- tproxy - lists.balabit.hu

Tproxy + squid + Wccp verion 2 + FC5 Does it really work
by Rajesh Yadav 28 May '07

28 May '07

Hello, I had been struggling for almost a month trying to make tproxy + Squid + Wccp work for me but all my effort gives me only "2007/05/28 11:50:30| tproxy ip=xxx.xxx.xxx.xxx,0x2e11c87a,port=0 ERROR ASSIGN". And I can only see my squid ip with www.dnsstuff.com & www.tracert.com. Please can anyone help me with the correct method & steps to make it work for me ? Regards Rajesh -----Original Message----- From: tproxy-bounces(a)lists.balabit.hu [mailto:tproxy-bounces@lists.balabit.hu] On Behalf Of tproxy-request(a)lists.balabit.hu Sent: Sunday, May 27, 2007 3:30 PM To: tproxy(a)lists.balabit.hu Subject: tproxy Digest, Vol 23, Issue 5 Send tproxy mailing list submissions to tproxy(a)lists.balabit.hu To subscribe or unsubscribe via the World Wide Web, visit https://lists.balabit.hu/mailman/listinfo/tproxy or, via email, send a message with subject or body 'help' to tproxy-request(a)lists.balabit.hu You can reach the person managing the list at tproxy-owner(a)lists.balabit.hu When replying, please edit your Subject line so it is more specific than "Re: Contents of tproxy digest..." Today's Topics: 1. Re: The future of tproxy (Jan Engelhardt) 2. Re: The future of tproxy (Igmar Palsenberg) 3. Re: The future of tproxy (Jan Engelhardt) 4. Re: The future of tproxy (Balazs Scheidler) ---------------------------------------------------------------------- Message: 1 Date: Sat, 26 May 2007 21:16:38 +0200 (MEST) From: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Subject: Re: [tproxy] The future of tproxy To: Balazs Scheidler <bazsi(a)balabit.hu> Cc: Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.61.0705262114160.7344(a)yvahk01.tjqt.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII On May 26 2007 07:36, Balazs Scheidler wrote: >> >> What are your future plans for TPROXY? I noticed that there's no plan >> for NAT in ipv6tables, so are you looking to move away from a NAT >> approach? Are you considering migrating towards Network Channels? > >We definitely want to move away from NAT, and we don't plan to migrate >towards network channels. (at least for now). But how is one supposed to fake addresses then? -- most prominent case: squid Jan -- ------------------------------ Message: 2 Date: Sat, 26 May 2007 22:32:06 +0200 (CEST) From: Igmar Palsenberg <maillist(a)jdimedia.nl> Subject: Re: [tproxy] The future of tproxy To: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Cc: Balazs Scheidler <bazsi(a)balabit.hu>, Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.64.0705262231210.30518(a)jdi.jdi-ict.nl> Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed >> We definitely want to move away from NAT, and we don't plan to migrate >> towards network channels. (at least for now). > > But how is one supposed to fake addresses then? By bind()'ing to the remote address, like the way it was done in the Linux 2.2 days. Igmar ------------------------------ Message: 3 Date: Sat, 26 May 2007 22:45:19 +0200 (MEST) From: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Subject: Re: [tproxy] The future of tproxy To: Igmar Palsenberg <maillist(a)jdimedia.nl> Cc: Balazs Scheidler <bazsi(a)balabit.hu>, Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <Pine.LNX.4.61.0705262244270.7344(a)yvahk01.tjqt.qr> Content-Type: TEXT/PLAIN; charset=US-ASCII On May 26 2007 22:32, Igmar Palsenberg wrote: >> > We definitely want to move away from NAT, and we don't plan to migrate >> > towards network channels. (at least for now). >> >> But how is one supposed to fake addresses then? > > By bind()'ing to the remote address, like the way it was done in the Linux 2.2 > days. Yeah but you'd still need a local table that lists tproxied sockets, so that for an arbitrary incoming packet it can be decided whether it is to go through the INPUT or FORWARD chain (and subsequently, destination program/host). Jan -- ------------------------------ Message: 4 Date: Sun, 27 May 2007 00:19:43 +0200 From: Balazs Scheidler <bazsi(a)balabit.hu> Subject: Re: [tproxy] The future of tproxy To: Jan Engelhardt <jengelh(a)linux01.gwdg.de> Cc: Igmar Palsenberg <maillist(a)jdimedia.nl>, Nicholas George <nick.george(a)gmail.com>, tproxy(a)lists.balabit.hu Message-ID: <1180217983.19697.33.camel(a)bzorp.balabit> Content-Type: text/plain On Sat, 2007-05-26 at 22:45 +0200, Jan Engelhardt wrote: > On May 26 2007 22:32, Igmar Palsenberg wrote: > >> > We definitely want to move away from NAT, and we don't plan to migrate > >> > towards network channels. (at least for now). > >> > >> But how is one supposed to fake addresses then? > > > > By bind()'ing to the remote address, like the way it was done in the Linux 2.2 > > days. > > Yeah but you'd still need a local table that lists tproxied sockets, so > that for an arbitrary incoming packet it can be decided whether it is > to go through the INPUT or FORWARD chain (and subsequently, destination > program/host). The local table is the "socket hash". We do a socket lookup early in the input path and divert the packet to the local IP stack by changing its dst_entry. -- Bazsi ------------------------------ _______________________________________________ tproxy mailing list tproxy(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/tproxy End of tproxy Digest, Vol 23, Issue 5 *************************************

