- tproxy - lists.balabit.hu

Re: [tproxy] tproxy Digest, Vol 25, Issue 9
by Sunin Thaveethamsavee 31 Jul '07

31 Jul '07

TProxy 4.0, Can applied with Squid 2.6 or 3.0 ? -----Original Message----- From: tproxy-bounces(a)lists.balabit.hu [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of tproxy-request(a)lists.balabit.hu Sent: Tuesday, July 31, 2007 6:39 PM To: tproxy(a)lists.balabit.hu Subject: tproxy Digest, Vol 25, Issue 9 Send tproxy mailing list submissions to tproxy(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/tproxy or, via email, send a message with subject or body 'help' to tproxy-request(a)lists.balabit.hu You can reach the person managing the list at tproxy-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of tproxy digest..." Today's Topics: 1. TProxy version 4.0.0 released (Laszlo Attila Toth) 2. Re: TProxy v4: xt_TPROXY (Jan Engelhardt) 3. Re: TProxy v4: xt_socket (Jan Engelhardt) 4. Re: TProxy v4: 2.6.23 addendum (Jan Engelhardt) 5. Re: TProxy v4: libxt_TPROXY (Jan Engelhardt) 6. Re: TProxy version 4.0.0 released (Jan Engelhardt) 7. Re: TProxy version 4.0.0 released (Balazs Scheidler) 8. Re: TProxy version 4.0.0 released (Jan Engelhardt) ---------------------------------------------------------------------- Message: 1 Date: Tue, 31 Jul 2007 12:31:35 +0200 From: Laszlo Attila Toth <panther(a)balabit.hu> Subject: [tproxy] TProxy version 4.0.0 released To: tproxy(a)lists.balabit.hu Message-ID: <200707311231.35194.panther(a)balabit.hu> Content-Type: text/plain; charset="utf-8" Hi, TProxy version 4.0.0 has been released for Linux 2.6.17 (Ubuntu 2.6.17.1-12.39) and 2.6.23-rc1 This is a completely rewritten version which no longer uses NAT. The release tarballs are available here: http://www.balabit.com/downloads/files/tproxy/ MD5 checksums of the tarballs: a655fd090c06827bd6927f2b894ee178 tproxy-4.0.0-2.6.23-rc1.tgz d7175531d67beaab48293cd86cac5d21 tproxy-4.0.0-ubuntu-2.6.17-12.39.tgz -- Regards, Laszlo Attila Toth ------------------------------ Message: 2 Date: Tue, 31 Jul 2007 12:37:23 +0200 (CEST) From: Jan Engelhardt <jengelh(a)computergmbh.de> Subject: Re: [tproxy] TProxy v4: xt_TPROXY To: Laszlo Attila Toth <panther(a)balabit.hu> Cc: tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.64.0707311235000.22515(a)fbirervta.pbzchgretzou.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII Looks like I should join in my modifications. === iptables TPROXY target From: KOVACS Krisztian <hidden(a)balabit.hu> The TPROXY target implements redirection of non-local TCP/UDP traffic to local sockets. It is simply a wrapper around functionality exported from iptable_tproxy. Signed-off-by: KOVACS Krisztian <hidden(a)balabit.hu> Changed to xt_TPROXY. -Jan Engelhardt <jengelh(a)gmx.de> --- include/linux/netfilter/xt_TPROXY.h | 9 ++++ net/ipv4/netfilter/Kconfig | 11 +++++ net/netfilter/Makefile | 1 net/netfilter/xt_TPROXY.c | 76 ++++++++++++++++++++++++++++++++++++ 4 files changed, 97 insertions(+) Index: linux-2.6.22.1/include/linux/netfilter/xt_TPROXY.h =================================================================== --- /dev/null +++ linux-2.6.22.1/include/linux/netfilter/xt_TPROXY.h @@ -0,0 +1,9 @@ +#ifndef _XT_TPROXY_H +#define _XT_TPROXY_H + +struct xt_tproxy_info { + u_int32_t laddr; + u_int16_t lport; +}; + +#endif /* _XT_TPROXY_H */ Index: linux-2.6.22.1/net/ipv4/netfilter/Kconfig =================================================================== --- linux-2.6.22.1.orig/net/ipv4/netfilter/Kconfig +++ linux-2.6.22.1/net/ipv4/netfilter/Kconfig @@ -403,6 +403,17 @@ config IP_NF_TPROXY_TABLE To compile it as a module, choose M here. If unsure, say `N'. +config NETFILTER_XT_TARGET_TPROXY + tristate "TPROXY target support" + depends on IP_NF_TPROXY_TABLE + help + This option adds a `TPROXY' target, which is somewhat similar to + REDIRECT. It can only be used in the tproxy table and is useful + to redirect traffic to a transparent proxy. It does _not_ depend + on Netfilter connection tracking. + + To compile it as a module, choose M here. If unsure, say N. + # ARP tables config IP_NF_ARPTABLES tristate "ARP tables support" Index: linux-2.6.22.1/net/netfilter/Makefile =================================================================== --- linux-2.6.22.1.orig/net/netfilter/Makefile +++ linux-2.6.22.1/net/netfilter/Makefile @@ -50,6 +50,7 @@ obj-$(CONFIG_NETFILTER_XT_TARGET_TRACE) obj-$(CONFIG_NETFILTER_XT_TARGET_SECMARK) += xt_SECMARK.o obj-$(CONFIG_NETFILTER_XT_TARGET_TARPIT) += xt_TARPIT.o obj-$(CONFIG_NETFILTER_XT_TARGET_TCPMSS) += xt_TCPMSS.o +obj-$(CONFIG_NETFILTER_XT_TARGET_TPROXY) += xt_TPROXY.o obj-$(CONFIG_NETFILTER_XT_TARGET_CONNSECMARK) += xt_CONNSECMARK.o # matches Index: linux-2.6.22.1/net/netfilter/xt_TPROXY.c =================================================================== --- /dev/null +++ linux-2.6.22.1/net/netfilter/xt_TPROXY.c @@ -0,0 +1,76 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2006-2007 BalaBit IT Ltd. + * Author: Balazs Scheidler, Krisztian Kovacs + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ +#include <linux/ip.h> +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/skbuff.h> +#include <linux/netfilter_ipv4/ip_tables.h> +#include <linux/netfilter_ipv4/ip_tproxy.h> +#include <linux/netfilter/xt_TPROXY.h> +#include <net/checksum.h> +#include <net/inet_sock.h> +#include <net/udp.h> + +static unsigned int +tproxy_target(struct sk_buff **pskb, const struct net_device *in, + const struct net_device *out, unsigned int hooknum, + const struct xt_target *target, const void *targinfo) +{ + const struct xt_tproxy_info *tgi = targinfo; + const struct iphdr *iph = ip_hdr(*pskb); + struct sk_buff *skb = *pskb; + struct udphdr _hdr, *hp; + + /* TCP/UDP only */ + if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP) + return NF_ACCEPT; + + hp = skb_header_pointer(*pskb, iph->ihl * 4, sizeof(_hdr), &_hdr); + if (hp == NULL) + return NF_DROP; + + skb->nf_tproxy.redirect_address = tgi->laddr ? : iph->daddr; + skb->nf_tproxy.redirect_port = tgi->lport ? : hp->dest; + + pr_debug(KERN_DEBUG "redirecting: proto %d %08x:%d -> %08x:%d\n", + iph->protocol, ntohl(iph->daddr), ntohs(hp->dest), + ntohl(skb->nf_tproxy.redirect_address), + ntohs(skb->nf_tproxy.redirect_port)); + + return NF_ACCEPT; +} + +static struct xt_target xt_tproxy_reg __read_mostly = { + .name = "TPROXY", + .family = AF_INET, + .table = "tproxy", + .target = tproxy_target, + .targetsize = sizeof(struct xt_tproxy_info), + .me = THIS_MODULE, +}; + +static int __init xt_tproxy_init(void) +{ + return xt_register_target(&xt_tproxy_reg); +} + +static void __exit xt_tproxy_exit(void) +{ + xt_unregister_target(&xt_tproxy_reg); +} + +module_init(xt_tproxy_init); +module_exit(xt_tproxy_exit); +MODULE_AUTHOR("Krisztian Kovacs <hidden(a)balabit.hu>"); +MODULE_DESCRIPTION("Netfilter transparent proxy TPROXY target module"); +MODULE_LICENSE("GPL"); +MODULE_ALIAS("ipt_TPROXY"); ------------------------------ Message: 3 Date: Tue, 31 Jul 2007 12:38:00 +0200 (CEST) From: Jan Engelhardt <jengelh(a)computergmbh.de> Subject: Re: [tproxy] TProxy v4: xt_socket To: Laszlo Attila Toth <panther(a)balabit.hu> Cc: TProxy Mailing List <tproxy(a)lists.balabit.hu> Message-ID: <Pine.LNX.4.64.0707311237400.22515(a)fbirervta.pbzchgretzou.