- tproxy - lists.balabit.hu

about coding details of tproxy
by kudiejlq 15 Dec '08

15 Dec '08

hello, all: I have been reseach on tproxy(for kernel-2.6.24) these days. And I found that Tproxy sets skb->mark and skb->sk first (both the TPROXY target and socket match do the same), then hand packets to non-local sockets rely on policy routing. Today I saw that Tproxy has modified ip_route_me_harder, it inserted lines of code to ip_route_me_harder like following: so, what does ip_route_me_harder used for, why Tproxy modified those codes. thanks very much! /* route_me_harder function, used by iptable_nat, iptable_mangle + ip_queue */ int ip_route_me_harder(struct sk_buff *skb, unsigned addr_type) { const struct iphdr *iph = ip_hdr(skb); struct rtable *rt; struct flowi fl = {}; struct dst_entry *odst; unsigned int hh_len; unsigned int type; type = inet_addr_type(iph->saddr); if (skb->sk && inet_sk(skb->sk)->transparent) //TPROXY ADDED type = RTN_LOCAL; if (addr_type == RTN_UNSPEC) addr_type = type; /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook. */ if (addr_type == RTN_LOCAL) { fl.nl_u.ip4_u.daddr = iph->daddr; if (type == RTN_LOCAL) fl.nl_u.ip4_u.saddr = iph->saddr; fl.nl_u.ip4_u.tos = RT_TOS(iph->tos); fl.oif = skb->sk ? skb->sk->sk_bound_dev_if : 0; fl.mark = skb->mark; fl.flags = skb->sk ? inet_sk_flowi_flags(skb->sk) : 0; //TPROXY ADDED if (ip_route_output_key(&rt, &fl) != 0) return -1; /* Drop old route. */ dst_release(skb->dst); skb->dst = &rt->u.dst; } else { /* non-local src, find valid iif to satisfy * rp-filter when calling ip_route_input. */ fl.nl_u.ip4_u.daddr = iph->saddr; if (ip_route_output_key(&rt, &fl) != 0) return -1; odst = skb->dst; if (ip_route_input(skb, iph->daddr, iph->saddr, RT_TOS(iph->tos), rt->u.dst.dev) != 0) { dst_release(&rt->u.dst); return -1; } dst_release(&rt->u.dst); dst_release(odst); } if (skb->dst->error) return -1; #ifdef CONFIG_XFRM if (!(IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) && xfrm_decode_session(skb, &fl, AF_INET) == 0) if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0)) return -1; #endif /* Change in oif may mean change in hh_len. */ hh_len = skb->dst->dev->hard_header_len; if (skb_headroom(skb) < hh_len && pskb_expand_head(skb, hh_len - skb_headroom(skb), 0, GFP_ATOMIC)) return -1; return 0; } regards.

1 0

Re: [tproxy] [RFC][PATCH] [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple
by Balazs Scheidler 10 Dec '08

