May 2011 - tproxy - lists.balabit.hu

ACCEPT LOCAL PACKETS
by maria isabel 31 May '11

31 May '11

Hello, This sysctl parameter (accept_local) is available from kernel version 2.6.34 onwards.Is it possible to isolate it as a loadable kernel module?It affects core routing functionality and the general opinion is to extract the patch and recompile the entire kernel.The patch was under Patrick's name http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.39.y.git;a=commi… Regards, Maria

1 0

Port redirection in TCP and SCTP
by maria isabel 17 May '11

17 May '11

Hello, I was going through the historical mail archives for tproxy in tcp and I found some changed functionality related to the hash tables and port redirection when TPROXY is involved. In SCTP the flow is proceeding as follows -Socket lookup in xt_TPROXY and xt_socket modules -Store the socket reference in skb->sk and redirect the packet -In input.c in sctp the association and endpoint structures are filled but the socket is reused from skb->sk?? Is this alright? If this is not alright we can also store the entire endpoint structure reference containing the socket in skb->cb and forward it to input.c after redirection. -Now INIT-ACK comes from the TPROXY port and not from the original destination port.By looking at the tcp patches I can see that you are storing and reusing this information and also adding an entry in the hash table to get the reply from the original port and not the tproxy port. Can somebody please tell me how to go about on the port redirection part and hash table part as I have no idea? Also I'm getting confused reading the mail archives as the design for TPROXY was changed (earlier it was a bit different I presume not using the IP_TRANSPARENT and the mangle tables) If you can tell me the outline followed for TCP I can look for similar equivalent functionality in SCTP and modify. It would be a lot quicker considering the deadline I'm on. :( The background behind all of this is we are trying to build a Load Balancer which will accept and route upto 2 million connections from clients.TPROXY is the core element for this. Thanks and Regards, Maria

1 0

!!Socket getting set to NULL in TPROXY for SCTP
by maria isabel 09 May '11

09 May '11

Hello, I am able to obtain a socket reference by doing a socket look-up in the xt_socket module.After this somehow the following code gets hit if (wildcard || !transparent){ printk(KERN_INFO "Inside not transparent or wildcard xt_socket"); sk = NULL; } I am sure the socket is transparent so I am assuming it satisfies the wildcard case here. socket match: proto 132 0aff0d8c:40480 -> 0aff0d9e:3127 (orig 0aff0d9e:3127) sock (null) sk gets set to null.Can you please tell me how to resolve this? What is the flow of the TPROXY module?My understanding is as follows -When a packet comes first it hits xt_socket -When this fails it hits xt_TPROXY I am able to get this trace from xt_TPROXY when I specify a port number in the TPROXY rule. iptables -t mangle -A PREROUTING -p sctp -i bond0.110 --*dport 1500* -j TPROXY --tproxy-mark 1 --on-port 3127 I get this trace redirecting: proto 132 0aff0d9e:1500 -> 00000000:3128, mark: 1 But this never comes when I make the rule iptables -t mangle -A PREROUTING -p sctp -i bond0.110 --*dport 0* -j TPROXY --tproxy-mark 1 --on-port 3127 Can someone please explain this to me.For TCP I am able to successfuly get a socket reference socket match: proto 6 0a8e8ea6:4576 -> 0aff0d9e:22 (orig 0aff0d9e:22) sock * ffff88041d3a54c0* For SCTP my design is as follows -I do the lookup and store the TPROXY port number in skb->cb and redirect the packet -Once the packet reaches the sctp module I redo the lookup with the TPROXY port so I get a valid association/endpoint and the global structures required by the sctp module are filled. I get this error also sporadically Regards, Maria

1 0

Re: [tproxy] Sample/test code
by 文剑 08 May '11

08 May '11

Hi, * *I want to write a full transparency proxy too. Squid and haproxy are so complicated that i can't quickly understand how tproxy works. And I am new to iptables. If there is a sample peace of code which is simple, I think it would be helpful. I wrote some code which failed at initiating connections with a foreign address as a source. The reason is timeout while attempting connection. Where am I wrong? Thanks. My code: #define NON_LOCAL_IP "192.168.111.23" #define NON_LOCAL_PORT 2000 int sockfd = socket(AF_INET, SOCK_STREAM, 0); memset (&non_local_addr, 0, sizeof(non_local_addr)); non_local_addr.sin_family = AF_INET; dst_addr.sin_addr.s_addr = inet_addr(NON_LOCAL_IP); inet_pton(AF_INET, NON_LOCAL_IP, &non_local_addr.sin_addr); non_local_addr.sin_port = htons(NON_LOCAL_PORT); setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &optvalue, sizeof(optvalue)); setsockopt(sockfd, SOL_IP, IP_TRANSPARENT, &optvalue, sizeof(optvalue)); bind(sockfd, (struct sockaddr *)&non_local_addr, sizeof(non_local_addr)); memset(&dst_addr, 0, sizeof(dst_addr)); dst_addr.sin_family = AF_INET; dst_addr.sin_addr.s_addr = inet_addr("192.168.1.1"); dst_addr.sin_port = htons(80); connect(sockfd, (struct sockaddr *) &dst_addr, sizeof(dst_addr)); // ETIMEOUT

2 2