4 3

The future of tproxy
by Nicholas George 27 May '07

27 May '07

I was just reading the following post: http://news.gmane.org/find-root.php?message_id=%3c20070103163357.14635.3775… regarding TPROXY Version 4. ie NOT using iptables NAT, but being able to bind to a non-local address. The approach discussed in the post looks and sounds good. How close is it to being ready for production use? Do you consider TPROXY Version 2 (the current TPROXY) safe for production use? What are your future plans for TPROXY? I noticed that there's no plan for NAT in ipv6tables, so are you looking to move away from a NAT approach? Are you considering migrating towards Network Channels? Kind Regards, Nick George

4 5

IP_TPROXY: socket already assigned errors
by Lior Dotan 20 May '07

20 May '07

Hi, I've been using TPROXY 2.0.6 + NAT reservation with kernel 2.4.33 and squid with tproxy support and I'm getting a lot of these messages: IP_TPROXY: socket already assigned, reuse=0.... I tried to enable the reuse address but that didn't help. With TPROXY 1.20 I didn't have this problem, but I did have the "error applying NAT" which is the reason that I am using NAT reservation. Another question that I have is the size of the has table, currently squid handles about 100 requests/sec. When should I increase the hash size, if ever? Thanks.

1 0

Debian K2.6 + wccp + tproxy squid 2.6 stable15
by Nicolas Royo 17 May '07

17 May '07

Hi fellows, hope you can help me out with a problem im still having. The problem is quite simple and complicated we are on a small isp, trying to implement squid without "the user noticing it" we´ve come very far reading your lists and googling squids tproxy. on a linux box, only one eth0, with a gre0, with a cisco 7200. kernel and iptables patched with lasts cttproxys :D iptables -L -t tproxy Chain PREROUTING (policy ACCEPT) target prot opt source destination TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3128 > #####squid Conf.##### > http_port 3128 tproxy transparent > hierarchy_stoplist cgi-bin ? > acl QUERY urlpath_regex cgi-bin \? > cache deny QUERY > acl apache rep_header Server ^Apache > broken_vary_encoding allow apache > access_log /usr/local/squid/var/logs/access.log > squid > refresh_pattern ^ftp: 1440 20% 10080 > refresh_pattern ^gopher: 1440 0% 1440 > refresh_pattern . 0 20% 4320 > acl all src 0.0.0.0/0.0.0.0 > acl manager proto cache_object > acl localhost src 127.0.0.1/255.255.255.255 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl to_localhost dst 127.0.0.0/8 > acl SSL_ports port 443 > acl Safe_ports port 80 # http > acl Safe_ports port 21 # ftp > acl Safe_ports port 443 # https > acl Safe_ports port 70 # gopher > acl Safe_ports port 210 # wais > acl Safe_ports port 1025-65535 # unregistered ports > acl Safe_ports port 280 # http-mgmt > acl Safe_ports port 488 # gss-http > acl Safe_ports port 591 # filemaker > acl Safe_ports port 777 # multiling http > acl CONNECT method CONNECT > http_access allow manager localhost > http_access deny manager > http_access deny !Safe_ports > http_access deny CONNECT !SSL_ports > acl our_networks src 0.0.0.0/0.0.0.0 > http_access allow our_networks > http_access deny all > http_reply_access allow all > icp_access allow all > visible_hostname debian-sq > wccp2_router XXX.XXX.XXX.XXX > wccp_version 4 > wccp2_forwarding_method 1 > wccp2_return_method 1 > wccp2_assignment_method 1 > coredump_dir /usr/local/squid/var/cache > via off > forwarded_for off with this last 2 options, we have played a lot. if set it on, client ip is passing through the squid, url`s like www.whatsmyipadress.com are still detecting a proxy behind it! :( if set off, squid ip is reaching final url, but squid is not being detected. as far as i can tell, is that if i set the parameter: tcp_outgoing_adress x.x.x.x and adding another iptables rule and NIC to the linux box, the requesting page on the client browser "dies" (keeps waiting till it times out( so no tcp_outgoing_adress is have to be set up in order to surf withouth problems BUT if not set up, on syslog and squid.out i can see: squid-RC9 squid[26519]: tproxy ip=[x.x.x.x--->client address here],0xa4e851c8,port=0 ERROR ASSIGN what else should i have to check? there is a hardware solution that has been offered to us.....bluecoat SG.........that is covering all these needs by our boss. but it is a so expensive product in a country like ours (argentina) that we cant afford it...........we bet on tproxy´s magic........we still believe Thanx in advance Nicolas ____________________________________________________________________________________ Moody friends. Drama queens. Your life? Nope! - their life, your story. Play Sims Stories at Yahoo! Games. http://sims.yahoo.com/

