- tproxy - lists.balabit.hu

Re: [tproxy] tproxy Digest, Vol 27, Issue 7
by last 17 Sep '07

17 Sep '07

I have the same question! where is the patch? last 2007-09-17 发件人： tproxy-request(a)lists.balabit.hu 发送时间： 2007-09-16 18:00:22 收件人： tproxy(a)lists.balabit.hu 抄送：主题： tproxy Digest, Vol 27, Issue 7 Send tproxy mailing list submissions to tproxy(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/tproxy or, via email, send a message with subject or body 'help' to tproxy-request(a)lists.balabit.hu You can reach the person managing the list at tproxy-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of tproxy digest..." Today's Topics: 1. libxt_TPROXY.c not compiling on iptables-1.3.8 (Romie Djapri) ---------------------------------------------------------------------- Message: 1 Date: Sat, 15 Sep 2007 17:48:21 +0700 From: Romie Djapri <rmdjapri(a)tokolinux.com > Subject: [tproxy] libxt_TPROXY.c not compiling on iptables-1.3.8 To: tproxy(a)lists.balabit.hu Message-ID: <46EBB875.3060606(a)tokolinux.com > Content-Type: text/plain; charset=ISO-8859-1; format=flowed Hi, I'm a new member in this list. I want to try to use TPROXY. And I downloaded iptables-1.3.8 and patch it against tproxy-4.0.2-2.6.22 from balabit download website. It patched successfully, but it will not compile the libxt_TPROXY.c. I've read the archive and Laszlo attached the fixed for Lachlan about the same question as mine. Can I get the patch too ? Thank you. Best regards, Romie Djapri ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 27, Issue 7 *************************************

1 0

TPROXY VER4 doesn't work wih squid
by ogeb 10 Sep '07

10 Sep '07

hi, i have problem with tproxy version 4 squid -z FATAL: Bungled squid.conf line 1: http_port 3128 transparent tproxy Squid Cache (Version 2.6.STABLE16-20070906): Terminated abnormally. [ 230.176831] IP_TPROXY: Transparent proxy support initialized, version 4.0.0 [ 230.176835] IP_TPROXY: Copyright (c) 2002-2007 BalaBit IT Ltd. please advice. best regards ogeb ____________________________________________________________________________________ Need a vacation? Get great deals to amazing places on Yahoo! Travel. http://travel.yahoo.com/

2 1

libipt_TPROXY.so not compiled
by Lachlan Bowes 05 Sep '07

05 Sep '07

Have any of you seen this before? I followed instructions in README, but to no avail. Apologies if this is obvious but I am from a FreeBSD background, linux is not my normal OS so environment is foreign to me. Regards, Lachlan root@syd-log01:/root/tproxy-4.0.1-2.6.22# uname -a Linux syd-log01 2.6.22.3 #1 SMP Tue Aug 28 21:54:20 EST 2007 i686 GNU/Linux root@syd-log01:/root/tproxy-4.0.1-2.6.22# root@syd-log01:/root/tproxy-4.0.1-2.6.22# iptables -t tproxy -A PREROUTING -j TPROXY --on-port 3128 iptables v1.3.8: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. root@syd-log01:/root/tproxy-4.0.1-2.6.22# iptables -t tproxy -A PREROUTING -j TPROXY iptables v1.3.8: Couldn't load target `TPROXY':/usr/local/lib/iptables/libipt_TPROXY.so: cannot open shared object file: No such file or directory Try `iptables -h' or 'iptables --help' for more information. root@syd-log01:/root/tproxy-4.0.1-2.6.22# lsmod | grep iptable iptable_filter 3104 0 iptable_tproxy 6468 0 ip_tables 12420 2 iptable_filter,iptable_tproxy root@syd-log01:/root/tproxy-4.0.1-2.6.22#

2 7

tproxy4 and bridge
by Cameron Schaus 23 Aug '07

23 Aug '07

I have managed to resolve the problems that prevented trpoxy4 from working on a bridged interface. There were 2 issues: a) bridge netfilter code was clobbering the skb->dst added by tproxy prerouting b) changed bridge ingress packet handling routing to inspect skb->ip_tproxy flag, and if set, change dest mac to that of bridge and set skb->pkt_type to PACKET_HOST With these changes, the foreign-connect and foreign-listen test programs are working correctly. I'll post patches against the bridge code once I've validated the changes I've made -- there are a couple of things I'm still not sure about. However, I have once concern with tproxy4 and what I'm ultimately trying to accomplish. Here is the setup: Proxy application bound to a bridge interface (192.168.0.73, port 8180). Traffic destined to port 80 is redirected to the bridge IP, port 8180 with iptables. So, if a client, 192.168.0.139, connects to a server, 192.168.0.121 (all the traffic passes through the proxy bridge), the proxy application will then: - create a socket - setsockopt(sock, IP_FREEBIND) - bind(CLIENT_IP, CLIENT_SOURCE_PORT) - connect(SERVER_IP, port 80) However, the connect does not work. Syn packets are sent from the bridge to the server, the server responds with Syn-Ack, but the Syn-Ack packet triggers an ip_rt_bug message: ip_rt_bug: 192.168.0.139 -> 192.168.0.73, ? Firstly, is it possible to do what I am trying to do with tproxy4? I suspect that there may be some confusion when the routing code tries to lookup the socket, since it is using the source IP, dest IP and interface to find the socket in the hash. Won't the client and server socket look similar in this regard? How would the routing code know which of the 2 sockets an incoming packet is destined for, since all packets arrive on the bridge interface? Thanks, Cam