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII iptables socket match From: KOVACS Krisztian <hidden(a)balabit.hu> Add iptables 'socket' match, which matches packets for which a TCP/UDP socket lookup succeeds. Signed-off-by: KOVACS Krisztian <hidden(a)balabit.hu> Changed to xt_socket. -Jan Engelhardt <jengelh(a)gmx.de> --- net/ipv4/netfilter/Kconfig | 10 +++++ net/netfilter/Makefile | 1 net/netfilter/xt_socket.c | 80 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 91 insertions(+) Index: linux-2.6.22.1/net/ipv4/netfilter/Kconfig =================================================================== --- linux-2.6.22.1.orig/net/ipv4/netfilter/Kconfig +++ linux-2.6.22.1/net/ipv4/netfilter/Kconfig @@ -414,6 +414,16 @@ config NETFILTER_XT_TARGET_TPROXY To compile it as a module, choose M here. If unsure, say N. +config NETFILTER_XT_MATCH_SOCKET + tristate "socket match support" + depends on IP_NF_TPROXY_TABLE + help + This option adds a `socket' match, which can be used to match + packets for which a TCP or UDP socket lookup finds a valid socket. + It can only be used in the tproxy table. + + To compile it as a module, choose M here. If unsure, say N. + # ARP tables config IP_NF_ARPTABLES tristate "ARP tables support" Index: linux-2.6.22.1/net/netfilter/Makefile =================================================================== --- linux-2.6.22.1.orig/net/netfilter/Makefile +++ linux-2.6.22.1/net/netfilter/Makefile @@ -76,6 +76,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_PKTTYPE) obj-$(CONFIG_NETFILTER_XT_MATCH_QUOTA) += xt_quota.o obj-$(CONFIG_NETFILTER_XT_MATCH_REALM) += xt_realm.o obj-$(CONFIG_NETFILTER_XT_MATCH_SCTP) += xt_sctp.o +obj-$(CONFIG_NETFILTER_XT_MATCH_SOCKET) += xt_socket.o obj-$(CONFIG_NETFILTER_XT_MATCH_STATE) += xt_state.o obj-$(CONFIG_NETFILTER_XT_MATCH_STATISTIC) += xt_statistic.o obj-$(CONFIG_NETFILTER_XT_MATCH_STRING) += xt_string.o Index: linux-2.6.22.1/net/netfilter/xt_socket.c =================================================================== --- /dev/null +++ linux-2.6.22.1/net/netfilter/xt_socket.c @@ -0,0 +1,80 @@ +/* + * Transparent proxy support for Linux/iptables + * + * Copyright (c) 2007 BalaBit IT Ltd. + * Author: Krisztian Kovacs + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as + * published by the Free Software Foundation. + * + */ +#include <linux/kernel.h> +#include <linux/module.h> +#include <linux/skbuff.h> +#include <linux/netfilter/x_tables.h> +#include <linux/netfilter_ipv4/ip_tproxy.h> +#include <net/inet_sock.h> +#include <net/sock.h> +#include <net/tcp.h> +#include <net/udp.h> + +static int +socket_match(const struct sk_buff *skb, const struct net_device *in, + const struct net_device *out, const struct xt_match *match, + const void *matchinfo, int offset, unsigned int protoff, + int *hotdrop) +{ + const struct iphdr *iph = ip_hdr(skb); + struct udphdr _hdr, *hp; + struct sock *sk; + + /* TCP/UDP only */ + if (iph->protocol != IPPROTO_TCP && iph->protocol != IPPROTO_UDP) + return false; + + hp = skb_header_pointer(skb, iph->ihl * 4, sizeof(_hdr), &_hdr); + if (hp == NULL) + return false; + + sk = ip_tproxy_get_sock(iph->protocol, iph->saddr, iph->daddr, + hp->source, hp->dest, in); + if (sk != NULL) { + if (iph->protocol == IPPROTO_TCP && + sk->sk_state == TCP_TIME_WAIT) + inet_twsk_put(inet_twsk(sk)); + else + sock_put(sk); + } + + pr_debug(KERN_DEBUG "socket match: proto %d %08x:%d -> %08x:%d sock %p\n", + iph->protocol, ntohl(iph->saddr), ntohs(hp->source), + ntohl(iph->daddr), ntohs(hp->dest), sk); + + return sk != NULL; +} + +static struct xt_match socket_reg __read_mostly = { + .name = "socket", + .family = AF_INET, + .table = "tproxy", + .match = socket_match, + .me = THIS_MODULE, +}; + +static int __init xt_socket_init(void) +{ + return