May 2009 - tproxy - lists.balabit.hu

tproxy side effect - expansion of worm attack
by elyasaf 11 Jun '09

11 Jun '09

tproxy side effect - expansion of worms attacks: We have identified a serious "social" side effect in tproxy that results significant performances lose. The scenario is as follows: We have proxy machines that each one serve about ten thousand internet users with unique IP. Since we are listening beside the outgoing traffic also to the ingoing traffic on all the ports: ${iptables} -t mangle -A ROUTINE -p tcp -j TPROXY --on-port 3144 --on-ip 0.0.0.0 --tproxy-mark 0x1/0xffffffff Now each worm that tries to access the computers behind our network, thinks that the remote port is open and our customers are vulnerable, will try more attacks and as result increase significantly the load of the servers (in some hours more than 50% of all the new connections are worms one!) Technically (without considering some flood protections on the iptables, that result sometimes unexpected behavior) we cannot see how to avoid that since we accept the connection from the internet, in case there is user server behind it and in case that not because we can't know which destination ip and port is accessed before accepting the new connection. BTW, similar kind of problems arise on outgoing connections where some applications that run on the customers desktops get confused where the connection to the remote server succeeds but no real server really listening. It's looks like that we have conceptual problem here, possible workaround can be to "know" somehow the remote address details before accepting the connection. Can someone please say if this kind of thing exists and if not is there chance to implement that thing from the perspective of the tproxy patch. br, elyasaf Do you think that there should be an option to implement the accept fucntion without SYN-ACK? And only after a SYN-ACK is received from the server side send the SYN-ACK to the client?

2 3

Is tproxy a real transparent proxy?
by mtpr 08 Jun '09

08 Jun '09

I am testing tproxy with a vmware Centos-5.3 virtual server. I installed squid-3.1, iptables-1.4.3 and kernel-2.6.28.3. Everything seems to be working, unless one... There is a proxy behaviour I thought it would be expectable, but I found it doesn't work the way I thought. Here is the example: If I create a cgi-bin script in a apache webserver that prints the client ip address like this one: #!/bin/env python # coding: utf-8 import os print 'Content-Type: text/plain' print print os.environ['REMOTE_ADDR'] I thought that, in a real transparent proxy, it would give me the original client ip address of the browser computer. But no! Like the old transparent proxy way (not tproxy), it prints the ip address of the proxy server. If I want the original ip address, I need to read the environment variable HTTP_X_FORWARDED_FOR. It doesn't seem to be a "real" transparent proxy. Is this the expectable behaviour, or could be something wrong with the way I setup my tproxy? mtpr

