- tproxy - lists.balabit.hu

problem with tproxy and iptables
by nantenaina Tianarivo 25 Feb '08

25 Feb '08

Hello everybody, I am tring to make tproxy work with our squid but I have a problem with the iptable to redirect traffic to squid now. I have compiled a linux kernel 2.6.22.18 patched with tproxy-4.0.3-2.6.22. and iptable 1.3.8. For squid, i'am using Version 2.6.STABLE5. I think my kernel is well compiled because I see all the tproxy module loaded : proxy:/usr/src/linux# lsmod | grep -i proxy xt_tproxy 1984 0 xt_TPROXY 1984 1 iptable_tproxy 6468 2 xt_TPROXY ip_tables 12420 2 iptable_filter,iptable_tproxy x_tables 14564 5 ipt_LOG,xt_tcpudp,xt_tproxy,xt_TPROXY,ip_tables My iptables rules is like this : iptables -t tproxy -A PREROUTING -p tcp -m tcp -i gre1 --dport 80 -j LOG iptables -t tproxy -A PREROUTING -p tcp -m tcp -i gre1 --dport 80 -j TPROXY --on-port 80 when I check it with tcpdump, I see traffic for http port on the gre1 interface proxy:/usr/src/linux# tcpdump -n -i gre1 tcpdump: WARNING: arptype 778 not supported by libpcap - falling back to cooked socket tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on gre1, link-type LINUX_SLL (Linux cooked), capture size 96 bytes 13:10:51.437856 IP 62.56.240.17.3200 > 84.16.80.10.80: . ack 3247536657 win 2264 <nop,nop,timestamp 24199037 1582152> 13:10:51.492666 IP 62.56.240.17.3199 > 84.16.80.10.80: . ack 3204902926 win 3604 <nop,nop,timestamp 24199051 1582156> 13:10:51.523999 IP 62.56.240.17.3198 > 84.16.80.10.80: . ack 3189913679 win 16022 <nop,nop,timestamp 24199058 1582173> when I check it on access.log of my squid, my requests are actually sent to the squid. But it is not the client ip which is sent to the Internet but the squid box IP. when I issue iptables-save -c command to check if there are traffic that enter my iptables rule, the counter so zero traffic. proxy:/usr/src/linux# iptables-save -t tproxy -c # Generated by iptables-save v1.3.8 on Wed Feb 20 13:07:45 2008 *tproxy :PREROUTING ACCEPT [128:11992] [0:0] -A PREROUTING -i gre1 -p tcp -m tcp --dport 80 -j LOG [0:0] -A PREROUTING -i gre1 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 --on-ip 0.0.0.0 COMMIT even the LOG don't tell me anything about traffic in gre1 interfaces. what I see in the log is this error that appear from time to time: Feb 20 13:08:31 proxy squid[2353]: parseHttpRequest: NF getsockopt(SO_ORIGINAL_DST) failed: (92) Protocol not available Feb 20 13:08:31 proxy squid[2353]: tproxy ip=62.56.240.17,0x11f0383e,port=0 ERROR ASSIGN Can anyone tell me why my iptables don't redirect the traffic to the squid? Best Regards Nantenaina Tianarivo Sys Admin Blueline ------------------- Today is what happened to yesterday.

4 8

tproxy and squid-3.0.STABLE1-20080220
by Remzi AKYUZ 20 Feb '08

20 Feb '08

Hello, I want to try squid 3 and tproxy. ./configure --prefix=/home/squid3/tproxy-test --with-filedescriptors=16384 --enable-x-accelerator-vary --enable-linux-tproxy --enable-linux-netfilter ... checking if Linux (Netfilter) kernel header files are installed... yes checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ ... I installed tproxy-4.0.3-2.6.22 to kernel and iptables. how can install tproxy headers files? Thank for your time. Remzi