1 0

tproxy and tcp_outgoing_address
by Bryan K. Walton 19 Apr '07

19 Apr '07

We are working to setup a Squid proxy server using the tproxy kernel and iptables patches. We've worked to get it configured for several days now and are having some problems. I spent a lot of time with Google and the mailing list archives but can't get my problem fixed. The proxy server has been working but I can't get it to rewrite the packets to show the client IP as the requesting IP for html requests. Trying to fix this, I specify the interface of the squid server for tcp_outgoing_address in the squid.conf file, but then client's can no longer access webpages. Their browser keeps waiting until they get a timeout error from the proxy server. Squid's access.log file shows a 504 error. I'm sure I'm missing something obvious, but I can't figure out what it is. BTW, I'm under the impression that ip_gre in recent kernels can do the equivalent of ip_wccp modules in older kernels. We are wanting to do the eqivalent of the ip_wccp as our router cannot do the GRE tunnel. I'm basing this understanding off of the following page: http://wiki.squid-cache.org/SquidFaq/InterceptionProxy#head-5887c3744368f29… Specifics: OS: Debian 4.0 Kernel: 2.6.19.7 (patched with tproxy patch) iptables-1.3.7 (patched with trproxy patch) Relevant Modules loaded: iptable_filter ipt_TPROXY xt_tcpudp iptable_tproxy iptable_nat ip_nat ip_conntrack ip_tables (Note: ip_gre is built staticly into the kernel) Iptables rule added: iptables -t tproxy -A PREROUTING -i eth1 -p tcp -m tcp --dport 80 -j TPROXY --on-port 80 (Note: eth1 is the inteface of the proxy server that clients hit. I've also tried eth0 in this iptables rule, as well as leaving out the -i flag entirely.) Relevant Parts of squid.conf: http_port 80 transparent tproxy wccp2_service dynamic 80 wccp2_service_info 80 protocol=tcp flags=src_ip_hash priority=240 ports=80 wccp2_service dynamic 90 wccp2_service_info 90 protocol=tcp flags=dst_ip_hash,ports_source priority=240 ports=80 tcp_outgoing_address <IP address of eth1> server_persistent_connections off If anybody can help me figure out what I'm missing, I would be most thankful. Sincerely, Bryan Walton

2 2

cttproxy question: what is ip_tproxy_confirmed () for ?
by Sergei Lavrov 23 Mar '07

23 Mar '07

What is the following function for ? static void ip_tproxy_confirmed(struct ip_conntrack *ct) { struct ip_tproxy_sockref *sr = (struct ip_tproxy_sockref *)ct->tproxy.sockref; /* check if it was marked by tproxy and not yet a related sockref */ if (test_bit(IPS_TPROXY_BIT, &ct->status) && !test_bit(IPS_TPROXY_RELATED_BIT, &ct->status) && sr) { ct->tproxy.sockref = NULL; /* put it on the sockref's related list */ if (sr->proto == IPPROTO_UDP) ip_tproxy_relatedct_add(sr, ct); /* drop reference to sockref */ ip_tproxy_sockref_unref(sr); } } ____________________________________________________________________________________ Get your own web address. Have a HUGE year through Yahoo! Small Business. http://smallbusiness.yahoo.com/domains/?p=BESTDEAL

1 0

Issue configuring 2.6.20 kernel with tproxy 2.0.6
by Pranav Desai 14 Mar '07

14 Mar '07

Hello All, I am trying to patch the 2.6.20 kernel with the patches in cttproxy-2.6.20-2.0.6.tar.gz. But it doesnt show up in 'make menuconfig'. Can someone point me to where it should show up and if there is any other way to configure tproxy into my kernel i.e. without using make menuconfig. Thanks -- Pranav

4 5

Patching iptables via apt-build
by Matt Miller 01 Mar '07

01 Mar '07

Under debian etch I'm trying to patch iptables using the debian tool apt-build. I'm using the "--patch" option of apt-build to get the tproxy patch included, and it looks like the source tree is being patched. The problem at this point seems to be that the resulting .deb package doesn't know that the new libipt_TPROXY.so library is supposed to be part of the package after the patch. I haven't yet tried to just get the iptables source from netfilter.org and patch the standard tree, because I'd really prefer to stay in the debian world to do all this. Can anyone provide instructions or hints for easily building a .deb of iptables that includes the tproxy patch? I'm not necessarily committed to using apt-build, but that tool's "--patch" option did seem to be the easiest approach. I am open to other approaches.