3 4

Re: [tproxy] tproxy Digest, Vol 47, Issue 9
by kudiejlq 31 May '09

31 May '09

that's seems your tproxy doesn't work yet.. 在2009-05-30?18:00:02，tproxy-request@lists.balabit.hu?写道： >Send?tproxy?mailing?list?submissions?to > tproxy(a)lists.balabit.hu > >To?subscribe?or?unsubscribe?via?the?World?Wide?Web,?visit > https://lists.balabit.hu/mailman/listinfo/tproxy >or,?via?email,?send?a?message?with?subject?or?body?'help'?to > tproxy-request(a)lists.balabit.hu > >You?can?reach?the?person?managing?the?list?at > tproxy-owner(a)lists.balabit.hu > >When?replying,?please?edit?your?Subject?line?so?it?is?more?specific >than?"Re:?Contents?of?tproxy?digest..." > > >Today's?Topics: > >???1.?Is?tproxy?a?real?transparent?proxy??(mtpr) > > >---------------------------------------------------------------------- > >Message:?1 >Date:?Fri,?29?May?2009?20:07:55?+0100 >From:?mtpr?<mtpr(a)carreira.com.pt> >Subject:?[tproxy]?Is?tproxy?a?real?transparent?proxy? >To:?tproxy@lists.balabit.hu >Message-ID:?<4A20328B.30304(a)carreira.com.pt> >Content-Type:?text/plain;?charset=ISO-8859-1;?format=flowed > >I?am?testing?tproxy?with?a?vmware?Centos-5.3?virtual?server. >I?installed?squid-3.1,?iptables-1.4.3?and?kernel-2.6.28.3. >Everything?seems?to?be?working,?unless?one... >There?is?a?proxy?behaviour?I?thought?it?would?be?expectable,?but?I?found? >it?doesn't?work?the?way?I?thought. > >Here?is?the?example: >If?I?create?a?cgi-bin?script?in?a?apache?webserver?that?prints?the? >client?ip?address?like?this?one: > >#!/bin/env?python >#?coding:?utf-8 >import?os > >print?'Content-Type:?text/plain' >print >print?os.environ['REMOTE_ADDR'] > >I?thought?that,?in?a?real?transparent?proxy,?it?would?give?me?the? >original?client?ip?address?of?the?browser?computer. >But?no! >Like?the?old?transparent?proxy?way?(not?tproxy),?it?prints?the?ip? >address?of?the?proxy?server. >If?I?want?the?original?ip?address,?I?need?to?read?the?environment? >variable?HTTP_X_FORWARDED_FOR. >It?doesn't?seem?to?be?a?"real"?transparent?proxy. > >Is?this?the?expectable?behaviour,?or?could?be?something?wrong?with?the? >way?I?setup?my?tproxy? > > >mtpr > > >------------------------------ > >_______________________________________________ >tproxy?mailing?list >tproxy(a)lists.balabit.hu >https://lists.balabit.hu/mailman/listinfo/tproxy > > >End?of?tproxy?Digest,?Vol?47,?Issue?9 >*************************************

1 0

Tproxy with WCCP configure error
by Engr.M.monzur Alam 13 May '09

13 May '09

I successfully configure tproxy all the steps. (Patching Centos, Patching iptables, Building squid). And also WCCP configuration with L4 WCCPv2. When I trying check gre0 tunnel with any packet flow but don't found any request. My error showed.............. [root@heldas]# tcpdump -i gre0 tcpdump: WARNING: arptype 778 not supported by libpcap - falling back to cooked socket tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gre0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes ^C 0 packets captured 0 packets received by filter 0 packets dropped by kernel My iptables script is........... #/bin/bash /sbin/iptables -t mangle -N DIVERT /sbin/iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT /sbin/iptables -t mangle -A DIVERT -j MARK --set-mark 1 /sbin/iptables -t mangle -A DIVERT -j ACCEPT /sbin/iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 3129 My Physical connectivity structure is .... Internet cloud to Cisco core router to Juniper firewall to Distributed Cisco router to Core Cisco switch to TPROXY Please give me a solution . Thanks Engr.Mohammad Monzur Alam Network & System Admin Grameen CyberNet Ltd. Dhaka, Bangladesh

2 2

tproxy bind failed - limit of TPROXY bind
by elyasaf 08 May '09

08 May '09

The tproxy bind is limit to only about 28219 socket I use TPROXY-4 (with the latest patch including latest udp patch too) Linux version 2.6.28.9 This is some sample test case: #define IP_TRANSPARENT 19 int main(){ int i,fd[100000],flag=1; struct sockaddr_in local_addr; bzero(&local_addr,sizeof(local_addr)); local_addr.sin_family = AF_INET; local_addr.sin_addr.s_addr=0xd0000000; for(i=0;i<100000;i++){ if((fd[i]=socket(AF_INET,SOCK_STREAM,0))<0){ printf("creating socket %d failed\n",i); exit(0); } if(setsockopt(fd[i],SOL_IP,IP_TRANSPARENT,&flag,sizeof(int))<0){ printf("set transparent to the %d socket (fd=%d) failed\n",i,fd[i]); exit(0); } local_addr.sin_port=0; if(bind(fd[i],(struct sockaddr *)&local_addr,sizeof(local_addr))<0){ perror("bind - error"); printf("bind for the %d socket (fd=%d) failed\nipport - %s:%d\n",i,fd[i],inet_ntoa(local_addr.sin_addr),htons(local_addr.sin_port)); exit(0); } local_addr.sin_addr.s_addr++; } } The result: bind - error: Address already in use bind for the 28223 socket (fd=28226) failed ipport - 63.110.0.208:0 Why this low limit? Can I configure something to by-pass it? If not, have chance to fix this bug?