2 1

Does TPROXY work on a bridge without IP address?
by Liang Bin 20 Feb '08

20 Feb '08

Hi all, I am Bryan Liang, a newbie to TPROXY. I am using TPROXY 2.0.6 with kernel 2.6.20.21. It works fine in router mode. I am going to run TPROXY in bridge mode. Here is my linux box setting. eth0: local admin port, IP address: 192.168.43.130, netmask 255.255.255.0, default gw 192.168.43.1 eth1 and eth2 belong to br0 (bridge device) br0: IP address: 0.0.0.0 This means I can use eth0 as admin port to manage my linux box. And I do not assign IP address to bridge interface. My problem is, does TPROXY work on a bridge without IP address? Thank you in advance. :) Thanks, -Bryan

3 3

tproxy 4.1.0 and FWMARK
by Ming-Ching Tiew 19 Feb '08

19 Feb '08

OK I could confirm that the SNAT patch provided seems to work for me. I have more questions on tproxy 4.1.0 and FWMARK :- > iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ > --tproxy-mark 0x1/0x1 -on-port 3128 > iptables -t mangle -N DIVERT > iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT > iptables -t mangle -A DIVERT -j MARK --set-mark 1 > iptables -t mangle -A DIVERT -j ACCEPT > > ip rule add fwmark 1 lookup 100 > ip route add local 0.0.0.0/0 dev lo table 100 If I have to do split access on outgoing traffic into multiple interfaces, I would already have use FWMARK in one way or other. For example, for split outgoing access, I would have already mark traffic going out to eth0 with FWMARK 5, and traffic going out to eth1 with FWMARK 7. And I would already have these rules :- ip rule add fwmark 5 lookup 120 ip rule add fwmark 7 lookup 130 ( And table 120 will default route to gateway belonging to interface 1 and table 130 will default route to gateway belonging to interface 2 ). So how could I incorporate the tproxy mark into my existing use of FWMARK ? Regards.

2 1

Tproxy and squid
by Brian Møller 14 Feb '08

14 Feb '08

Hello there I'm in the process of setting up a filtering bridge for my work. I want to use Squid via url_redirect-option to do the filtering. I want to se the source ip of the clients on the webservers because of som logging isues and because the clients come from different subnets and stuff like that I cant do anything against. I'm a little confused when it comes to the versions of tproxy / cttproxy that I should use. >From what I can read squid doesn't support tproxy4 so i have to use cttproxy. Am I correct in that assumption? If I'm i have a question: I have compiled my kernel (2.6.20) with this patch-set: http://www.balabit.com/downloads/files/tproxy/obsolete/linux-2.6/cttproxy-2… And also IPTables 1.3.8 with the same patch-set After that I have compiled squid-2.6.STABLE18 --enable-linux-tproxy after copy'ing one or two .h-files to the right directory. My squid.conf can be seen in the bottom of this email. The bridge is working, traffic is flowing as it should, and the traffic is redirected nicely after running this command: /usr/local/sbin/iptables -t tproxy -A PREROUTING -p tcp -m tcp --dport 80 -j TPROXY --on-port 3128 But now it is the IP of the proxy that gets into the logs of the webservers. Have I missed something or might there be /Brian access_log /var/log/squid/access.log squid acl CONNECT method CONNECT acl QUERY urlpath_regex cgi-bin \? acl SSL_ports port 443 acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 21 # ftp acl Safe_ports port 210 # wais acl Safe_ports port 280 # http-mgmt acl Safe_ports port 443 # https acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 70 # gopher acl Safe_ports port 777 # multiling http acl Safe_ports port 80 # http acl all src 0.0.0.0/0.0.0.0 acl apache rep_header Server ^Apache acl localhost src 127.0.0.1/255.255.255.255 acl manager proto cache_object acl our_networks src 192.168.0.0/16 10.0.0.0/8 acl to_localhost dst 127.0.0.0/8 broken_vary_encoding allow apache cache deny QUERY cache_dir null /null cache_log /var/log/squid/cache.log cache_mem 256 MB cache_store_log none coredump_dir /var/log/squid/cache dns_nameservers 10.30.17.73 10.30.17.71 forwarded_for off hierarchy_stoplist cgi-bin ? http_access allow manager localhost http_access allow our_networks http_access deny !Safe_ports http_access deny CONNECT !SSL_ports http_access deny all http_access deny manager http_port 3128 transparent tproxy icp_access allow all logfile_rotate 10 refresh_pattern . 0 20% 4320 refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 tcp_outgoing_address 10.30.17.45 url_rewrite_children 30 url_rewrite_program /usr/bin/squidGuard via off

