.959| Processing: 'http_access allow manager localhost' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'manager' 2009/03/24 16:04:06.959| ACL::FindByName 'manager' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'localhost' 2009/03/24 16:04:06.959| ACL::FindByName 'localhost' 2009/03/24 16:04:06.959| Processing: 'http_access deny manager' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'manager' 2009/03/24 16:04:06.959| ACL::FindByName 'manager' 2009/03/24 16:04:06.959| Processing: 'http_access deny !Safe_ports' 2009/03/24 16:04:06.959| aclParseAccessLine: looking for ACL name 'Safe_ports' 2009/03/24 16:04:06.960| ACL::FindByName 'Safe_ports' 2009/03/24 16:04:06.960| Processing: 'http_access deny CONNECT !SSL_ports' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'CONNECT' 2009/03/24 16:04:06.960| ACL::FindByName 'CONNECT' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'SSL_ports' 2009/03/24 16:04:06.960| ACL::FindByName 'SSL_ports' 2009/03/24 16:04:06.960| Processing: 'http_access allow localnet' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'localnet' 2009/03/24 16:04:06.960| ACL::FindByName 'localnet' 2009/03/24 16:04:06.960| Processing: 'http_access deny all' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.960| ACL::FindByName 'all' 2009/03/24 16:04:06.960| Processing: 'http_port 3128 tproxy' 2009/03/24 16:04:06.960| http(s)_port: found Listen on Port: 3128 2009/03/24 16:04:06.960| http(s)_port: found Listen on wildcard address: 0.0.0.0:3128 2009/03/24 16:04:06.960| Starting IP Spoofing on port 0.0.0.0:3128 2009/03/24 16:04:06.960| Disabling Authentication on port 0.0.0.0:3128 (Ip spoofing enabled) 2009/03/24 16:04:06.960| Processing: 'hierarchy_stoplist cgi-bin ?' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern ^ftp: 1440 20% 10080' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern ^gopher: 1440 0% 1440' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern -i (/cgi-bin/|\?) 0 0% 0' 2009/03/24 16:04:06.960| Processing: 'refresh_pattern . 0 20% 4320' 2009/03/24 16:04:06.960| Processing: 'coredump_dir /var/spool/squid/cache' 2009/03/24 16:04:06.960| Processing: 'cache_effective_user proxy' 2009/03/24 16:04:06.960| Processing: 'cache_effective_group proxy' 2009/03/24 16:04:06.960| Processing: 'access_log /var/log/squid/access.log squid' 2009/03/24 16:04:06.960| Log definition name 'squid' file '/var/log/squid/access.log' 2009/03/24 16:04:06.960| Processing: 'cache_store_log /var/log/squid/store.log' 2009/03/24 16:04:06.960| Processing: 'referer_log /var/log/squid/referer.log' 2009/03/24 16:04:06.960| Processing: 'log_access allow all' 2009/03/24 16:04:06.960| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.960| ACL::FindByName 'all' 2009/03/24 16:04:06.960| Processing: 'cache allow all ' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| wccp2_add_service_list: added service id 0 2009/03/24 16:04:06.961| aclParseAccessLine: looking for ACL name 'all' 2009/03/24 16:04:06.961| ACL::FindByName 'all' 2009/03/24 16:04:06.961| tools.cc(671) uniqueHostname: Config: ' 2009/03/24 16:04:06.961| getMyHostname: 'netflow' has rDNS. 2009/03/24 16:04:06.961| tools.cc(671) uniqueHostname: Config: ' 2009/03/24 16:04:06.961| acl_access::containsPURGE: invoked for 'http_access allow manager localhost' 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: can't create tempAcl 2009/03/24 16:04:06.961| acl_access::containsPURGE: returning false 2009/03/24 16:04:06.961| Initializing https proxy context 2009/03/24 16:04:06.964| Using SSLv2/SSLv3. 2009/03/24 16:04:06.965| Setting RSA key generation callback. 2009/03/24 16:04:06.965| Setting certificate verification callback. 2009/03/24 16:04:06.965| Setting CA certificate locations. 2009/03/24 16:04:06.965| leave_suid: PID 11891 called 2009/03/24 16:04:06.965| leave_suid: PID 11891 giving up root, becoming 'proxy' 2009/03/24 16:04:06.965| Stopping full transparency: Missing needed capability support. 2009/03/24 16:04:06.965| command-line -X overrides: ALL,1 2009/03/24 16:04:06.966| Starting Squid Cache version 3.1.0.6 for i686-pc-linux-gnu... 2009/03/24 16:04:06.966| Process ID 11891 2009/03/24 16:04:06.966| With 1024 file descriptors available 2009/03/24 16:04:06.966| Initializing IP Cache... 2009/03/24 16:04:06.966| ipcacheAddEntryFromHosts: Bad IP address '::1' 2009/03/24 16:04:06.966| ipcacheAddEntryFromHosts: Bad IP address 'fe00::0' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff00::0' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff02::1' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff02::2' 2009/03/24 16:04:06.967| ipcacheAddEntryFromHosts: Bad IP address 'ff02::3' 2009/03/24 16:04:06.967| DNS Socket created at 0.0.0.0, FD 5 2009/03/24 16:04:06.967| Adding domain isiline.net from /etc/resolv.conf 2009/03/24 16:04:06.967| Adding nameserver 213.144.64.1 from /etc/resolv.conf 2009/03/24 16:04:06.967| Adding nameserver 213.144.66.1 from /etc/resolv.conf 2009/03/24 16:04:06.968| User-Agent logging is disabled. 2009/03/24 16:04:07.234| Unlinkd pipe opened on FD 11 2009/03/24 16:04:07.238| Local cache digest enabled; rebuild/rewrite every 3600/3600 sec 2009/03/24 16:04:07.238| Swap maxSize 0 KB, estimated 0 objects 2009/03/24 16:04:07.238| Target number of buckets: 0 2009/03/24 16:04:07.238| Using 8192 Store buckets 2009/03/24 16:04:07.238| Max Mem size: 262144 KB 2009/03/24 16:04:07.238| Max Swap size: 0 KB 2009/03/24 16:04:07.238| Using Least Load store dir selection 2009/03/24 16:04:07.239| Set Current Directory to /var/spool/squid/cache 2009/03/24 16:04:07.335| Loaded Icons. 2009/03/24 16:04:07.336| Accepting spoofing HTTP connections at 0.0.0.0:3128, FD 13. 2009/03/24 16:04:07.336| HTCP Disabled. 2009/03/24 16:04:07.337| Squid modules loaded: 0 2009/03/24 16:04:07.337| Adaptation support is off. 2009/03/24 16:04:07.337| Ready to serve requests.