2 2

doing SNAT after tproxy doing IP spoofing
by Kannan Sampath 22 Aug '07

22 Aug '07

Hi, I am looking for a solution, where I want to use TPROXY to do the IP spoofing, followed by SNAT. When I tried to add a rule in POSTROUTE nat iptable for my SNAT, it is never hit. In my case, the user machine's IP addr is 10.0.0.1 <http://80.0.0.1/_>, and the IP address of the Squid machine on user side is 10.0.0.99<http://80.0.0.99/_>. User's http packet arrives Squid machine. I have already applied tproxy patch. The IP address of Squid machine's physical interface on internet side is 90.0.0.99 <http://90.0.0.99/_>. When the Squid establishes connection with internet server, lets say google.com <http://google.com/_> (IP address is 150.0.0.1 <http://150.0.0.1/_> example), then the packet has to go with SourceIP address as 70.0.0.1 I have a static SNAT for the user IP address as follows in POSTROUTE nat iptable as "10.0.0.1 <http://80.0.0.1/_> <---> 70.0.0.1 <http://70.0.0.1/_> ". i.e, After doing the IP Spoofing, we need to apply static NAT. With TPROXY, it is not working as I expected. Instead, it is sending the packet with source IP addr as 10.0.0.1. How do we resolve this issue? Thanks in advance, and sorry for the big email. Regards, Kannan.

3 2

Re: [tproxy] TPROXY + Arp Table
by Jojy Varghese 22 Aug '07

22 Aug '07

Thanks Bazsi. In a real life scenario, where my proxy server will be inside a firewall how can the proxy server make the routing decision? The trafic is always going to flow through the firewall/router and then come to the subnet having the proxy server. On Wed, 2007-08-15 at 11:01 -0700, Jojy Varghese wrote: > Hi > I was trying the example code given with the patch and couldnt get > it to work. Upon tcpdump'ing the packets, I found out that my > firewall(Cisco) sends out a ARP request for the FOREIGN IP address i > am masquerading the request as and after that the packet is dropped. > How do I get around this problem? I am sure this is nothing unusual > setting and I might be missing something fundamental here. > > Any help is much appreciated. the masquaraded IP address must be routed through the TProxy box. -- Bazsi Need a vacation? Get great deals to amazing places on Yahoo! Travel. ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

2 1

Re: [tproxy] Issue with iptables 1.3.8
by Marco Aurelio da Silva 21 Aug '07

21 Aug '07

Hello, Did you set KERNEL_DIR to your kernel source (/usr/src/linux)? Only with it can you compile libxt_TROXY, libxt_tproxy and some other modules (see extensions/.tproxy-testx) Yes, I used make KERNELDIR=/usr/src/linux, and nothing. Then I edit .tproxy-testx and point to my kernel (/usr/src/linux-2.6.22.4) and nothing. Thanks for help. Marco.

2 6

Re: [tproxy] TPROXY + Arp Table
by Jojy Varghese 21 Aug '07

21 Aug '07

Thanks Bazsi. Does it mean that the patch wont work in a WCCP configuration? Because with WCCP, the proxy cannot be the router nor can it be inline with the router. Googling on this problem led me to this link : http://wiki.squid-cache.org/ConfigExamples/FullyTransparentWithTPROXY. I am unable to figure out how Squid in WCCP mode can work with the patch. What I am trying to do is something similar. thanks again Jojy ----- Original Message ---- From: Balazs Scheidler <bazsi(a)balabit.hu> To: Jojy Varghese <jojygv(a)yahoo.com> Cc: tproxy(a)lists.balabit.hu Sent: Friday, August 17, 2007 12:14:13 AM Subject: Re: [tproxy] TPROXY + Arp Table On Thu, 2007-08-16 at 13:21 -0700, Jojy Varghese wrote: > Thanks Bazsi. In a real life scenario, where my proxy server will be > inside a firewall how can the proxy server make the routing decision? > The trafic is always going to flow through the firewall/router and > then come to the subnet having the proxy server. In order for tproxy to work the traffic must flow through the tproxy box. Either install the proxy on the firewall, or put it in-line with the firewall. That's the only way to do it. With Zorp you could script a different scenario, but I guess you are not using Zorp as a firewall. -- Bazsi ____________________________________________________________________________________ Got a little couch potato? Check out fun summer activities for kids. http://search.yahoo.com/search?fr=oni_on_mail&p=summer+activities+for+kids&…

2 1

Issue with iptables 1.3.8
by Marco Aurelio da Silva 21 Aug '07

21 Aug '07

Hy, I'm using the new version o tproxy 4.0.1 for kernel 2.6.22 and iptables 1.3.8. The patches are applyed correctly both in kernel and iptables. The modules of kernel are compiled correctly but I cant compile the library for iptables. Dont generate the .so file. Can someone help me please. Thanks, Marco.

2 1

Re: [tproxy] TPROXY + Arp Table
by Balazs Scheidler 17 Aug '07

17 Aug '07

On Thu, 2007-08-16 at 13:21 -0700, Jojy Varghese wrote: > Thanks Bazsi. In a real life scenario, where my proxy server will be > inside a firewall how can the proxy server make the routing decision? > The trafic is always going to flow through the firewall/router and > then come to the subnet having the proxy server. In order for tproxy to work the traffic must flow through the tproxy box. Either install the proxy on the firewall, or put it in-line with the firewall. That's the only way to do it. With Zorp you could script a different scenario, but I guess you are not using Zorp as a firewall. -- Bazsi

1 0