xt_register_match(&socket_reg); +} + +static void __exit xt_socket_fini(void) +{ + xt_unregister_match(&socket_reg); +} + +module_init(xt_socket_init); +module_exit(xt_socket_fini); +MODULE_AUTHOR("Krisztian Kovacs <hidden(a)balabit.hu>"); +MODULE_DESCRIPTION("netfilter socket match module"); +MODULE_LICENSE("GPL"); +MODULE_ALIAS("ipt_socket"); ------------------------------ Message: 4 Date: Tue, 31 Jul 2007 12:39:04 +0200 (CEST) From: Jan Engelhardt <jengelh(a)computergmbh.de> Subject: Re: [tproxy] TProxy v4: 2.6.23 addendum To: Laszlo Attila Toth <panther(a)balabit.hu> Cc: TProxy Mailing List <tproxy(a)lists.balabit.hu> Message-ID: <Pine.LNX.4.64.0707311238170.22515(a)fbirervta.pbzchgretzou.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII Previous two were for 2.6.22, if using nf-dev, the following extra is needed. --- net/netfilter/xt_socket.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) Index: linux-2.6.22.1/net/netfilter/xt_socket.c =================================================================== --- linux-2.6.22.1.orig/net/netfilter/xt_socket.c +++ linux-2.6.22.1/net/netfilter/xt_socket.c @@ -19,11 +19,11 @@ #include <net/tcp.h> #include <net/udp.h> -static int +static bool socket_match(const struct sk_buff *skb, const struct net_device *in, const struct net_device *out, const struct xt_match *match, const void *matchinfo, int offset, unsigned int protoff, - int *hotdrop) + bool *hotdrop) { const struct iphdr *iph = ip_hdr(skb); struct udphdr _hdr, *hp; ------------------------------ Message: 5 Date: Tue, 31 Jul 2007 12:40:18 +0200 (CEST) From: Jan Engelhardt <jengelh(a)computergmbh.de> Subject: Re: [tproxy] TProxy v4: libxt_TPROXY To: Laszlo Attila Toth <panther(a)balabit.hu> Cc: TProxy Mailing List <tproxy(a)lists.balabit.hu> Message-ID: <Pine.LNX.4.64.0707311239130.22515(a)fbirervta.pbzchgretzou.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII Applies on top of iptables-svn6974. --- extensions/.tproxy-testx | 3 + extensions/libxt_TPROXY.c | 114 ++++++++++++++++++++++++++++++++++++++++++++++ extensions/libxt_socket.c | 49 +++++++++++++++++++ 3 files changed, 166 insertions(+) Index: iptables/extensions/.tproxy-testx =================================================================== --- /dev/null +++ iptables/extensions/.tproxy-testx @@ -0,0 +1,3 @@ +#!/bin/sh +[ -f "$KERNEL_DIR/include/linux/netfilter/xt_TPROXY.h" ] && echo TPROXY; +echo socket; Index: iptables/extensions/libxt_TPROXY.c =================================================================== --- /dev/null +++ iptables/extensions/libxt_TPROXY.c @@ -0,0 +1,114 @@ +/* Shared library add-on to iptables to add TPROXY target support. + * + * Copyright (C) 2002-2007 BalaBit IT Ltd. + */ +#include <stdio.h> +#include <string.h> +#include <stdlib.h> +#include <getopt.h> + +#include <iptables.h> +#include <xtables.h> +#include <linux/netfilter_ipv4/ip_tables.h> +#include <linux/netfilter/xt_TPROXY.h> + +static const struct option tproxy_opts[] = { + {"on-port", 1, NULL, '1'}, + {"on-ip", 1, NULL, '2'}, + {NULL}, +}; + +static void tproxy_help(void) +{ + printf( +"TPROXY target v%s options:\n" +" --on-port port Redirect connection to port, or the original port if 0\n" +" --on-ip ip Optionally redirect to the given IP\n", +IPTABLES_VERSION); +} + +static void parse_tproxy_lport(const char *s, struct xt_tproxy_info *info) +{ + unsigned int lport; + + if (string_to_number(s, 0, 65535, &lport) != -1) + info->lport = htons(lport); + else + exit_error(PARAMETER_PROBLEM, "bad --on-proxy `%s'", s); +} + +static void parse_tproxy_laddr(const char *s, struct xt_tproxy_info *info) +{ + struct in_addr *laddr; + + if ((laddr = dotted_to_addr(s)) == NULL) + exit_error(PARAMETER_PROBLEM, "bad --on-ip `%s'", s); + info->laddr = laddr->s_addr; +} + +static int tproxy_parse(int c, char **argv, int invert, unsigned int *flags, + const void *entry, struct xt_entry_target **target) +{ + struct xt_tproxy_info *tproxyinfo = (void *)(*target)->data; + + switch (c) { + case '1': + if (*flags != 0) + exit_error(PARAMETER_PROBLEM, + "TPROXY target: Can't specify --to-port twice"); + parse_tproxy_lport(optarg, tproxyinfo); + *flags = 1; + break; + case '2': + parse_tproxy_laddr(optarg, tproxyinfo); + break; + default: + return 0; + } + + return 1; +} + +static void tproxy_check(unsigned int flags) +{ + if (flags == 0) + exit_error(PARAMETER_PROBLEM, + "TPROXY target: Parameter --on-port is required"); +} + +static void tproxy_print(const void *ip, const struct xt_entry_target *target, + int numeric) +{ + const struct xt_tproxy_info *tproxyinfo = (const void *)target->data; + printf("TPROXY redirect %s:%d", + addr_to_dotted((const struct in_addr *)&tproxyinfo->laddr), + ntohs(tproxyinfo->lport)); +} + +static void tproxy_save(const void *ip, const struct xt_entry_target *target) +{ + const struct xt_tproxy_info *tproxyinfo = (const void *)target->data; + + printf("--on-port %d ", ntohs(tproxyinfo->lport)); + printf("--on-ip %s ", + addr_to_dotted((const struct in_addr *)&tproxyinfo->laddr)); +} + +static struct xtables_target tproxy_reg = { + .name = "TPROXY", + .family = AF_INET, + .version = IPTABLES_VERSION, + .size = XT_ALIGN(sizeof(struct xt_tproxy_info)), + .userspacesize = XT_ALIGN(sizeof(struct xt_tproxy_info)), + .help = tproxy_help, + .parse = tproxy_parse, + .final_check = tproxy_check, + .print = tproxy_print, + .save = tproxy_save, + .extra_opts = tproxy_opts, +}; + +void _init(void) +{ + xtables_register_target(&tproxy_reg); +} Index: iptables/extensions/libxt_socket.c =================================================================== --- /dev/null +++ iptables/extensions/libxt_socket.c @@ -0,0 +1,49 @@ +/* Shared library add-on to iptables to add early socket matching support. */ +#include <stdio.h> +#include <getopt.h> +#include <xtables.h> + +static void socket_print(const void *ip, const struct xt_entry_match *match, + int numeric) +{ + printf("socket "); +} + +static int socket_parse(int c, char **argv, int invert, unsigned int *flags, + const void *entry, unsigned int *nfcache, + struct xt_entry_match **match) +{ + return 0; +} + +static void socket_check(unsigned int flags) +{ +} + +static struct xtables_match socket_reg = { + .name = "socket", + .family = AF_INET, + .version = IPTABLES_VERSION, + .size = XT_ALIGN(0), + .userspacesize = XT_ALIGN(0), + .parse = socket_parse, + .final_check = socket_check, + .print = socket_print, +}; + +static struct xtables_match socket_reg6 = { + .name = "socket", + .family = AF_INET6, + .version = IPTABLES_VERSION, + .size = XT_ALIGN(0), + .userspacesize = XT_ALIGN(0), + .parse = socket_parse, + .final_check = socket_check, + .print = socket_print, +}; + +void _init(void) +{ + xtables_register_match(&socket_reg); + xtables_register_match(&socket_reg6); +} ------------------------------ Message: 6 Date: Tue, 31 Jul 2007 12:45:15 +0200 (CEST) From: Jan Engelhardt <jengelh(a)computergmbh.de> Subject: Re: [tproxy] TProxy version 4.0.0 released To: Laszlo Attila Toth <panther(a)balabit.hu> Cc: tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.64.0707311243440.22515(a)fbirervta.pbzchgretzou.