3 6

Please give a solution
by Monzur Md.. Alam 08 May '09

08 May '09

Dear all, I have gone the the procedure as described at the following URL URL: http://wiki.squid-cache.org/Features/Tproxy4#head-f17bb712222beeb0aa083f022… I have successfully complied kernel:2.6.28.1 and iptables:1.4.3 with tproxy:2.6.25-20080519-165031-1211208631.tar.bz2 Now when I run following ipables commands, all the commands running without any problem except.... iptables 1.4.3 Configuration iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT and error messege shown: [root@hpproxy ~]# iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables: No chain/target/match by that name. Run `dmesg' for more information. [root@hpproxy ~]# plese give me anybody solution..

2 1

Re: [tproxy] tproxy Digest, Vol 47, Issue 3
by Monzura Alam 06 May '09

06 May '09

Dear Amos, Thank you to your suggestion. We have a successfully patching tproxy-iptables and tproxy-kernel. Then how can i configured WCCP configuration in L4 WCCPv2 with GRE interface in my Linux box. It's also mention that we have used Centos 5.2 and Squid v3.1 Thanks Monzur ----- Original Message ----- From: <tproxy-request(a)lists.balabit.hu> To: <tproxy(a)lists.balabit.hu> Sent: Wednesday, May 06, 2009 4:00 PM Subject: tproxy Digest, Vol 47, Issue 3 > Send tproxy mailing list submissions to > tproxy(a)lists.balabit.hu > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.balabit.hu/mailman/listinfo/tproxy > or, via email, send a message with subject or body 'help' to > tproxy-request(a)lists.balabit.hu > > You can reach the person managing the list at > tproxy-owner(a)lists.balabit.hu > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of tproxy digest..." > > > Today's Topics: > > 1. Re: Please give a solution (sonu chouhan) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Tue, 5 May 2009 09:34:09 -0700 (PDT) > From: sonu chouhan <hi100nu(a)yahoo.com> > Subject: Re: [tproxy] Please give a solution > To: monzur(a)citechco.net > Cc: tproxy(a)lists.balabit.hu > Message-ID: <782120.52780.qm(a)web32508.mail.mud.yahoo.com> > Content-Type: text/plain; charset="iso-8859-1" > > it seem that?ur kernel is not compiled with netfilter socket support, > plz enable "CONFIG_NETFILTER_XT_MATCH_SOCKET=m" in your kernel's .config > file and again compile kernel > > > Bollywood news, movie reviews, film trailers and more! Go to > http://in.movies.yahoo.com/ >

1 0

Re: [tproxy] Please give a solution
by sonu chouhan 05 May '09

05 May '09

it seem that ur kernel is not compiled with netfilter socket support, plz enable "CONFIG_NETFILTER_XT_MATCH_SOCKET=m" in your kernel's .config file and again compile kernel Bollywood news, movie reviews, film trailers and more! Go to http://in.movies.yahoo.com/

1 0

Tproxy v4 patch for squid 2.7 version
by Visolve Squid Team 04 May '09

04 May '09

Hello all, Tproxy-4 patch for squid 2.7 STABLE6 is been released. Tproxy helps in IP spoofing, which means when a browser request for an URL, the client IP is sent to the webserver instead of the proxy server's IP. The patch is available at http://www.visolve.com/squid/squid-tproxy.php Thanks ViSolve Squid Team. http://www.visolve.com

4 6