2 1

tproxy 4.1.0 and kernel 2.6.24
by Ming-Ching Tiew 07 Feb '08

07 Feb '08

tproxy 4.1.0 on kernel 2.6.24 is not working and I haven't tested any other kernel version :- Issues ====== 1. Failed to compile. I fixed the compilation problem by taking two of the patches from 2.6.25 and apply them onto 2.6.24, namely netfilter_ip_route_me_harder patch and inet_sock_and_route_dependency.patch. 2. socket in IP_TRANSPARENT mode failed to received return packets both in bridge mode and nat mode. According to the docs, I have executed this script :- iptables -t mangle -F iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY \ --tproxy-mark 0x1/0x1 -on-port 3128 iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT They were executed without any error. 3. In the bridge mode case, when I execute a simple 'ip spoofing' program ( which I posted here previously, but I changed IP_FREEBIND to IP_TRANSPARENT ), there packets appearing in the DIVERT target and the TPROXY target, but they are delivered to the machined which IP has been spoofed ( by right they are supposed to be delivered locally to the spoofing program ). 4. In the nat mode, packets leaving the interface SNAT-ed and so there are reply packets however the local socket program is not receiving either. Packets do not hit the DIVERT and TPROXY targets at all, ie the iptables counter return 0 bytes. 5. When I execute ebtables commands on the br0 interface, there will be kernel panic. Example of the commands which can cause panic :- ebtables -t broute -A BROUTING --logical-in br0 -p ipv4 --ip-protocol tcp \ --ip-destination-port 80 -j redirect --redirect-target ACCEPT Regards. -------------------------------------------- Important Warning! *************************** This electronic communication (including any attached files) may contain confidential and/or legally privileged information and is only intended for the use of the person to whom it is addressed. If you are not the intended recipient, you do not have permission to read, use, disseminate, distribute, copy or retain any part of this communication or its attachments in any form. If this e-mail was sent to you by mistake, please take the time to notify the sender so that they can identify the problem and avoid any more mistakes in sending e-mail to you. The unauthorised use of information contained in this communication or its attachments may result in legal action against any person who uses it.

2 4

and error from tproxy
by Kamran Sarkary 30 Jan '08

30 Jan '08

I have installed tproxy 2.6.18 and squid 2.6.17 with tproxy enabled on my box everything is fine and look working but invalid IPs, i have should nat invalid IPs in my linux box and i have error in squid and they cant open the page. thanks for your ealest response

1 0

TPROXY_ASSIGN fails with File exists
by Pranav Desai 28 Jan '08

28 Jan '08

Hello All, I am testing with the example code foreign-tcp-connect on kernel-2.6.20.15/cttproxy-2.0.6 When I run the sample in quick successions, I get this message in /var/log/messages and program returns with errno 17 (File exists). IP_TPROXY: socket already assigned, reuse=0, e101a8c0:0f27, sr->faddr=c000010a:d007, flags=210000, sr->tv_hashed=1201103313:191693969 Is it ok to add a check to ignore this ? -- ------------------------------ http://pd.dnsalias.org