10 Dec '08

On Wed, 2008-12-10 at 00:57 -0800, David Miller wrote: > From: Balazs Scheidler <bazsi(a)balabit.hu> > Date: Wed, 10 Dec 2008 09:52:22 +0100 > > > I understand. Here are the alternatives I considered: > > 1) the patch above, by extending the socket structures > > 2) expand skb, of course I felt this is worse than the patch I posted > > 3) call inet_twsk_deschedule() from the prerouting hook > > > > The 3rd one does not require any expansion of the related structures, > > however it'd mean that the TCP state is not only looked up, but also > > changed from the TPROXY target. I felt this ugly, but the ugliness would > > be constrained to the tproxy code. Shall I post a patch implementing > > option #3 above? > > It would be interesting to see what it looks like, so if you > don't mind then yes please toss that together so we can have > a look. > Updated patch below. The SYN validation could still be improved to match the one in tcp_timewait_state_process(), the current one is very simplistic, but the approach is already visible. [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple Without tproxy redirections an incoming SYN kicks out conflicting TIME_WAIT sockets, in order to handle clients that reuse ports within the TIME_WAIT period. The same mechanism didn't work in case TProxy is involved in finding the proper socket, as the time_wait processing code looked up the listening socket assuming that the listener addr/port matches those of the established connection. This is not the case with TProxy as the listener addr/port is possibly changed with the tproxy rule. An earlier version of this patch used expanded inet_sock and inet_timewait_sock structs in order to store the original listener address. This time, the TIME_WAIT socket is removed from the hashes right in the TPROXY target so by the time the packet reaches the TCP stack, the TIME_WAIT socket will not be there. This patch is currently only a draft, I'm still thinking about changing the prototype of nf_tproxy_get_sock_v4(), so please do NOT apply. --- include/net/inet_timewait_sock.h | 2 +- include/net/netfilter/nf_tproxy_core.h | 6 +++++- net/netfilter/nf_tproxy_core.c | 29 +++++++++++++++++++++-------- net/netfilter/xt_TPROXY.c | 29 ++++++++++++++++++++++++----- net/netfilter/xt_socket.c | 2 +- 5 files changed, 52 insertions(+), 16 deletions(-) diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h index 4b8ece2..2f579f4 100644 --- a/include/net/inet_timewait_sock.h +++ b/include/net/inet_timewait_sock.h @@ -130,7 +130,7 @@ struct inet_timewait_sock { /* And these are ours. */ __u8 tw_ipv6only:1, tw_transparent:1; - /* 15 bits hole, try to pack */ + /* 14 bits hole, try to pack */ __u16 tw_ipv6_offset; unsigned long tw_ttd; struct inet_bind_bucket *tw_tb; diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h index 208b46f..b3a8942 100644 --- a/include/net/netfilter/nf_tproxy_core.h +++ b/include/net/netfilter/nf_tproxy_core.h @@ -8,12 +8,16 @@ #include <net/inet_sock.h> #include <net/tcp.h> +#define NFT_LOOKUP_ANY 0 +#define NFT_LOOKUP_LISTENER 1 +#define NFT_LOOKUP_ESTABLISHED 2 + /* look up and get a reference to a matching socket */ extern struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening); + const struct net_device *in, int lookup_type); static inline void nf_tproxy_put_sock(struct sock *sk) diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c index cdc97f3..1858da0 100644 --- a/net/netfilter/nf_tproxy_core.c +++ b/net/netfilter/nf_tproxy_core.c @@ -22,21 +22,34 @@ struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening_only) + const struct net_device *in, int lookup_type) { struct sock *sk; /* look up socket */ switch (protocol) { case IPPROTO_TCP: - if (listening_only) - sk = __inet_lookup_listener(net, &tcp_hashinfo, - daddr, ntohs(dport), - in->ifindex); - else + switch (lookup_type) { + case NFT_LOOKUP_ANY: sk = __inet_lookup(net, &tcp_hashinfo, saddr, sport, daddr, dport, in->ifindex); + break; + case NFT_LOOKUP_LISTENER: + sk = inet_lookup_listener(net, &tcp_hashinfo, + daddr, dport, + in->ifindex); + break; + case NFT_LOOKUP_ESTABLISHED: + sk = inet_lookup_established(net, &tcp_hashinfo, + saddr, sport, daddr, dport, + in->ifindex); + break; + default: + WARN_ON(1); + sk = NULL; + break; + } break; case IPPROTO_UDP: sk = udp4_lib_lookup(net, saddr, sport, daddr, dport, @@ -47,8 +60,8 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, sk = NULL; } - pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, listener only: %d, sock %p\n", - protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), listening_only, sk); + pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n", + protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk); return sk; } diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 1340c2f..92a911e 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -29,7 +29,7 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par) { const struct iphdr *iph = ip_hdr(skb); const struct xt_tproxy_target_info *tgi = par->targinfo; - struct udphdr _hdr, *hp; + struct tcphdr _hdr, *hp; struct sock *sk; hp = skb_header_pointer(skb, ip_hdrlen(skb), sizeof(_hdr), &_hdr); @@ -37,10 +37,29 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par) return NF_DROP; sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, - iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, - hp->source, tgi->lport ? tgi->lport : hp->dest, - par->in, true); - + iph->saddr, iph->daddr, + hp->source, hp->dest, + par->in, NFT_LOOKUP_ESTABLISHED); + + if (sk->sk_state == TCP_TIME_WAIT && hp->syn && !hp->rst && !hp->ack && !hp->fin) { + struct sock *sk2; + + sk2 = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, + iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, + hp->source, tgi->lport ? tgi->lport : hp->dest, + par->in, NFT_LOOKUP_LISTENER); + if (sk2) { + inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); + inet_twsk_put(inet_twsk(sk)); + sk = sk2; + } + } + else if (!sk) { + sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, + iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, + hp->source, tgi->lport ? tgi->lport : hp->dest, + par->in, NFT_LOOKUP_LISTENER); + } /* NOTE: assign_sock consumes our sk reference */ if (sk && nf_tproxy_assign_sock(skb, sk)) { /* This should be in a separate target, but we don't do multiple diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 1d521a5..ae8233d 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -142,7 +142,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par) #endif sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, - saddr, daddr, sport, dport, par->in, false); + saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); if (sk != NULL) { bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0); -- Bazsi

