- tproxy - lists.balabit.hu

[PATCH] [TPROXY] implemented IP_RECVORIGDSTADDR socket option
by Balazs Scheidler 13 Nov '08

13 Nov '08

In case UDP traffic is redirected to a local UDP socket, the originally addressed destination address/port cannot be recovered with the in-kernel tproxy. This patch adds an IP_RECVORIGDSTADDR sockopt that enables a IP_ORIGDSTADDR ancillary message in recvmsg(). This ancillary message contains the original destination address/port of the packet being received. Please apply. Signed-off-by: Balazs Scheidler <bazsi(a)balabit.hu> --- include/linux/in.h | 4 ++++ net/ipv4/ip_sockglue.c | 40 +++++++++++++++++++++++++++++++++++++++- 2 files changed, 43 insertions(+), 1 deletions(-) diff --git a/include/linux/in.h b/include/linux/in.h index db458be..d60122a 100644 --- a/include/linux/in.h +++ b/include/linux/in.h @@ -80,6 +80,10 @@ struct in_addr { /* BSD compatibility */ #define IP_RECVRETOPTS IP_RETOPTS +/* TProxy original addresses */ +#define IP_ORIGDSTADDR 20 +#define IP_RECVORIGDSTADDR IP_ORIGDSTADDR + /* IP_MTU_DISCOVER values */ #define IP_PMTUDISC_DONT 0 /* Never send DF frames */ #define IP_PMTUDISC_WANT 1 /* Use per route hints */ diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 465abf0..1e70488 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -48,6 +48,7 @@ #define IP_CMSG_RECVOPTS 8 #define IP_CMSG_RETOPTS 16 #define IP_CMSG_PASSSEC 32 +#define IP_CMSG_ORIGDSTADDR 64 /* * SOL_IP control messages. @@ -126,6 +127,27 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) security_release_secctx(secdata, seclen); } +void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) +{ + struct sockaddr_in sin; + struct iphdr *iph = ip_hdr(skb); + u16 *ports = (u16 *) skb_transport_header(skb); + + if (skb_transport_offset(skb) + 4 > skb->len) + return; + + /* All current transport protocols have the port numbers in the + * first four bytes of the transport header and this function is + * written with this assumption in mind. + */ + + sin.sin_family = AF_INET; + sin.sin_addr.s_addr = iph->daddr; + sin.sin_port = ports[1]; + memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); + + put_cmsg(msg, SOL_IP, IP_ORIGDSTADDR, sizeof(sin), &sin); +} void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb) { @@ -160,6 +182,12 @@ void ip_cmsg_recv(struct msghdr *msg, struct sk_buff *skb) if (flags & 1) ip_cmsg_recv_security(msg, skb); + + if ((flags>>=1) == 0) + return; + if (flags & 1) + ip_cmsg_recv_dstaddr(msg, skb); + } int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc) @@ -421,7 +449,8 @@ static int do_ip_setsockopt(struct sock *sk, int level, (1<<IP_ROUTER_ALERT) | (1<<IP_FREEBIND) | (1<<IP_PASSSEC) | (1<<IP_TRANSPARENT))) || optname == IP_MULTICAST_TTL || - optname == IP_MULTICAST_LOOP) { + optname == IP_MULTICAST_LOOP || + optname == IP_RECVORIGDSTADDR) { if (optlen >= sizeof(int)) { if (get_user(val, (int __user *) optval)) return -EFAULT; @@ -509,6 +538,12 @@ static int do_ip_setsockopt(struct sock *sk, int level, else inet->cmsg_flags &= ~IP_CMSG_PASSSEC; break; + case IP_RECVORIGDSTADDR: + if (val) + inet->cmsg_flags |= IP_CMSG_ORIGDSTADDR; + else + inet->cmsg_flags &= ~IP_CMSG_ORIGDSTADDR; + break; case IP_TOS: /* This sets both TOS and Precedence */ if (sk->sk_type == SOCK_STREAM) { val &= ~3; @@ -1022,6 +1057,9 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname, case IP_PASSSEC: val = (inet->cmsg_flags & IP_CMSG_PASSSEC) != 0; break; + case IP_RECVORIGDSTADDR: + val = (inet->cmsg_flags & IP_CMSG_ORIGDSTADDR) != 0; + break; case IP_TOS: val = inet->tos; break; -- 1.5.4.3 -- Bazsi

