- tproxy - lists.balabit.hu

Tproxy changes for performing dual NAT
by Arun S 15 Oct '07

15 Oct '07

Hi Bazsi, Thank you for a nice work that provides real transparency to both web users and web servers. :) I am using cttproxy v2.0.6 on linux kernel v2.6.18.1 along with Squid v2.6. Cttproxy is used to provide transparency to both web server and client and also to cache web requests. Sometimes it is required to SNAT HTTP traffic that is not possible with Cttproxy-v2.0.6; since double NAT is not possible. Here is a patch attached to solve that issue. This patch helps to perform SNAT in POSTROUTING chain of TPROXY table as well as in POSTROUTING chain of NAT table. Can you please validate this patch let me know your concerns. -- Regards, Arun S.

3 4

Fwd: Tproxy changes for performing dual NAT
by Arun S 15 Oct '07

15 Oct '07

May be others could help you on this.. forgot to copy to tproxy list. ---------- Forwarded message ---------- From: Arun S <hi2arun(a)gmail.com> Date: 11 Oct 2007 16:30 Subject: Re: [tproxy] Tproxy changes for performing dual NAT To: "Sunday A. Idajili [ITClick Lagos]" <sonny(a)itclick.net> Yes Sonny, you can very well use cttproxy2 for your purpose. :) On 11/10/2007, Sunday A. Idajili [ITClick Lagos] <sonny(a)itclick.net> wrote: > Arun, > > Thanks! This must be the problem am having. I will rebuild my kernel based > on cttproxy2. I appreciate your feedback. > > Sonny. > > -----Original Message----- > From: Arun S [mailto:hi2arun@gmail.com] > Sent: Thursday, October 11, 2007 7:03 AM > To: Sunday A. Idajili [ITClick Lagos] > Subject: Re: [tproxy] Tproxy changes for performing dual NAT > > Hi, > > AFAIK tproxy4 is just a replacement for the conventional REDIRECT rule. > > Cttproxy2 provides the real transparency that you mentioned. > > Arun. > > On 11/10/2007, Sunday A. Idajili [ITClick Lagos] <sonny(a)itclick.net> wrote: > > Arun, > > > > For use with squid 2.6, what is the main difference between cttproxy2 and > > tproxy4? Still trying to find my feet getting tproxy4 to provide real > > transparency with squid. Any pointer will help > > > > Sonny. > > > > -----Original Message----- > > From: tproxy-bounces(a)lists.balabit.hu > > [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of Arun S > > Sent: Wednesday, October 10, 2007 12:08 PM > > To: Tproxy > > Subject: Re: [tproxy] Tproxy changes for performing dual NAT > > > > Hi Bazsi, > > > > The patch was not included with the previous mail. > > > > Please find the patch in text format. > > > > > > > > On 10/10/2007, Arun S <hi2arun(a)gmail.com> wrote: > > > Hi Bazsi, > > > > > > Thank you for a nice work that provides real transparency to both web > > > users and web servers. > > > > > > :) > > > > > > I am using cttproxy v2.0.6 on linux kernel v2.6.18.1 along with Squid > > v2.6. > > > > > > Cttproxy is used to provide transparency to both web server and client > > > and also to cache web requests. > > > > > > Sometimes it is required to SNAT HTTP traffic that is not possible > > > with Cttproxy-v2.0.6; since double NAT is not possible. > > > > > > Here is a patch attached to solve that issue. > > > > > > This patch helps to perform SNAT in POSTROUTING chain of TPROXY table > > > as well as in POSTROUTING chain of NAT table. > > > > > > Can you please validate this patch let me know your concerns. > > > > > > -- > > > Regards, > > > Arun S. > > > > > > > > > > > > -- > > Regards, > > Arun S. > > > > > > > > > -- > Regards, > Arun S. > > > -- Regards, Arun S. -- Regards, Arun S.