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII On Jul 31 2007 12:31, Laszlo Attila Toth wrote: > >MD5 checksums of the tarballs: > >a655fd090c06827bd6927f2b894ee178 tproxy-4.0.0-2.6.23-rc1.tgz >d7175531d67beaab48293cd86cac5d21 tproxy-4.0.0-ubuntu-2.6.17-12.39.tgz That can not compile, because there are still a lot of merge markers. @@ -1950,7 +2065,14 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, rth->fl.fl4_src == saddr && rth->fl.iif == iif && rth->fl.oif == 0 && +<<<<<<< HEAD:net/ipv4/route.c rth->fl.mark == skb->mark && +======= +#ifdef CONFIG_IP_ROUTE_FWMARK + rth->fl.fl4_fwmark == skb->nfmark && +#endif + !(rth->u.dst.flags & DST_DIVERTED) && +>>>>>>> 2bc8cb4... initial import of tproxy4 (2007-07-30):net/ipv4/route.c rth->fl.fl4_tos == tos) { rth->u.dst.lastuse = jiffies; dst_hold(&rth->u.dst); Jan -- ------------------------------ Message: 7 Date: Tue, 31 Jul 2007 13:13:28 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [tproxy] TProxy version 4.0.0 released To: Jan Engelhardt <jengelh(a)computergmbh.de> Cc: tproxy(a)lists.balabit.hu Message-ID: <1185880408.6998.69.camel(a)bzorp.balabit> Content-Type: text/plain On Tue, 2007-07-31 at 12:45 +0200, Jan Engelhardt wrote: > On Jul 31 2007 12:31, Laszlo Attila Toth wrote: > > > >MD5 checksums of the tarballs: > > > >a655fd090c06827bd6927f2b894ee178 tproxy-4.0.0-2.6.23-rc1.tgz > >d7175531d67beaab48293cd86cac5d21 tproxy-4.0.0-ubuntu-2.6.17-12.39.tgz > > That can not compile, because there are still a lot of merge markers. > > > @@ -1950,7 +2065,14 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, > rth->fl.fl4_src == saddr && > rth->fl.iif == iif && > rth->fl.oif == 0 && > +<<<<<<< HEAD:net/ipv4/route.c > rth->fl.mark == skb->mark && > +======= > +#ifdef CONFIG_IP_ROUTE_FWMARK > + rth->fl.fl4_fwmark == skb->nfmark && > +#endif > + !(rth->u.dst.flags & DST_DIVERTED) && > +>>>>>>> 2bc8cb4... initial import of tproxy4 (2007-07-30):net/ipv4/route.c > rth->fl.fl4_tos == tos) { > rth->u.dst.lastuse = jiffies; > dst_hold(&rth->u.dst); Looks like we did not resolve all conflicts when forward-porting to 2.6.23. The version on top of Ubuntu 2.6.17-12.39 was the one that has been tested, but we thought that we should release to a more current version as well. So in summary, the 2.6.17 based patch should be considered 'reasonably' stable, the other is completely untested. By the way, let me introduce Panther, he is going to be the new tproxy maintainer. As an additional item of interest, we've also published an experimental git tree to http://people.balabit.hu/panther/tproxy4.git/ -- Bazsi ------------------------------ Message: 8 Date: Tue, 31 Jul 2007 13:38:38 +0200 (CEST) From: Jan Engelhardt <jengelh(a)computergmbh.de> Subject: Re: [tproxy] TProxy version 4.0.0 released To: Balazs Scheidler <bazsi(a)balabit.hu> Cc: tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.64.0707311336340.22515(a)fbirervta.pbzchgretzou.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII On Jul 31 2007 13:13, Balazs Scheidler wrote: > >Looks like we did not resolve all conflicts when forward-porting to >2.6.23. > >The version on top of Ubuntu 2.6.17-12.39 was the one that has been >tested, but we thought that we should release to a more current version >as well. > >So in summary, the 2.6.17 based patch should be considered 'reasonably' >stable, the other is completely untested. Is there a 'socket' match at all in balabit's tree? As far as I understand, I need xt_socket because otherwise, traffic to [foreign address on local socket] is forwarded to the real host. >By the way, let me introduce Panther, he is going to be the new tproxy >maintainer. > >As an additional item of interest, we've also published an experimental >git tree to http://people.balabit.hu/panther/tproxy4.git/ 403. Not a good day, today, is it? :) Jan -- ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 25, Issue 9 *************************************