2 1

Re: [tproxy] udp + tproxy
by Balazs Scheidler 13 Nov '08

13 Nov '08

On Thu, 2008-11-13 at 08:17 +0100, Jan Engelhardt wrote: > On Wednesday 2008-11-12 20:27, Balazs Scheidler wrote: > >> > >> Since tproxy 4 (unlike tproxy 2) doesn't modify the incoming packets in > >> any way you should be able to get the correct destination address by > >> simply calling recvfrom() and using the source address returned by the > >> kernel. > > > >This is not true, recvfrom() returns the client address and does not > >return the original destination. > > Mh, perhaps getsockname() could do something - well, at least > if used with accept() and as such, mostly for TCP only. > Well, here's my other mail on the subject on the tproxy list, it basically details that we do have an implementation of accept() for UDP which we use in production. But I'm not sure that could be integrated to mainline. -<- quote ->- Well, for supporting UDP with tproxy4 we use a different approach: udp_accept(), you can find it in the BalaBit kernel patch tree at http://www.balabit.com/downloads/files/kernel-patches/ The way udp_accept() works is as follows: * the userspace proxy opens a "listening" udp socket, binds it to the listening address, performs no connect() calls * tproxy redirects packets to this socket just like in the case for TCP * whenever the socket becomes readable from the userspace proxy, accept() is invoked on the UDP socket, this accept() is implemented by the patch mentioned above * in kernel space: the first packet is consulted from the socket buffer of the listening socket * the kernel opens a new UDP socket, just like the accept() call for TCP does * this new UDP socket is bound this way: * local address is the same as the destination address of the incoming packet * destination address is the same as the source address of the incoming packet * the socket buffer of the listening socket is traversed, and each packet having the same IP addresses as the first packet is moved to the newly opened socket; this traversal is happening in an atomic context, thus no new packets can arrive * a reference to the newly opened socket is returned to userspace * when a new packet comes in, the socket lookup will prefer the completely bound socket over the listening socket Since at the end of the accept() call you get a completely bound socket, you can simply call getsockname() to query the target address, just like with TCP. Hope this helps. PS: I was talking to Patrick McHardy whether to send the udp_accept() patch for kernel inclusion, he said it might be worth trying, however he was not completely sure it'd be integrated. So I didn't push it so far. -- Bazsi

1 0

udp + tproxy
by Andrey Luzgin 12 Nov '08

12 Nov '08

Hello, While I can see example of using udp on tproxy2 onto the redirect-udp-recv.c file, I can't find equivalent on tproxy4. For getting the original destination IP, I just use setsockopt IP_PKTINFO: setsockopt(sd, SOL_IP, IP_PKTINFO , &flags, sizeof(flags)); But I don't know how to get the original destination port: a) I manually defined IP_RECVORIGADDRS to be 11273 as I find on tproxy2: setsockopt(sd, SOL_IP, IP_RECVORIGADDRS , &flags, sizeof(flags)); but the setsockopt failed. b) the getsockname give me the server listening port. Here are my iptables\ip route redirection lines: ${iptables} -t mangle -N DIVERT ${iptables} -t mangle -A PREROUTING -p udp -m socket -j DIVERT ${iptables} -t mangle -A DIVERT -j MARK --set-mark 1 ${iptables} -t mangle -A DIVERT -j ACCEPT ${iptables} -t mangle -A PREROUTING -p udp --dport 1500 -j TPROXY --tproxy-mark 1 --on-port 3127 ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 What is missed? Best, Moshe