2 1

Re: [tproxy] Tproxy changes for performing dual NAT
by zulkarnain 12 Oct '07

12 Oct '07

Hi Arun, I my kernel-2.6.19.7 with your patch and seemed it won't work. I got this messages below and I attached you iptable_tproxy.c.rej [root@squid linux]# patch -p1 -i ../07-linux_aircell_tproxy.patch patching file include/linux/netfilter_ipv4/ip_tproxy.h patching file net/ipv4/netfilter/ip_tables.c Hunk #7 succeeded at 245 (offset -2 lines). patching file net/ipv4/netfilter/iptable_tproxy.c Hunk #1 succeeded at 43 with fuzz 2 (offset -2 lines). Hunk #2 FAILED at 145. Hunk #3 succeeded at 120 with fuzz 2 (offset -79 lines). Hunk #4 FAILED at 647. Hunk #5 succeeded at 831 (offset -4 lines). Hunk #6 succeeded at 798 (offset -79 lines). Hunk #7 succeeded at 896 (offset -4 lines). Hunk #8 succeeded at 837 (offset -79 lines). Hunk #9 FAILED at 916. patch unexpectedly ends in middle of line Hunk #10 succeeded at 993 with fuzz 1 (offset -34 lines). 3 out of 10 hunks FAILED -- saving rejects to file net/ipv4/netfilter/iptable_tproxy.c.rej [root@squid linux]# Do you have a patch that work with kernel-2.6.19.7? Any help would be great. Thanks! Regards, Zul ----- Original Message ---- From: Arun S <hi2arun(a)gmail.com> To: zulkarnain <sizulku(a)yahoo.com> Cc: Tproxy <tproxy(a)lists.balabit.hu> Sent: Friday, October 12, 2007 6:40:52 AM Subject: Re: [tproxy] Tproxy changes for performing dual NAT Hi Zul, Here are the steps to be followed: 1. Apply Cttproxyv2.0.6 to linux kernel v2.6.18 2. Apply the given patch for dual NAT 3. Compile the kernel as usual with TPROXY support enabled. 4. Run Squid (I have tested it with Squid v 2.6) with tproxy related options enabled. 5. Add TPROXY rule to redirect HTTP packets: e.g.: iptables -t tproxy -A PREROUTING -p tcp --dport 80 -j TPROXY --on-port 3128 [Assuming Squid proxy listens on port 3128] 6. Add POSTROUTING rule for performing SNAT. e.g. Say LAN network is 192.168.1.0/24, iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to <Src IP> Please let me know of any issues along with the kernel version , Squid version, iptables rules and your test setup. ____________________________________________________________________________________ Don't let your dream ride pass you by. Make it a reality with Yahoo! Autos. http://autos.yahoo.com/index.html

2 1

Re: [tproxy] Tproxy changes for performing dual NAT
by zulkarnain 12 Oct '07

12 Oct '07

> On 10/10/2007, Arun S <hi2arun(a)gmail.com> wrote: > Hi Bazsi, > > Sometimes it is required to SNAT HTTP traffic that is not possible > with Cttproxy-v2.0.6; since double NAT is not possible. > > Here is a patch attached to solve that issue. > > This patch helps to perform SNAT in POSTROUTING chain of TPROXY table > as well as in POSTROUTING chain of NAT table. > > Can you please validate this patch let me know your concerns. Hi Arun, I'm having problem to perform dual NAT using your patch. Would you please be more detail and give some example how to use it? Thanks! Regards, Zul ____________________________________________________________________________________ Boardwalk for $500? In 2007? Ha! Play Monopoly Here and Now (it's updated for today's economy) at Yahoo! Games. http://get.games.yahoo.com/proddesc?gamekey=monopolyherenow