2 1

RE: tproxy Digest, Vol 25, Issue 7
by Sunin Thaveethamsavee 21 Jul '07

21 Jul '07

Thanks for your suggestion but I already add my squid ip address (eth0) to the tcp_outgoing_address tag but it still got the problem Message: 1 Date: Thu, 19 Jul 2007 22:58:14 +0200 From: Prof_Ethan Ethan Hunt <prof_ethan(a)hotmail.com> Subject: RE: [tproxy] port=0 ERROR ASSIGN To: <tsunin(a)gmail.com>, <tproxy(a)lists.balabit.hu> Message-ID: <BAY124-W28F13F0EADE9442C8F1344EDFB0(a)phx.gbl> Content-Type: text/plain; charset="iso-8859-1" Hi there Have you tried setting in squid.conf the tcp_outgoing_address? Regards From: tsunin(a)gmail.comTo: tproxy(a)lists.balabit.huDate: Thu, 19 Jul 2007 12:28:55 +0700Subject: [tproxy] port=0 ERROR ASSIGN Hi Folk, I had try to fix this problem with along time, any guy please guide me to solve this problem --- from cache.log of squid --- tproxy ip=124.121.92.124,0x7c5c797c,port=0 ERROR ASSIGN it dump the port=0 ERROR ASSIGN every time Thanks _________________________________________________________________ !Ya esta aqum Windows Live Spaces! Ahora podras crear facilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

1 0

Problem in the Tproxy compilation
by cpd＠agitajau.com.br 20 Jul '07

20 Jul '07

Hi, Sorry for me english, first. Following, i come trying to compile, the tproxy used patch cttproxy-2.6.12-2.0.2.tar.gz with kernel 2.6.12.2, i come having some problems, at time compile of kernel. it follows the low o error: net/ipv4/netfilter/iptable_tproxy.c: In function 'ip_tproxy_kill_related': include/linux/netfilter_ipv4/ip_conntrack.h:261: sorry, unimplemented: inlining failed in call to 'ip_conntrack_put': function body not available net/ipv4/netfilter/iptable_tproxy.c:458: sorry, unimplemented: called from here make[3]: ** [net/ipv4/netfilter/iptable_tproxy.o] Erro 1 make[2]: ** [net/ipv4/netfilter] Erro 2 make[1]: ** [net/ipv4] Erro 2 make: ** [net] Erro 2 thank you for help... Regards Welisson Tomé

1 0

transparent proxy in bridgemode
by Ramana Yarlagadda 20 Jul '07

20 Jul '07

Hi, I am trying to use the cttpprxy module to setup a transparent proxy. I am running into some problems because of which I couldn't bring up the setup. Following is one of the issues I ran into. I configured Linux bridge on my fedora core 6 box. I am running the foreign-tcp-listen with foreign ip 10.10.4.22 and the foreign port is 80. Then I am also running the foreign_tcp_connect with the foreign IP 10.10.4.111 and foreign port 2000. And destination IP 10.10.4.22, and destination port 80. The proxy server is listening on port # 10001. 1) started the foreign_tcp_listen application. 2) then I started foreign_tcp_connect application. Unexpectedly the TCP connection is established with the local application ie to foreign_tcp_listen application running on the same box ( instead of connecting to the server). 3) But if don't run the foreign_tcp_application, then the client request goes to the server ( as expected) 3) The setup is as shown below and following are the rules that I have been using +---------------------------+ 10.10.4.111 <==> | eth0 br0 eth1| | <====> 10.10.4.22:80 +---------------------------+ ebtables -t broute -A BROUTING -i eth0 -p IPv4 --ip-protocol 6 --ip-destination-port 80 -j redirect --redirect-target ACCEPT iptables -t tproxy -A PREROUTING -j TPROXY -p tcp -m tcp -i br0 -d 10.10.4.22 --dport 80 --on-port 10001 is there anything that I am missing here? can somebody help me. . -Thanks in advance -ramana