1 0

Re: [tproxy] [RFC][PATCH] [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple
by Balazs Scheidler 10 Dec '08

10 Dec '08

On Tue, 2008-12-09 at 22:18 -0800, David Miller wrote: > From: Balazs Scheidler <bazsi(a)balabit.hu> > Date: Tue, 09 Dec 2008 08:51:35 +0000 > > > Hi, > > > > I'd like to get some guidance regarding the following patch. There's a > > severe performance limitation related to TIME_WAIT sockets and TProxy rules. > > The patch below is the 'nice' approach, but it adds 6 bytes to > > inet_sock and inet_timewait_sock. The 'ugly' approach would be to schedule the > > removal of the affected TIME_WAIT sockets at PREROUTING time. > > > > This post is meant to get some review, but please do not apply this patch this time. > > I have no general objection to this, but people seem to be > experts at making various parts of the TCP socket structures > larger and larger :-( > I understand. Here are the alternatives I considered: 1) the patch above, by extending the socket structures 2) expand skb, of course I felt this is worse than the patch I posted 3) call inet_twsk_deschedule() from the prerouting hook The 3rd one does not require any expansion of the related structures, however it'd mean that the TCP state is not only looked up, but also changed from the TPROXY target. I felt this ugly, but the ugliness would be constrained to the tproxy code. Shall I post a patch implementing option #3 above? -- Bazsi

1 0

[RFC][PATCH] [TPROXY] kick out TIME_WAIT sockets in case a new connection comes in with the same tuple
by Balazs Scheidler 09 Dec '08