2 5

Fw: Tproxy4, fwmark and netfilter route_me_harder
by Ming-Ching Tiew 21 Jan '08

21 Jan '08

Forwarded here just in case some of you are not in netfilter-devel list. ----- Original Message ----- From: "Patrick McHardy" <kaber(a)trash.net> To: "Ming-Ching Tiew" <mingching.tiew(a)redtone.com> Cc: <netfilter-devel(a)vger.kernel.org>; <tproxy(a)lists.balabit.hu> Sent: Sunday, January 20, 2008 11:31 PM Subject: Re: Tproxy4, fwmark and netfilter route_me_harder > Ming-Ching Tiew wrote: > > I sort of just forward this to netfilter-devel. > > > > For those who in netfilter-devel but not in tproxy mail list, a little > > background here :- > > > > I discovered after applying the tproxy4 patch which allows one to spoof > > originating traffic with a foreign IP address ( for the purpose of doing > > transparent proxy ) that after doing it, traffics with foreign IP will > > not leave the system if there is a FWMARK in the mangle table OUTPUT > > chain. Any MARK will screw up the routing. > > > > And the patch above seems to be able to get the packets out of the machine > > again. > > > > So the motivation here perhaps someone here could throw some light as to > > how this situation is best handled. > > > IIRC the current TPROXY patches use a flag in the dst_entry > to indicate that the source address is non-local. So > ip_route_me_harder should probably check that flag and > use routing for foreign addresses for that case. > - -------------------------------------------- Important Warning! *************************** This electronic communication (including any attached files) may contain confidential and/or legally privileged information and is only intended for the use of the person to whom it is addressed. If you are not the intended recipient, you do not have permission to read, use, disseminate, distribute, copy or retain any part of this communication or its attachments in any form. If this e-mail was sent to you by mistake, please take the time to notify the sender so that they can identify the problem and avoid any more mistakes in sending e-mail to you. The unauthorised use of information contained in this communication or its attachments may result in legal action against any person who uses it.

1 0

Tproxy4, fwmark and netfilter route_me_harder
by Ming-Ching Tiew 17 Jan '08

17 Jan '08

KOVACS Krisztian wrote: > Hi, > > On szo, jan 12, 2008 at 11:47:44 +0800, Ming-Ching Tiew wrote: > >> 2 ) IP FREEBIND packets spoofed with foreign source address will not >> leave the system when there is a FWMARK in the mangle table OUTPUT >> chain. This patch is created by me based on the information given by >> Kovacs, code quality is highly questionable as I barely understood >> what's it is all about, but it seems to work. >> >> --- linux-2.6.22-org/net/ipv4/netfilter.c 2007-12-13 >> 20:55:45.000000000 +0800 >> +++ linux-2.6.22-new/net/ipv4/netfilter.c 2007-12-13 >> 20:55:03.000000000 +0800 >> @@ -24,7 +24,7 @@ >> /* some non-standard hacks like ipt_REJECT.c:send_reset() can cause >> * packets with foreign saddr to appear on the NF_IP_LOCAL_OUT hook. >> */ >> - if (addr_type == RTN_LOCAL) { >> +// if (addr_type == RTN_LOCAL) { >> fl.nl_u.ip4_u.daddr = iph->daddr; >> if (type == RTN_LOCAL) >> fl.nl_u.ip4_u.saddr = iph->saddr; >> @@ -37,10 +37,10 @@ >> /* Drop old route. */ >> dst_release((*pskb)->dst); >> (*pskb)->dst = &rt->u.dst; >> - } else { >> +// } else { >> /* non-local src, find valid iif to satisfy >> * rp-filter when calling ip_route_input. */ >> - fl.nl_u.ip4_u.daddr = iph->saddr; >> +/* fl.nl_u.ip4_u.daddr = iph->saddr; >> if (ip_route_output_key(&rt, &fl) != 0) >> return -1; >> >> @@ -53,7 +53,7 @@ >> dst_release(&rt->u.dst); >> dst_release(odst); >> } >> - >> +*/ >> if ((*pskb)->dst->error) >> return -1; >> > > We should probably first ask on netfilter-devel@ why this whole route > lookup thing is necessary... > > I sort of just forward this to netfilter-devel. For those who in netfilter-devel but not in tproxy mail list, a little background here :- I discovered after applying the tproxy4 patch which allows one to spoof originating traffic with a foreign IP address ( for the purpose of doing transparent proxy ) that after doing it, traffics with foreign IP will not leave the system if there is a FWMARK in the mangle table OUTPUT chain. Any MARK will screw up the routing. And the patch above seems to be able to get the packets out of the machine again. So the motivation here perhaps someone here could throw some light as to how this situation is best handled. Regards.

1 0