2 4

reuse connection
by Eyal Rundstein 17 Jan '07

17 Jan '07

Hi, I am using kernel 2.4.32 with TPROXY 2.0.5. My application is a transparent proxy. My client opens a connection to the proxy and a transparent connection is opened to the server. Now my application closes the server connection and FIN is sent to the server. The server does not reply with FIN. (it is down). The connection goes to FIN_WAIT1 state (netstat). The client connection stays open and I try to reestablish the backend connection with the same client (source IP/port) parameters. The problem is that I can not reestablish the connection for about 60-80 seconds. It seems that the entry of the connection is not cleared so I can not reuse the connection. 1) Is there a way I can delete the entry as soon as the FIN is sent? 2) Is there a timeout I can change to shorten the time I need to wait before reusing the connection? Thanks in advance, E.R

1 0

tproxy LISTEN proxy does not work.
by Yoshioka Tsuneo 16 Jan '07

16 Jan '07

Hello When I tried to listen proxy using tproxy like following, it does not work to be intented. Structure: Client <===> Proxy <===> Server 1. On Proxy, listen on the port 9999. 2. On Proxy, assign Server:2000 using TPROXY_ASSIGN, and set ITP_LISTEN flag. 3. Client connect to Server:2000. 4. Proxy steal connection using tproxy.(using ITP_LISTEN) 5. Proxy connect to Server:2000. On "4.", Proxy should connect server:2000 on "4.". But, actually, proxy connect to Proxy:9999. Packet capturing result is like following. (*) line is "5.". It should be like "10.65.3.100.47886 > 10.65.3.110.2000". ========================================================= 13:12:30.957695 10.65.1.208.5495 > 10.65.3.110.2000: S 2155077236:2155077236(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) 13:12:30.957821 10.65.1.208.5495 > 10.65.3.100.9999: S 2155077236:2155077236(0) win 65535 <mss 1460,nop,nop,sackOK> (DF) 13:12:30.957837 10.65.3.110.2000 > 10.65.1.208.5495: S 754591780:754591780(0) ack 2155077237 win 5840 <mss 1460,nop,nop,sackOK> (DF) [ttl 1] 13:12:30.957860 10.65.3.110.2000 > 10.65.1.208.5495: S 754591780:754591780(0) ack 2155077237 win 5840 <mss 1460,nop,nop,sackOK> (DF) [ttl 1] 13:12:30.957874 10.65.1.208.5495 > 10.65.3.110.2000: . ack 1 win 65535 (DF) 13:12:30.957884 10.65.1.208.5495 > 10.65.3.100.9999: . ack 754591781 win 65535 (DF) (*)13:12:30.958069 10.65.3.100.47886 > 10.65.3.100.9999: S 765420716:765420716(0) win 5840 <mss 1460,sackOK,timestamp 1284404 0,nop,wscale 2> (DF) 13:12:30.958096 10.65.3.110.2000 > 10.65.3.100.47886: S 756210562:756210562(0) ack 765420717 win 32768 <mss 16396,sackOK,timestamp 1284404 1284404,nop,wscale 2> (DF) [ttl 1] 13:12:30.958116 10.65.3.100.47886 > 10.65.3.100.9999: . ack 756210563 win 1460 <nop,nop,timestamp 1284404 1284404> (DF) 13:12:30.958152 10.65.3.100.47886 > 10.65.3.100.9999: P 0:10(10) ack 1 win 1460 <nop,nop,timestamp 1284404 1284404> (DF) 13:12:30.958164 10.65.3.110.2000 > 10.65.3.100.47886: . ack 11 win 8192 <nop,nop,timestamp 1284404 1284404> (DF) [ttl 1] ========================================================= IP address is like following. Client: 10.65.1.208 Proxy: 10.65.3.100 Server: 10.65.3.110 Test code is attached. I have confirmed the issue on both: "linux-2.6.19.1" with "cttproxy-2.6.19-2.0.6" and "linux-2.4.31" with "cttproxy-2.4.31-2.0.2" I guess that the connection is NAT'ed. But I cannot find the way to connect Server:2000. This scenario happens while ftp data connection. For about ftp itself, using ip_nat_ftp seems solve the issue. But, can I get any information(reason, advice), if possible ? Thank you ! -- (Nihon F-Secure Corporation) Yoshioka Tsuneo E-MAIL: Tsuneo.Yoshioka(a)f-secure.com

2 2