09 Dec '08

Hi, I'd like to get some guidance regarding the following patch. There's a severe performance limitation related to TIME_WAIT sockets and TProxy rules. The patch below is the 'nice' approach, but it adds 6 bytes to inet_sock and inet_timewait_sock. The 'ugly' approach would be to schedule the removal of the affected TIME_WAIT sockets at PREROUTING time. This post is meant to get some review, but please do not apply this patch this time. Thanks in advance. Without tproxy redirections an incoming SYN kicks out conflicting TIME_WAIT sockets, in order to handle clients that reuse ports within the TIME_WAIT period. The same mechanism didn't work in case TProxy is involved in finding the proper socket, as the time_wait processing code looks up the listening socket assuming that the listener addr/port matches those of the established connection. This is not the case with TProxy as the listener addr/port is possibly changed with the tproxy rule. This patch extends struct inet_timewait_sock and inet_sock with 6 bytes causing a 112->118 bytes increase in case of inet_timewait_sock, and 680->686 bytes in the case of struct inet_sock on 64 bit platforms. Neither of these cause another cacheline to be used. This patch is currently only a draft, I'm still thinking about changing the prototype of nf_tproxy_get_sock_v4(), so please do NOT apply. --- include/net/inet_sock.h | 3 +++ include/net/inet_timewait_sock.h | 5 ++++- include/net/netfilter/nf_tproxy_core.h | 6 +++++- net/ipv4/inet_connection_sock.c | 2 ++ net/ipv4/inet_timewait_sock.c | 2 ++ net/ipv4/tcp_ipv4.c | 2 +- net/netfilter/nf_tproxy_core.c | 29 +++++++++++++++++++++-------- net/netfilter/xt_TPROXY.c | 13 +++++++++---- net/netfilter/xt_socket.c | 2 +- 9 files changed, 48 insertions(+), 16 deletions(-) diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h index de0ecc7..33434b1 100644 --- a/include/net/inet_sock.h +++ b/include/net/inet_sock.h @@ -143,6 +143,9 @@ struct inet_sock { __be32 addr; struct flowi fl; } cork; + /* listener addr/port, can be different than saddr/sport in case tproxy redirection occurred */ + __be32 laddr; + __be16 lport; }; #define IPCORK_OPT 1 /* ip-options has been held in ipcork.opt */ diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h index 4b8ece2..4de70a2 100644 --- a/include/net/inet_timewait_sock.h +++ b/include/net/inet_timewait_sock.h @@ -130,11 +130,14 @@ struct inet_timewait_sock { /* And these are ours. */ __u8 tw_ipv6only:1, tw_transparent:1; - /* 15 bits hole, try to pack */ + /* 14 bits hole, try to pack */ __u16 tw_ipv6_offset; unsigned long tw_ttd; struct inet_bind_bucket *tw_tb; struct hlist_node tw_death_node; + /* listener addr/port, can be different from tw_saddr/tw_sport in case tproxy redirection occurred */ + __be32 tw_laddr; + __be16 tw_lport; }; static inline void inet_twsk_add_node_rcu(struct inet_timewait_sock *tw, diff --git a/include/net/netfilter/nf_tproxy_core.h b/include/net/netfilter/nf_tproxy_core.h index 208b46f..b3a8942 100644 --- a/include/net/netfilter/nf_tproxy_core.h +++ b/include/net/netfilter/nf_tproxy_core.h @@ -8,12 +8,16 @@ #include <net/inet_sock.h> #include <net/tcp.h> +#define NFT_LOOKUP_ANY 0 +#define NFT_LOOKUP_LISTENER 1 +#define NFT_LOOKUP_ESTABLISHED 2 + /* look up and get a reference to a matching socket */ extern struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening); + const struct net_device *in, int lookup_type); static inline void nf_tproxy_put_sock(struct sock *sk) diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index fe32255..adbc509 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -520,6 +520,8 @@ struct sock *inet_csk_clone(struct sock *sk, const struct request_sock *req, inet_sk(newsk)->dport = inet_rsk(req)->rmt_port; inet_sk(newsk)->num = ntohs(inet_rsk(req)->loc_port); inet_sk(newsk)->sport = inet_rsk(req)->loc_port; + inet_sk(newsk)->laddr = inet_sk(sk)->saddr; + inet_sk(newsk)->lport = inet_sk(sk)->sport; newsk->sk_write_space = sk_stream_write_space; newicsk->icsk_retransmits = 0; diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index 8554d0e..0e0e844 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -126,6 +126,8 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, const int stat tw->tw_substate = state; tw->tw_sport = inet->sport; tw->tw_dport = inet->dport; + tw->tw_laddr = inet->laddr; + tw->tw_lport = inet->lport; tw->tw_family = sk->sk_family; tw->tw_reuse = sk->sk_reuse; tw->tw_hash = sk->sk_hash; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 26b9030..d858ec7 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1645,7 +1645,7 @@ do_time_wait: case TCP_TW_SYN: { struct sock *sk2 = inet_lookup_listener(dev_net(skb->dev), &tcp_hashinfo, - iph->daddr, th->dest, + inet_twsk(sk)->tw_laddr, inet_twsk(sk)->tw_lport, inet_iif(skb)); if (sk2) { inet_twsk_deschedule(inet_twsk(sk), &tcp_death_row); diff --git a/net/netfilter/nf_tproxy_core.c b/net/netfilter/nf_tproxy_core.c index cdc97f3..1858da0 100644 --- a/net/netfilter/nf_tproxy_core.c +++ b/net/netfilter/nf_tproxy_core.c @@ -22,21 +22,34 @@ struct sock * nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, const __be32 saddr, const __be32 daddr, const __be16 sport, const __be16 dport, - const struct net_device *in, bool listening_only) + const struct net_device *in, int lookup_type) { struct sock *sk; /* look up socket */ switch (protocol) { case IPPROTO_TCP: - if (listening_only) - sk = __inet_lookup_listener(net, &tcp_hashinfo, - daddr, ntohs(dport), - in->ifindex); - else + switch (lookup_type) { + case NFT_LOOKUP_ANY: sk = __inet_lookup(net, &tcp_hashinfo, saddr, sport, daddr, dport, in->ifindex); + break; + case NFT_LOOKUP_LISTENER: + sk = inet_lookup_listener(net, &tcp_hashinfo, + daddr, dport, + in->ifindex); + break; + case NFT_LOOKUP_ESTABLISHED: + sk = inet_lookup_established(net, &tcp_hashinfo, + saddr, sport, daddr, dport, + in->ifindex); + break; + default: + WARN_ON(1); + sk = NULL; + break; + } break; case IPPROTO_UDP: sk = udp4_lib_lookup(net, saddr, sport, daddr, dport, @@ -47,8 +60,8 @@ nf_tproxy_get_sock_v4(struct net *net, const u8 protocol, sk = NULL; } - pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, listener only: %d, sock %p\n", - protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), listening_only, sk); + pr_debug("tproxy socket lookup: proto %u %08x:%u -> %08x:%u, lookup type: %d, sock %p\n", + protocol, ntohl(saddr), ntohs(sport), ntohl(daddr), ntohs(dport), lookup_type, sk); return sk; } diff --git a/net/netfilter/xt_TPROXY.c b/net/netfilter/xt_TPROXY.c index 1340c2f..5d66613 100644 --- a/net/netfilter/xt_TPROXY.c +++ b/net/netfilter/xt_TPROXY.c @@ -37,10 +37,15 @@ tproxy_tg(struct sk_buff *skb, const struct xt_target_param *par) return NF_DROP; sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, - iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, - hp->source, tgi->lport ? tgi->lport : hp->dest, - par->in, true); - + iph->saddr, iph->daddr, + hp->source, hp->dest, + par->in, NFT_LOOKUP_ESTABLISHED); + if (!sk) { + sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, + iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, + hp->source, tgi->lport ? tgi->lport : hp->dest, + par->in, NFT_LOOKUP_LISTENER); + } /* NOTE: assign_sock consumes our sk reference */ if (sk && nf_tproxy_assign_sock(skb, sk)) { /* This should be in a separate target, but we don't do multiple diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c index 1d521a5..ae8233d 100644 --- a/net/netfilter/xt_socket.c +++ b/net/netfilter/xt_socket.c @@ -142,7 +142,7 @@ socket_mt(const struct sk_buff *skb, const struct xt_match_param *par) #endif sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), protocol, - saddr, daddr, sport, dport, par->in, false); + saddr, daddr, sport, dport, par->in, NFT_LOOKUP_ANY); if (sk != NULL) { bool wildcard = (sk->sk_state != TCP_TIME_WAIT && inet_sk(sk)->rcv_saddr == 0); -- 1.5.6.3