3 3

tproxy for kernel 2.6.18.6
by Victoria Muntean 12 Nov '08

12 Nov '08

Hello, What is latest version of tproxy that I can apply to kernel 2.6.18.6 ? Thanks Viki

2 1

Re: [tproxy] Where can I get the latest tproxy all patch
by Luiz Biazus 10 Nov '08

10 Nov '08

Hi, On h, nov 03, 2008 at 04:03:08 +0800, Dong Wei wrote: > I find the xt_socket in linux-2.6.28 can handle ICMP packet. I want to > port the latest tproxy kernel patch to linux-2.6.21.7. Does anyone > know where I can download it? Well, the one in the current linux-2.6 GIT tree is the most up-to-date. I also have a version for 2.6.26 which has all the features of the upstream one, you can download it from http://people.netfilter.org/hidden/tproxy/tproxy4-2.6.26-200809262032.tar.b… Hope it helps. -- KOVACS Krisztian this link does not work... have any new patch for iptables 1.4.1 and squid patches?

1 0

Where can I get the latest tproxy patch
by Dong Wei 05 Nov '08

05 Nov '08

Hi, all I checked linux-2.6.28,found TPROXY patch had been merged into linux kernel and the socket match also can handle ICMP packet. Where can I found the latest TPROXY kernel patch? Thanks in advance. -- Thanks BR. Wei Dong

2 1

A general question on xt_socket
by Arun Srinivasan 04 Nov '08

04 Nov '08

Hi all, A general question: Say I have the following rules configured: +++++++++++++++++++++++++++++ iptables -t mangle -N DIVERT iptables -t mangle -I PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A DIVERT -j MARK --set-mark 0x1 iptables -t mangle -A DIVERT -j ACCEPT ++++++++++++++++++++++++++++++++++++ In which case can the tcp packets go without hitting the rule "iptables -t mangle -I PREROUTING -p tcp -m socket -j DIVERT"? -- Regards, Arun S.

2 7

Where can I get the latest tproxy all patch
by Dong Wei 04 Nov '08

04 Nov '08

Hi, all I find the xt_socket in linux-2.6.28 can handle ICMP packet. I want to port the latest tproxy kernel patch to linux-2.6.21.7. Does anyone know where I can download it? -- Thanks BR. Wei Dong