1 0

Re: [tproxy] TProxy4 and Squid 3.1.0.5 client address spoofing problem !
by Hamid Hashemi 22 Mar '09

22 Mar '09

Dear Modestas, Thanks for your response. My problem was exactly the libcap-devel ( CentOS package name ) missing in compile time. unfortunately there was no error or warning message in configure time in compile and if you rely in the messages in configure or compile time it should work. I was following up this howto : http://wiki.squid-cache.org/ConfigExamples/TPROXYPatchingCentOS and there was no hint about this package. Anyway the problem was solved compeletely and I think it is better to mention this in squid-cache.org HOWTO. _Hamid On Sat, Mar 14, 2009 at 6:04 PM, Modestas Vainius <modestas(a)vainius.eu>wrote: > Hello, > > I faced similar problem to yours yesterday. > > Linux 2.6.28 on Debian GNU/Linux amd64 (TPROXY v4.1) > iptables 1.4.3 snapshot (20090312) > squid 3.1.0.6 (beta) > > I had no problems building iptables 1.4.3 snapshot, TPROXY target was built > properly without a hassle and worked perfectly out-of-the-box. > > Squid seemed to build fine from the first sight however it simply didn't do > any tproxy'ing (tproxy port worked but packets came out with the IP of the > squid server). After long hours of debugging and tracing, I localized the > problem to this squid code at src/tools.cc [1]. > > And guess what: > > # squid -X 2>&1 | grep 'Stopping full transparency' > Stopping full transparency: Missing needed capability support. > > So I needed to install libcap-dev package (on Debian) and to get > development > headers (sys/capability.h) for the Linux capabilities library and rebuild > squid. And squid has started working fine then. I guess you have the same > issue, just package name is different. > > Basically, I recommend running the command above to check your squid config > with regard to tproxy support. Obviously, it should return nothing if > transparency support has been successfully enabled. squid should be more > verbose about such errors... > > What is more, TPROXY+squid works fine on my router/server which does > NETMAP/SNAT too (I was concerned that there would be problems with > nat'ing). > Great job and thanks to everybody involved. > > 1. > ------------------- > static void > restoreCapabilities(int keep) > { > /* NP: keep these two if-endif separate. Non-Linux work perfectly well > without Linux syscap support. */ > #if defined(_SQUID_LINUX_) > > #if HAVE_SYS_CAPABILITY_H > #ifndef _LINUX_CAPABILITY_VERSION_1 > #define _LINUX_CAPABILITY_VERSION_1 _LINUX_CAPABILITY_VERSION > #endif > cap_user_header_t head = (cap_user_header_t) xcalloc(1, sizeof(*head)); > cap_user_data_t cap = (cap_user_data_t) xcalloc(1, sizeof(*cap)); > > head->version = _LINUX_CAPABILITY_VERSION_1; > > if (capget(head, cap) != 0) { > debugs(50, DBG_IMPORTANT, "Can't get current capabilities"); > } else if (head->version != _LINUX_CAPABILITY_VERSION_1) { > debugs(50, DBG_IMPORTANT, "Invalid capability version " << head- > >version << " (expected " << _LINUX_CAPABILITY_VERSION_1 << ")"); > } else { > > head->pid = 0; > > cap->inheritable = 0; > cap->effective = (1 << CAP_NET_BIND_SERVICE); > > if (IpInterceptor.TransparentActive()) { > cap->effective |= (1 << CAP_NET_ADMIN); > #if LINUX_TPROXY2 > cap->effective |= (1 << CAP_NET_BROADCAST); > #endif > } > > if (!keep) > cap->permitted &= cap->effective; > > if (capset(head, cap) != 0) { > IpInterceptor.StopTransparency("Error enabling needed > capabilities."); > } > } > > xfree(head); > xfree(cap); > > #else > IpInterceptor.StopTransparency("Missing needed capability support."); > #endif /* HAVE_SYS_CAPABILITY_H */ > > #endif /* !defined(_SQUID_LINUX_) */ > } > --------------- > > -- > Modestas Vainius <modestas(a)vainius.eu> > > -- Regards Hamid Hashemi