1 0

Squid doesn't seem to spoof client ip address.
by Przemysław Kudyba 04 Dec '08

04 Dec '08

Hello. I have set up fully transpatent http proxy, my problem is: squid sends requests with ip:port of te box running squid instead of clients ip. Here's my config: kernel patch: tproxy4-2.6.26-200809262032 iptables patch: tproxy-iptables-1.4.0-20080521-113954-1211362794 squid: squid-3.HEAD-20081127 iptables & iproute rules: > > iptables -t mangle -N DIVERT > iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT > > > iptables -t mangle -A DIVERT -j MARK --set-mark 1 > iptables -t mangle -A DIVERT -j ACCEPT > > iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j TPROXY > --on-port 3128 --tproxy-mark 0x1/0x1 > > ip rule add fwmark 1 lookup 100 > ip route add local 0.0.0.0/0 dev lo table 100 > squid conf: > http_port 192.168.250.2:3128 tproxy 217.97.174.18 - my laptop 212.77.100.101 - some www page tcpdump : 19:06:01.736342 IP 217.97.174.18.53401 > 192.168.250.2.80: S 2658655945:2658655945(0) win 5840 <mss 1440,sackOK,timestamp 6961615 0,nop,wscale 5> 19:06:01.736597 IP 192.168.250.2.80 > 217.97.174.18.53401: S 2655745023:2655745023(0) ack 2658655946 win 5792 <mss 1460,sackOK,timestamp 2617146 6961615,nop,wscale 7> 19:06:01.745935 IP 217.97.174.18.53401 > 192.168.250.2.80: . ack 1 win 183 <nop,nop,timestamp 6961619 2617146> 19:06:15.648614 IP 217.97.174.18.53401 > 192.168.250.2.80: P 1:29(28) ack 1 win 183 <nop,nop,timestamp 6975524 2617146> 19:06:15.648681 IP 192.168.250.2.80 > 217.97.174.18.53401: . ack 29 win 46 <nop,nop,timestamp 2620624 6975524> 19:06:17.130355 IP 217.97.174.18.53401 > 192.168.250.2.80: P 29:31(2) ack 1 win 183 <nop,nop,timestamp 6977004 2620624> 19:06:17.130447 IP 192.168.250.2.80 > 217.97.174.18.53401: . ack 31 win 46 <nop,nop,timestamp 2620994 6977004> 19:06:17.131289 IP 192.168.250.2.59447 > 212.77.100.101.80: S 2887325147:2887325147(0) win 5840 <mss 1460,sackOK,timestamp 2620994 0,nop,wscale 7> 19:06:17.353255 IP 217.97.174.18.34317 > 192.168.250.2.80: S 2917413960:2917413960(0) win 5840 <mss 1440,sackOK,timestamp 6977231 0,nop,wscale 5> 19:06:17.353338 IP 192.168.250.2.80 > 217.97.174.18.34317: S 2895521199:2895521199(0) ack 2917413961 win 5792 <mss 1460,sackOK,timestamp 2621050 6977231,nop,wscale 7> 19:06:17.357848 IP 217.97.174.18.34317 > 192.168.250.2.80: . ack 1 win 183 <nop,nop,timestamp 6977235 2621050> 19:06:17.358077 IP 217.97.174.18.34317 > 192.168.250.2.80: P 1:360(359) ack 1 win 183 <nop,nop,timestamp 6977235 2621050> 19:06:17.358133 IP 192.168.250.2.80 > 217.97.174.18.34317: . ack 360 win 54 <nop,nop,timestamp 2621051 6977235> 19:06:17.358230 IP 192.168.250.2.39336 > 217.97.173.21.80: S 2890323424:2890323424(0) win 5840 <mss 1460,sackOK,timestamp 2621051 0,nop,wscale 7> 19:06:17.358467 IP 217.97.173.21.80 > 192.168.250.2.39336: S 3189038941:3189038941(0) ack 2890323425 win 5792 <mss 1460,sackOK,timestamp 117140974 2621051,nop,wscale 7> 19:06:17.358530 IP 192.168.250.2.39336 > 217.97.173.21.80: . ack 1 win 46 <nop,nop,timestamp 2621051 117140974> 19:06:17.358671 IP 192.168.250.2.39336 > 217.97.173.21.80: P 1:462(461) ack 1 win 46 <nop,nop,timestamp 2621051 117140974> 19:06:17.358958 IP 217.97.173.21.80 > 192.168.250.2.39336: . ack 462 win 54 <nop,nop,timestamp 117140975 2621051> 19:06:17.427512 IP 217.97.173.21.80 > 192.168.250.2.39336: . 1:1449(1448) ack 462 win 54 <nop,nop,timestamp 117140992 2621051>

2 2

Latest tproxy patch for kernel, iptables and squid
by Eduardo Schoedler 04 Dec '08

04 Dec '08

Hi list. I'm installing a box with linux with squid and I'm a little bit confuse. First of all, sorry my bad english... I'm brazilian. =) I need to now where I can found the latest version for: - kernel 2.6.27 (or can I use kernel 2.8.x ?); - iptables 1.4.2; - squid. I have some questions: - Which kernel is better to use in a production box? 2.6.27 or 2.6.28 ? - Which squid is better to use in a production box? 2.7 or 3.0 ? - Where I can found a documentation to install and configure tproxy patches ? Thanks in advance! Regards, Eduardo Schoedler.