2 1

Tproxy + squid 2.6.18STABLE + squid patch problem!
by Luiz Biazus 30 Oct '08

30 Oct '08

dear all, im trying to use the last patch for squid2.6 (tproxy-squid-2.6-STABLE18.20080304-110716-1204625236.patch ) on ubuntu 8.04 with kernel 2.6.24.6 patched! i follow this steps: #wget http://www.balabit.com/downloads/files/tproxy/tproxy-squid-2.6-STABLE18.200… #tar -xvzf squid squid-2.6.STABLE18 #cd squid-2.6.STABLE18 #cat ../tproxy-squid*.patch | patch -p1 OUTPUT: patching file configure patching file configure.in patching file src/cache_cf.c patching file src/cf_gen_defines patching file src/client_side.c patching file src/comm.c patching file src/defines.h patching file src/forward.c patching file src/globals.h patching file src/http.c patching file src/ssl.c patching file src/structs.h patching file src/tools.c # ./configure --prefix=/usr --exec_prefix=/usr --srcdir=/usr/local/src/squid-2.6.STABLE18 --bindir=/usr/sbin --sbindir=/usr/sbin --libexecdir=/usr/lib/squid --sysconfdir=/etc --localstatedir=/var/spool/squid --datadir=/usr/share/squid --with-pthreads --enable-netfilter --enable-arp-acl --enable-epoll --enable-removal-policies=lru,heap --enable-snmp --enable-delay-pools --enable-htcp --enable-cache-digests --enable-auth="basic,digest" --enable-carp --enable-follow-x-forwarded-for --with-large-files --enable-linux-tproxy --with-filedescriptors=65536 --enable-multicast-miss --disable-ident-lookups --with-maxfd=65536 everything ok until here! but when i do make.... #make make[3]: Leaving directory `/usr/local/src/squid-2.6.STABLE18/src/auth' make[3]: Entering directory `/usr/local/src/squid-2.6.STABLE18/src' gcc -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\"/etc/squid.conf\" -I. -I. -I../include -I. -I. -I../include -I../include -m64 -Wall -g -O2 -D_REENTRANT -DUNLINK_DAEMON -c ./unlinkd.c -o unlinkd-daemon.o gcc -m64 -Wall -g -O2 -D_REENTRANT -o unlinkd unlinkd-daemon.o if gcc -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\"/etc/squid.conf\" -I. -I. -I../include -I. -I. -I../include -I../include -m64 -Wall -g -O2 -D_REENTRANT -MT access_log.o -MD -MP -MF ".deps/access_log.Tpo" -c -o access_log.o access_log.c; \ then mv -f ".deps/access_log.Tpo" ".deps/access_log.Po"; else rm -f ".deps/access_log.Tpo"; exit 1; fi if gcc -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\"/etc/squid.conf\" -I. -I. -I../include -I. -I. -I../include -I../include -m64 -Wall -g -O2 -D_REENTRANT -MT acl.o -MD -MP -MF ".deps/acl.Tpo" -c -o acl.o acl.c; \ then mv -f ".deps/acl.Tpo" ".deps/acl.Po"; else rm -f ".deps/acl.Tpo"; exit 1; fi if gcc -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\"/etc/squid.conf\" -I. -I. -I../include -I. -I. -I../include -I../include -m64 -Wall -g -O2 -D_REENTRANT -MT asn.o -MD -MP -MF ".deps/asn.Tpo" -c -o asn.o asn.c; \ then mv -f ".deps/asn.Tpo" ".deps/asn.Po"; else rm -f ".deps/asn.Tpo"; exit 1; fi if gcc -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\"/etc/squid.conf\" -I. -I. -I../include -I. -I. -I../include -I../include -m64 -Wall -g -O2 -D_REENTRANT -MT authenticate.o -MD -MP -MF ".deps/authenticate.Tpo" -c -o authenticate.o authenticate.c; \ then mv -f ".deps/authenticate.Tpo" ".deps/authenticate.Po"; else rm -f ".deps/authenticate.Tpo"; exit 1; fi if gcc -DHAVE_CONFIG_H -DDEFAULT_CONFIG_FILE=\"/etc/squid.conf\" -I. -I. -I../include -I. -I. -I../include -I../include -m64 -Wall -g -O2 -D_REENTRANT -MT cache_cf.o -MD -MP -MF ".deps/cache_cf.Tpo" -c -o cache_cf.o cache_cf.c; \ then mv -f ".deps/cache_cf.Tpo" ".deps/cache_cf.Po"; else rm -f ".deps/cache_cf.Tpo"; exit 1; fi cache_cf.c:45:2: error: #error krotefa In file included from cache_cf.c:2629: cf_parser.h: In function âparse_lineâ: cf_parser.h:999: warning: passing argument 1 of âparse_ushortâ from incompatible pointer type cf_parser.h: In function âfree_allâ: cf_parser.h:1820: warning: passing argument 1 of âfree_ushortâ from incompatible pointer type make[3]: *** [cache_cf.o] Error 1 make[3]: Leaving directory `/usr/local/src/squid-2.6.STABLE18/src' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/local/src/squid-2.6.STABLE18/src' make[1]: *** [all] Error 2 make[1]: Leaving directory `/usr/local/src/squid-2.6.STABLE18/src' make: *** [all-recursive] Error 1 any one knows what´s up?! Best Rgds! Luiz Biazus

1 0

user priority to run tproxy app
by Dong Wei 30 Oct '08

30 Oct '08

Hi, All When I use tproxy app, I found that if I run the app as a normal user, the APP can't work. But if I run APP as root, it can work well. Must I use root to run the tproxy app, or just run it with a user who has the same priority as root? -- Thanks BR. Wei Dong

2 1