1 0

Problem with redirection from 80 to 8080 with -j TPROXY redirect
by Pranav Desai 15 Mar '09

15 Mar '09

Hello All, I am having some trouble redirecting port 80 traffic to 8080 using tproxy for transparent proxying. The SYNs come in but there is no SYN-ACK going out. the iptables -L do show the rules being matched. tcpdump output -------------------- # tcpdump -nn -i eth1 port 8080 or port 80 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes 12:12:30.973583 IP 13.1.1.1.34879 > 172.16.55.205.80: S 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp 3948186312 0,nop,wscale 7> 12:12:33.974329 IP 13.1.1.1.34879 > 172.16.55.205.80: S 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp 3948189312 0,nop,wscale 7> Kernel (with tproxy enabled) and Iptables Version -------------------------------------------------------------- # iptables -V iptables v1.4.3-rc1 # uname -a Linux dev 2.6.28.3 #1 SMP Sun Mar 1 23:13:20 PST 2009 x86_64 x86_64 x86_64 GNU/Linux I am only trying to get the first step of redirection working. Are these instructions in the README enough, or do I need any thing else ? <instructions> iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port <proxyport> --tproxy-mark 0x1/0x1 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 </instructions> I do have 2 interfaces, does that have anything to do with the problem ? I have even tried with the other mangle rules (the rules for socket match) given in the README, but still no difference. I have given some details below, but let me know if you need any other details. Thanks -- Pranav mangle table (nat and filter table are empty) -------------------------------------------------------- Chain PREROUTING (policy ACCEPT 31132 packets, 2279K bytes) pkts bytes target prot opt in out source destination 3 180 TPROXY tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:8080 mark 0x1/0x1 Chain INPUT (policy ACCEPT 33779 packets, 2304K bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 36335 packets, 35M bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 36355 packets, 35M bytes) pkts bytes target prot opt in out source destination Chain DIVERT (0 references) pkts bytes target prot opt in out source destination Here are my ip rule and route setting --------------------------------------------- # ip rule ls 0: from all lookup 255 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default # ip route ls table 100 local default dev lo scope host Here are my modules. --------------------------- # lsmod | egrep "xt|nf" [root@vcadev httpd]# ip rule ls xt_TPROXY 2944 1 xt_socket 3264 0 nf_tproxy_core 3200 2 xt_TPROXY,xt_socket,[permanent] xt_MARK 3456 0 nf_nat 18580 2 ipt_REDIRECT,iptable_nat nf_conntrack_ipv4 14680 3 iptable_nat,nf_nat nf_conntrack 58984 4 xt_socket,iptable_nat,nf_nat,nf_conntrack_ipv4 nf_defrag_ipv4 2560 3 xt_TPROXY,xt_socket,nf_conntrack_ipv4