2 1

missing ip_tproxy.h header file
by Sunday A. Idajili [ITClick Lagos] 23 Sep '07

23 Sep '07

Hi I need help with tproxy. Am trying to get it to work with squid-2.6.STABLE16 but I get the popular missing ip_tproxy.h header file error while compiling: "checking if TPROXY header files are installed... no WARNING: Cannot find TPROXY headers, you need to install the tproxy package from: - lynx http://www.balabit.com/downloads/tproxy/ " I run Debian with kernel 2.6.22 compiled with tproxy 4.0.3 support already. I followed the instruction for patching the kernel and iptables-1.3.8. I can load the iptable_tproxy module: candy:~# modprobe iptable_tproxy candy:~# lsmod Module Size Used by iptable_tproxy 6404 0 ip_tables 11592 1 iptable_tproxy ipv6 225508 12 dm_snapshot 16416 0 dm_mirror 19712 0 dm_mod 50624 2 dm_snapshot,dm_mirror 8021q 18952 0 xt_tproxy 2048 0 x_tables 14084 2 ip_tables,xt_tproxy reiserfs 216832 1 loop 16260 0 pcspkr 2944 0 rtc 11672 0 i2c_piix4 8460 0 i2c_core 23696 1 i2c_piix4 ext3 118792 1 jbd 49832 1 ext3 sd_mod 27280 5 aic7xxx 160600 3 scsi_transport_spi 23296 1 aic7xxx scsi_mod 134540 3 sd_mod,aic7xxx,scsi_transport_spi tulip 47776 0 candy:~# dmesg | grep TPROX IP_TPROXY: Transparent proxy support initialized, version 4.0.0 IP_TPROXY: Copyright (c) 2002-2007 BalaBit IT Ltd. I can add iptables rule with tproxy without any problem: candy:~# iptables -t tproxy -A PREROUTING -j TPROXY --on-port 3128 candy:~# iptables -t tproxy -L Chain PREROUTING (policy ACCEPT) target prot opt source destination TPROXY all -- anywhere anywhere TPROXY redirect 0.0.0.0:3128 candy:~# My problem is the missing ip_tproxy.h file. Its not anywhere in my /usr/src/linux. I have searched everywhere for a solution the past 7 days with no luck. Please help me as am flat out of ideas! Thanks in advance. Sonny.

3 2

Stunnel 4 on linux 2.6.22
by Mike Mattice 20 Sep '07

20 Sep '07

This strace shows my (albeit hacked up) work attempting to get stunnel to play with tproxy support. strace obviously doesn't know how to interpret the IP_FREEBIND passed to setsockopt, but other than that, it's not throwing an error there. Stunnel uses the EINPROGRESS error as a signal to attempt the next ip in the list (if it has one) so it just ends up resetting a perfectly good connection every time. We're using tproxy 4.0.2-2.6.22 Do we _have_ to patch iptables and set up the tproxy stuff there in order to do the tproxy freebind stuff? Thanks... 779 socket(PF_INET, SOCK_STREAM, IPPROTO_IP) = 8 779 fcntl64(8, F_GETFL) = 0x2 (flags O_RDWR) 779 fcntl64(8, F_SETFL, O_RDWR|O_NONBLOCK) = 0 779 setsockopt(8, SOL_IP, 0xf /* IP_??? */, [1], 4) = 0 779 bind(8, {sa_family=AF_INET, sin_port=htons(60413), sin_addr=inet_addr("172.16.200.249")}, 16) = 0 779 connect(8, {sa_family=AF_INET, sin_port=htons(514), sin_addr=inet_addr("127.0.0.1")}, 16) = -1 EINPROGRESS (Operation now in progress)

2 1

iptables 1.3.8 problem
by Vects 20 Sep '07

20 Sep '07

Hello there, I have some problem with iptables 1.3.8, please point me out where's my error is. I took latest tproxy patches, applied them on kernel 2.6.22.6 and iptables 1.3.8 according to README, I used iptables-1.3.8.diff for iptables-1.3.8.diff but can't add any iptables rules with TPROXY for some reasons. Here's some details about my set up module is loaded # dmesg | grep TPROX IP_TPROXY: Transparent proxy support initialized, version 4.0.0 IP_TPROXY: Copyright (c) 2002-2007 BalaBit IT Ltd. module is loaded # lsmod | grep proxy iptable_tproxy 7620 0 ip_tables 20840 3 iptable_nat,iptable_tproxy,iptable_filter list of rules # iptables -t tproxy -L -n Chain PREROUTING (policy ACCEPT) target prot opt source destination iptables has failed # iptables -t tproxy -A PREROUTING -j TPROXY --on-port 80 iptables: No chain/target/match by that name I guess I missed something, please advise. Thanks, Alexc