1 0

RE: [tproxy] port=0 ERROR ASSIGN
by Prof_Ethan Ethan Hunt 19 Jul '07

19 Jul '07

Hi there Have you tried setting in squid.conf the tcp_outgoing_address? Regards From: tsunin(a)gmail.comTo: tproxy(a)lists.balabit.huDate: Thu, 19 Jul 2007 12:28:55 +0700Subject: [tproxy] port=0 ERROR ASSIGN Hi Folk, I had try to fix this problem with along time, any guy please guide me to solve this problem --- from cache.log of squid --- tproxy ip=124.121.92.124,0x7c5c797c,port=0 ERROR ASSIGN it dump the port=0 ERROR ASSIGN every time Thanks _________________________________________________________________ ¡Ya está aquí Windows Live Spaces! Ahora podrás crear fácilmente tu propio sitio Web. http://spaces.live.com/signup.aspx

1 0

MAC and VLAN transparency
by Cameron Schaus 19 Jul '07

19 Jul '07

I am using tproxy to do source IP address transparency on our proxy, and it is working well. I would like to extend the functionality of tproxy to provide source MAC address and VLAN transparency as well. The proxy in question runs as a transparent bridge, so I think that I have to integrate the tproxy framework with ebtables, but I'm not 100% sure how to go about that. I would like to set up an ebtables (or equivalent) rule that does source MAC natting, similar to the source IP addrses NAT rule used by tproxy today, and I would also like to rewrite the VLAN tag in the outgoing packet to that of the original connection, if any. Can anyone give me any pointers about how to best accomplish what I am trying to do? Thanks, Cam

5 6

port=0 ERROR ASSIGN
by Sunin Thaveethamsavee 19 Jul '07

19 Jul '07

Hi Folk, I had try to fix this problem with along time, any guy please guide me to solve this problem --- from cache.log of squid --- tproxy ip=124.121.92.124,0x7c5c797c,port=0 ERROR ASSIGN it dump the port=0 ERROR ASSIGN every time Thanks

1 0

Re: [tproxy] MAC and VLAN transparency
by KOVACS Krisztian 18 Jul '07

18 Jul '07

Hi, On sze, júl 18, 2007 at 02:27:36 +0200, Jan Engelhardt wrote: > > I don't know how far Balazs got since the end of May, but it was > >certainly not production-ready by that time (it wasn't heavily tested). > > http://jengelh.hopto.org/f/tproxy4-20070718-ccj1.tar.bz2 Ok, and what are you trying to referring to with this link? -- KOVACS Krisztian

1 0

squid + tproxy + nat
by Alexandre Correa 17 Jul '07

17 Jul '07

Hello, my gateway redirect traffic using transparent mode to my squid box.. my clients are using private ips (172.30.xx.xx) and transparent redirect using DNAT --to-destination ip.of.proxy:3128 clients that have routable ip, appears on squid.. but clients that have private.. i only see private ip of the gateway ... if i install tproxy on gateway, will it work ? i need to see all of ips on squid box... thanks... !! regards ! -- Sds. Alexandre J. Correa Onda Internet / OPinguim.net http://www.ondainternet.com.br http://www.opinguim.net

1 0

Re: [tproxy] MAC and VLAN transparency
by Cameron Schaus 16 Jul '07

16 Jul '07

On Sun, Jul 15, 2007 at 06:01:24PM +0200, Jan Engelhardt wrote: > ebtables -t nat -A POSTROUTING -m <some_condition> > -j snat --to-source <orig_mac> > > Simple :) > (you'd still need arpreply, and something like connmark, so that you can > properly can figure out orig_mac). This is not so much of a tproxy job IMO. That is the effect I want to achieve. But these rules need to be enacted dynamically as each client connects to the proxy. I had hoped to leverage the connection tracking that tproxy was doing in order to ensure the ebtables nat rules had the same lifetime as the associated tcp connection. And, as Balazs suggests, I also need to grab the orig_mac from the client connection to use when setting up such a rule. Cam

1 0