2 1

Re: [tproxy] Problem with redirection from 80 to 8080 with -j TPROXY redirect [SOLVED]
by Pranav Desai 05 Mar '09

05 Mar '09

Hello All, Even the listen socket needs to have to setsockopt(IP_TRANSPARENT). I missed that, I was doing it only for the backend connecting socket. Thanks -- Pranav On Mon, Mar 2, 2009 at 12:16 PM, Pranav Desai <pranavadesai(a)gmail.com> wrote: > Hello All, > > I am having some trouble redirecting port 80 traffic to 8080 using > tproxy for transparent proxying. > The SYNs come in but there is no SYN-ACK going out. the iptables -L do > show the rules being matched. > > tcpdump output > -------------------- > # tcpdump -nn -i eth1 port 8080 or port 80 > tcpdump: verbose output suppressed, use -v or -vv for full protocol decode > listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes > > 12:12:30.973583 IP 13.1.1.1.34879 > 172.16.55.205.80: S > 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp > 3948186312 0,nop,wscale 7> > 12:12:33.974329 IP 13.1.1.1.34879 > 172.16.55.205.80: S > 2941026950:2941026950(0) win 5840 <mss 1460,sackOK,timestamp > 3948189312 0,nop,wscale 7> > > Kernel (with tproxy enabled) and Iptables Version > -------------------------------------------------------------- > # iptables -V > iptables v1.4.3-rc1 > # uname -a > Linux dev 2.6.28.3 #1 SMP Sun Mar 1 23:13:20 PST 2009 x86_64 x86_64 > x86_64 GNU/Linux > > > I am only trying to get the first step of redirection working. > > Are these instructions in the README enough, or do I need any thing else ? > <instructions> > iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY > --on-port <proxyport> --tproxy-mark 0x1/0x1 > > ip rule add fwmark 1 lookup 100 > ip route add local 0.0.0.0/0 dev lo table 100 > </instructions> > > I do have 2 interfaces, does that have anything to do with the problem ? > > I have even tried with the other mangle rules (the rules for socket > match) given in the README, but still no difference. I have given some > details below, but let me know if you need any other details. > > Thanks > -- Pranav > > > mangle table (nat and filter table are empty) > -------------------------------------------------------- > Chain PREROUTING (policy ACCEPT 31132 packets, 2279K bytes) > pkts bytes target prot opt in out source > destination > 3 180 TPROXY tcp -- * * 0.0.0.0/0 > 0.0.0.0/0 tcp dpt:80 TPROXY redirect 0.0.0.0:8080 mark > 0x1/0x1 > > Chain INPUT (policy ACCEPT 33779 packets, 2304K bytes) > pkts bytes target prot opt in out source > destination > > Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) > pkts bytes target prot opt in out source > destination > > Chain OUTPUT (policy ACCEPT 36335 packets, 35M bytes) > pkts bytes target prot opt in out source > destination > > Chain POSTROUTING (policy ACCEPT 36355 packets, 35M bytes) > pkts bytes target prot opt in out source > destination > > Chain DIVERT (0 references) > pkts bytes target prot opt in out source > destination > > > Here are my ip rule and route setting > --------------------------------------------- > # ip rule ls > 0: from all lookup 255 > 32765: from all fwmark 0x1 lookup 100 > 32766: from all lookup main > 32767: from all lookup default > > # ip route ls table 100 > local default dev lo scope host > > > Here are my modules. > --------------------------- > # lsmod | egrep "xt|nf" > [root@vcadev httpd]# ip rule ls > xt_TPROXY 2944 1 > xt_socket 3264 0 > nf_tproxy_core 3200 2 xt_TPROXY,xt_socket,[permanent] > xt_MARK 3456 0 > nf_nat 18580 2 ipt_REDIRECT,iptable_nat > nf_conntrack_ipv4 14680 3 iptable_nat,nf_nat > nf_conntrack 58984 4 xt_socket,iptable_nat,nf_nat,nf_conntrack_ipv4 > nf_defrag_ipv4 2560 3 xt_TPROXY,xt_socket,nf_conntrack_ipv4 >

2 1