3 5

example of using udp on tproxy4
by elyasaf 30 Nov '08

30 Nov '08

> While I can see example of using udp on tproxy2 onto the > redirect-udp-recv.c > file, I can't find equivalent on tproxy4. > > Here are my iptables\ip route redirection lines: > ${iptables} -t mangle -N DIVERT > ${iptables} -t mangle -A PREROUTING -p udp -m socket -j DIVERT > ${iptables} -t mangle -A DIVERT -j MARK --set-mark 1 > ${iptables} -t mangle -A DIVERT -j ACCEPT > ${iptables} -t mangle -A PREROUTING -p udp --dport 1500 -j TPROXY > --tproxy-mark 1 --on-port 3127 > > ip rule add fwmark 1 lookup 100 > ip route add local 0.0.0.0/0 dev lo table 100 #include <netdb.h> #include <stdio.h> #include <unistd.h> #include <string.h> #include <time.h> #define LOCAL_PROXY_PORT 3127 #define MAX_MSG 100 #ifndef IP_TRANSPARENT #define IP_TRANSPARENT 19 #endif #ifndef IP_ORIGADDRS #define IP_ORIGADDRS 20 #endif #ifndef IP_RECVORIGADDRS #define IP_RECVORIGADDRS IP_ORIGADDRS #endif #define CTL_BUF_SIZE 64 int main(int argc, char *argv[]) { int fd, rc, n, cliLen, flags; struct sockaddr_in sourceAddr, destinationAddr , proxyAddr; char buf[MAX_MSG]; struct in_origaddrs *ioa; /* socket creation */ fd=socket(AF_INET, SOCK_DGRAM, 0); if(fd<0) { printf("%s: cannot open socket \n",argv[0]); exit(1); } flags=1; if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &flags, sizeof(int)) == -1){ perror("proxy-setsockopt() IP_TRANSPARENT error!"); exit(1); }else printf("proxy-setsockopt IP_TRANSPARENT is OK...\n"); setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &flags, sizeof(flags)); setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &flags, sizeof(flags)); if ( setsockopt(fd, SOL_IP, IP_ORIGADDRS , &flags, sizeof(flags))){ perror("proxy-setsockopt() IP_ORIGADDRS error"); }else{ printf("proxy-setsockopt IP_ORIGADDRS is OK...\n"); } /* bind local server port */ proxyAddr.sin_family = AF_INET; proxyAddr.sin_addr.s_addr = htonl(INADDR_ANY); proxyAddr.sin_port = htons(LOCAL_PROXY_PORT); rc = bind (fd, (struct sockaddr *) &proxyAddr,sizeof(proxyAddr)); if(rc<0) { printf("%s: cannot bind port number %d \n",argv[0], LOCAL_PROXY_PORT); exit(1); } printf("%s: waiting for data on port UDP %u\n",argv[0],LOCAL_PROXY_PORT); /* proxy infinite loop */ while(1) { struct msghdr msg; struct cmsghdr *cmsg; struct iovec iov; char ctl_buf[CTL_BUF_SIZE]; /* init buffer */ memset(buf,0,MAX_MSG); memset(&msg, 0, sizeof(msg)); msg.msg_name = &sourceAddr; msg.msg_namelen = sizeof(sourceAddr); msg.msg_controllen = CTL_BUF_SIZE; msg.msg_control = ctl_buf; msg.msg_iovlen = 1; msg.msg_iov = &iov; iov.iov_base = buf; iov.iov_len = MAX_MSG; n = recvmsg(fd, &msg, 0); if(n<0) { printf("%s: cannot receive data \n",argv[0]); perror("recvmsg"); continue; } printf("%s: source %s:UDP%u : %s \n", argv[0],inet_ntoa(sourceAddr.sin_addr), ntohs(sourceAddr.sin_port),buf); memset(&destinationAddr,0,sizeof(struct sockaddr_in)); for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg,cmsg)){ if (cmsg->cmsg_level == SOL_IP && cmsg->cmsg_type == IP_RECVORIGADDRS){ memcpy(&destinationAddr,(struct sockaddr_in *)CMSG_DATA(cmsg),sizeof(struct sockaddr_in)); destinationAddr.sin_family = AF_INET; printf("%s: destination %s:UDP%u\n", argv[0],inet_ntoa(destinationAddr.sin_addr), ntohs(destinationAddr.sin_port)); send_to_transparenty(buf,n,&sourceAddr,&destinationAddr); //sendto(fd,buf,n,&sourceAddr,&destinationAddr); } } }/* end of proxy infinite loop */ return 0; } int send_to_transparenty(char *buf,int len,struct sockaddr_in *source,struct sockaddr_in *destination){ int fd,flags,i; fd=socket(AF_INET, SOCK_DGRAM, 0); flags=1; if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &flags, sizeof(int)) == -1){ perror("destination-setsockopt() IP_TRANSPARENT error!"); return; }else{ //printf("destination-setsockopt IP_TRANSPARENT is OK...\n"); } setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &flags, sizeof(flags)); setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &flags, sizeof(flags)); if(bind (fd, (struct sockaddr *) source,sizeof(*source))==-1){ perror("source-bind() error!"); return; } flags=0; if(sendto(fd,buf,len,flags,(struct sockaddr *)destination,sizeof(*destination))==-1){ perror("destination-sendto() error!"); return 0; }else{ printf("send to other side\n"); } close(fd); return 1; }