2 3

tproxy4 future
by Balazs Scheidler 18 Sep '07

18 Sep '07

Hi, As some of you might know, the 5th Netfilter Developer's Workshop took place last week in Karlsruhe, Germany. Krisztian Kovacs (hidden) and me attended the workshop and tried to merge the somewhat diverged work on tproxy4. The fork of the tproxy code was caused by a change of maintenance, thus some of the latest work of Krisztian was left out from the latest 4.0.x patches released by Panther. (more exactly the "socket" match and the mark based diversion code). On the workshop we merged our efforts again in order to get acceptance of the Linux net/netfilter maintainers. (DaveM and Patrick McHardy). This will again change the way tproxy should be used. Sorry for breaking compatibility again, and the whole confusion, hopefully the results will be a tproxy functionality merged in the Linux kernel. :) The most important changes relative to the current 4.0.x patches are: * the tproxy table is gone, TPROXY targets need to be added to the mangle table instead * the tproxy match is gone, a new "socket" match is introduced * instead of using a separate routing trick to divert packets to the local IP stack inside the TProxy target, we are now using stock routing decisions, and need a bit in the packet MARK field, and perform diversion by using an advanced routing rule. * instead of IP_FREEBIND we are using a setsockopt named IP_TRANSPARENT which requires CAP_NET_ADMIN privilege * in previous patches the output routing decision was commented out, it is now correctly decided whether a packet belongs to a tproxied connection or not. These are the major changes, now here's a script that demonstrates TProxy usage: 1) create advanced routing rules We are using the lowest bit of the packet MARK value to indicate that the packet was diverted by the TProxy code. The exact bit value can be changed. Commands to set this up: ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 2) create TProxy rules in the mangle table # create a chain named DIVERT iptables -t mangle -N DIVERT # everything that matches "-m socket" should go to the local stack iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT # connections to be redirected should use the TPROXY target, which sets # up redirection, and marks the packet according to its 'tproxy-mark' # argument iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 # DIVERT chain: mark packets and accept iptables -t mangle -A DIVERT -j MARK --set-mark 1 iptables -t mangle -A DIVERT -j ACCEPT The ruleset would be much simpler if iptables would support ebtables like multiple targets, which it is going to. In that case the rules would become: iptables -t mangle -A PREROUTING -p tcp -m socket -j MARK --set-mark 1 -j ACCEPT iptables -t mangle -A PREROUTING -p tcp --dport 80 j MARK --set-mark 1 -j TPROXY --on-port 50080 Hopefully this will also be implemented soon. I have done some functionality testing on the patchset, and things like redirection did work. We'll start some more testing this week, however more tests never hurt. We'd appreciate if someone could help us with testing. The latest patchset is available at: http://home.sch.bme.hu/~piglet/netfilter/tproxy/ Some documentation and manual pages are still missing, but we are working on that issue as well. -- Bazsi

3 6

TProxy version 4.0.3 released
by Laszlo Attila Toth 17 Sep '07

17 Sep '07

Hello, TProxy version 4.0.3 has been released for Linux 2.6.22 The release tarball is available here: http://www.balabit.com/downloads/files/tproxy/ MD5 checksum: c4d9808a205160575945db47da8d75c5 tproxy-4.0.3-2.6.22.tgz It contains diff for iptables-1.3.8 and iptables-svn r7047. The iptables-svn.diff patch doesn't work with the old version of iptables (1.3.8) beceause it doesn't yet support xtables. -- Panther

1 0

libxt_TPROXY.c not compiling on iptables-1.3.8
by Romie Djapri 17 Sep '07

17 Sep '07

Hi, I'm a new member in this list. I want to try to use TPROXY. And I downloaded iptables-1.3.8 and patch it against tproxy-4.0.2-2.6.22 from balabit download website. It patched successfully, but it will not compile the libxt_TPROXY.c. I've read the archive and Laszlo attached the fixed for Lachlan about the same question as mine. Can I get the patch too ? Thank you. Best regards, Romie Djapri

2 1