September 2011 - tproxy - lists.balabit.hu

httpd-2.2.14-tproxy compile error on freebsd
by Dariush Zahedmanesh 27 Sep '11

27 Sep '11

Hello all when we patch httpd.tproxy to httpd-2.2.14, and compile it, it returns some error such as prctl(), capset() undefined reference in freebsd. os/unix/.libs/libos.a(unixd.o): In function `keep_capabilities': /root/httpd-2.2.14/os/unix/unixd.c:82: undefined reference to `prctl' os/unix/.libs/libos.a(unixd.o): In function `set_capabilities': /root/httpd-2.2.14/os/unix/unixd.c:99: undefined reference to `capset' *** Error code 1 Stop in /root/httpd-2.2.14. these two functions are linux syscall that only implements on linux! are any freebsd based of these functions? how we can compile it without any error? -- Best regards Dariush Zahedmanesh

1 0

apache-2.2.14 with httpd-2.2.14.tproxy.patch compile error on freebsd-8.2
by Dariush Zahedmanesh 26 Sep '11

26 Sep '11

Hello all I patched httpd-2.2.14.tproxy on freebsd-8.2 as bellow: 1. tar zxvf httpd-2.2.14.tar.bz2 2. cd httpd-2.2.14 3. patch -p1 < ../httpd-2.2.14.tproxy.patch Hmm... Looks like a unified diff to me... The text leading up to this was: -------------------------- |diff -ru httpd-2.2.14/modules/proxy/mod_proxy_ajp.c httpd-2.2.14.tproxy/modules/proxy/mod_proxy_ajp.c |--- httpd-2.2.14/modules/proxy/mod_proxy_ajp.c 2009-04-25 12:04:21.000000000 +0200 |+++ httpd-2.2.14.tproxy/modules/proxy/mod_proxy_ajp.c 2010-02-17 18:46:47.000000000 +0100 -------------------------- Patching file modules/proxy/mod_proxy_ajp.c using Plan A... Hunk #1 succeeded at 673. Hmm... The next patch looks like a unified diff to me... The text leading up to this was: .... .... .... it seems patch fully successful. 4. ./configure --enable-proxy --enable-proxy-http but when i try to compile it, it return error! 5. make ... /usr/local/share/apr/build-1/libtool --silent --mode=compile cc -g -O2 -I/root/httpd-2.2.14/srclib/pcre -I. -I/root/httpd-2.2.14/os/unix -I/root/httpd-2.2.14/server/mpm/prefork -I/root/httpd-2.2.14/modules/http -I/root/httpd-2.2.14/modules/filters -I/root/httpd-2.2.14/modules/proxy -I/root/httpd-2.2.14/include -I/root/httpd-2.2.14/modules/generators -I/root/httpd-2.2.14/modules/mappers -I/root/httpd-2.2.14/modules/database -I/usr/local/include/apr-1 -I/usr/local/include -I/usr/local/include/db42 -I/root/httpd-2.2.14/modules/proxy/../generators -I/root/httpd-2.2.14/modules/ssl -I/root/httpd-2.2.14/modules/dav/main -prefer-non-pic -static -c unixd.c && touch unixd.lo unixd.c: In function 'keep_capabilities': unixd.c:67: error: 'PR_SET_KEEPCAPS' undeclared (first use in this function) unixd.c:67: error: (Each undeclared identifier is reported only once unixd.c:67: error: for each function it appears in.) unixd.c: In function 'set_capabilities': unixd.c:75: error: 'cap_user_header_t' undeclared (first use in this function) unixd.c:75: error: expected ';' before 'head' unixd.c:76: error: 'cap_user_data_t' undeclared (first use in this function) unixd.c:76: error: expected ';' before 'cap' unixd.c:78: error: 'head' undeclared (first use in this function) unixd.c:78: error: '_LINUX_CAPABILITY_VERSION' undeclared (first use in this function) unixd.c:80: error: 'cap' undeclared (first use in this function) unixd.c: In function 'unixd_setup_child': unixd.c:201: error: 'CAP_NET_ADMIN' undeclared (first use in this function) *** Error code 1 ... how we can solve this error? any help would be great -- Best regards Dariush Zahedmanesh

1 0

Issue with iptables for tproxy
by RDP 22 Sep '11

22 Sep '11

Hi I am trying to build tproxy support for haproxy on Ubuntu 10.04 LTS 64 bit server. The kernel has the tproxy support .config | grep -E '(NF_CONNTRACK=|TPROXY|XT_MATCH_SOCKET|XT_TARGET_TPROXY)' CONFIG_NF_CONNTRACK=m CONFIG_NETFILTER_TPROXY=m CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_NETFILTER_XT_MATCH_SOCKET=m and the iptables version is 1.4.4 Now when I execute the iptables rule iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables: No chain/target/match by that name. I get this issue. Any thought or advice will be highly appreciated. regards

1 1

tproxy patch for freebsd-8.2
by Dariush Zahedmanesh 19 Sep '11

19 Sep '11

Hello all I want to use apache tproxy for transparent proxy on freebsd-8.2. is any patch for freebsd kernel and httpd-2.2.17? how can i patch it? Any help would be great -- Best regards Dariush Zahedmanesh

2 1

Tproxy request getting timed-out
by Karthik Vembar 08 Sep '11

08 Sep '11

Hi I am running squid 3.1.15 , kernel version 2.6.32-33-server , Iptables version v1.4.4. I followed the instrcution given on When the client browse using this Squid as gateway, request are getting timed out with following in access.log 1315384947.854 60225 xx.xx.xx.xx TCP_MISS/000 0 GET http://www.google.co.in/url? - DIRECT/www.google.co.in - 1315384949.431 117995 xx.xx.xx.xx TCP_MISS/000 0 GET http://www.google.co.in/url? - DIRECT/www.google.co.in - where xx.xx.xx.xx are client Public Ips Following is the squid setup 1) Network configuration Router ---> squid (eth0 - Public IP) --> Client (Public IP) sysctl -p net.ipv4.conf.default.rp_filter = 1 net.ipv4.ip_forward = 1 cat /boot/config-2.6.32-33-server |grep -E '(NF_CONNTRACK=|TPROXY|XT_MATCH_SOCKET|XT_TARGET_TPROXY)' CONFIG_NF_CONNTRACK=m CONFIG_NETFILTER_TPROXY=m CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_NETFILTER_XT_MATCH_SOCKET=m iptables -L -t mangle Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff ACCEPT all -- anywhere anywhere from squid.conf http_port 3129 tproxy from dmesg [62387.197490] nf_conntrack version 0.5.0 (16384 buckets, 65536 max) [62387.197746] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use [62387.197749] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or [62387.197752] sysctl net.netfilter.nf_conntrack_acct=1 to enable it. [62387.242358] NF_TPROXY: Transparent proxy support initialized, version 4.1.0 [62387.242362] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. Browsing is happening fine in transparent mode using http_port 3128 transparent.. Please help.... -- Karthik Vembar “Condemn none: if you can stretch out a helping hand, do so. If you cannot, fold your hands, bless your brothers, and let them go their own way.” Swami Vivekananda

1 0