1 0

Re: [tproxy] [PATCH] [TPROXY] implementedIP_RECVORIGDSTADDRsocketoption
by Balazs Scheidler 18 Nov '08

18 Nov '08

Hi, You were right, sendto() wasn't working properly, but not because of my last patch, it never really worked in IP_TRANSPARENT mode. I've attached two patches I've just submitted to netdev, which should solve your problem. I'm Ccing the tproxy list as well. On Mon, 2008-11-17 at 21:21 +0200, elyasaf wrote: > You are right that in my isolate example was a bug > Now I add transparenty and its continue to be "Invalid argument" (but > without transparenty it work fine) > Its some how really work before the patch, and I cant see any reason why, > the patch seen clean and not related... > > int main(int argc, char *argv[]) { > char buf[5]="aaaa"; > struct sockaddr_in source,destination; > source.sin_family = AF_INET; > source.sin_addr.s_addr = inet_addr("10.0.0.26"); > source.sin_port = htons(INADDR_ANY); > > destination.sin_family = AF_INET; > destination.sin_port = htons(1500); > destination.sin_addr.s_addr = inet_addr("10.0.0.2"); > send_to_transparenty(buf,4,&source,&destination); > } > > int send_to_transparenty(char *buf,int len,struct sockaddr_in *source,struct > sockaddr_in *destination){ > int fd=socket(AF_INET, SOCK_DGRAM, 0); > int flags=1; > if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &flags, sizeof(int)) == > -1){ > perror("destination-setsockopt() IP_TRANSPARENT error!"); > return; > }else{ > printf("destination-setsockopt IP_TRANSPARENT is OK...\n"); > } > setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &flags, sizeof(flags)); > setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &flags, sizeof(flags)); > if(bind (fd, (struct sockaddr *) source,sizeof(*source))==-1){ > perror("destination-bind() error!"); > return; > } > flags=0; > if(sendto(fd,buf,len,flags,(struct sockaddr > *)destination,sizeof(*destination))==-1){ > perror("destination-sendto() error!"); > return; > } > close(fd); > } > > execve("./udpserver", ["./udpserver"], [/* 31 vars */]) = 0 > brk(0) = 0x602000 -- Bazsi

1 0

Re: [tproxy] [PATCH] [TPROXY] implemented IP_RECVORIGDSTADDR socket option
by elyasaf 16 Nov '08

16 Nov '08

Last week spoofing UDP work fine (before I try UDP patch - https://lists.balabit.hu/pipermail/tproxy/2008-November/000999.html) But now I get: " destination-sendto() error:Invalid argument" (I can achieve the source and destination IP for "UDP server") I use tproxy 4.1 kernel: 2.6.25 The code (that work fine before the above patch): int fd=socket(AF_INET, SOCK_DGRAM, 0); int flags=1; if (setsockopt(fd, SOL_IP, IP_TRANSPARENT, &flags, sizeof(int)) == -1){ perror("destination-setsockopt() IP_TRANSPARENT error!"); return; }else{ printf("destination-setsockopt IP_TRANSPARENT is OK...\n"); } setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &flags, sizeof(flags)); setsockopt(fd, SOL_SOCKET, SO_BROADCAST, &flags, sizeof(flags)); if(bind (fd, (struct sockaddr *) source,sizeof(*source))==-1){ perror("destination-bind() error!"); return; } flags=0; if(sendto(fd,buf,len,flags, (struct sockaddr *)destination, sizeof(*destination))==-1){ perror("destination-sendto() error"); return; } close(fd); Any Advice?

2 1

Re: [tproxy] [PATCH] [TPROXY] implemented IP_RECVORIGDSTADDR socket option
by Balazs Scheidler 14 Nov '08

14 Nov '08

On Thu, 2008-11-13 at 12:21 -0800, David Stevens wrote: > I know it's not part of your patch, but what about turning that into > an array of function pointers and a loop, as code cleanup? > > +-DLS > > I could do that if I get a positive feedback from DaveM, that the sockopt itself is ok. (functionally it was already tested independently from me) -- Bazsi

1 0