- tproxy - lists.balabit.hu

tproxy kernel panic
by Sai Bathina 23 Jul '06

23 Jul '06

I am using a 2.6.14 kernel with the 2.0.3 patch. I am using a proxy server to connect transparently using tproxy. While the traffic is flowing I did a cat /proc/net/tproxy and I saw a kernel panic. The trace I could see was: pipe_writev pipe_write vfs_write sys_write syscall_call Sorry I do not get better informtion. But I was wondering if this is a known issue or something that is new. Thanks Sai

2 2

tproxy non-root access
by eric_chao＠trend.com.tw 20 Jul '06

20 Jul '06

Hi, Is it true that my program needs to have root access in order to change socket options with tproxy? If so, is there a workaround for it? Currently, I have a program running under a non-root user and needs to use tproxy but it keeps getting "Operation not permmited" error when trying to set socket option using tproxy. I'm using 2.6.14 kernel and its corresponding tproxy patch. Eric TREND MICRO EMAIL NOTICE The information contained in this email and any attachments is confidential and may be subject to copyright or other intellectual property protection. If you are not the intended recipient, you are not authorized to use or disclose this information, and we request that you notify us by reply mail or telephone and delete the original message from your mail system.

3 2

tproxy in newer 2.6 kernels
by Lennert Buytenhek 13 Jul '06

13 Jul '06

Hi, Having to very suddenly (due to hardware failure) upgrade an old 2.4 tproxy box to a stock 2.6 distro kernel box, I was faced with the problem of the upstream 2.6 kernel (and thus, the distro kernel) not supporting tproxy. REDIRECT functionality does work upstream, but TCP source address spoofing can only be achieved with iptables SNAT. So, I implemented a small module that can insert SNAT rules into nat/POSTROUTING, and our proxy (in-house program) now uses that instead of tproxy. This works well for us since we don't need all the other functionality that tproxy provides, but of course, YMMV. I've attached the code we use. It uses libiptc, and may look kind of weird since it was chainsawed from a (much) bigger piece of code, but you'll get the idea. (It flushes and inserts rules in POSTROUTING by default, if that's not appropriate, make a new chain and add a rule to POSTROUTING to jump to that chain.) It's not been tested incredibly extensively, but since the proxy has been processing 4000-5000 concurrent connections at 200-300 connections per second without a hitch for about 12 hours now, it's at least not completely broken. cheers, Lennert

2 5

Porting 2.0.4 patch to 2.6.9 kernel
by Clifford Hung 07 May '06

07 May '06

Hi, I am using the stock kernel (2.6.9-34) for Red Hat Enterprise Linux WS release 4 (Nahant Update 3). I was able to patch it to 2.0.1 using cttproxy-2.6.10-2.0.1 quite easily. However, I would like to use the latest tproxy patch (2.0.4) as it appears to have some important bug fixes. It appears to be quite difficult to patch this kernel using cttproxy-2.6.15-2.0.4. Is it possible to port the 2.0.4 patch to the 2.6.9-34 kernel? Thanks, Cliff

2 1

errno 92
by Jan Engelhardt 01 May '06

01 May '06

Hi, just a note, please add an explanation to the README of the upcoming tproxy version, thanks. When iptable_tproxy is not loaded, the setsockopt() calls might return errno 92 (ENOPROTOOPT -- Protocol not available). A quite misleading value, especially since tproxy's setsockopt function returns -ENOPROTOOPT if an invalid itp.op was specified. But given that -ENOPROTOOPT also shows up when tproxy is not loaded, I assume that the general linux networking also returns -ENOPROTOOPT, which makes it almost indistinguishable where the problem is. Jan Engelhardt --

1 0

tproxy 2.0.2 (2.6.12) and SMP kernel freeze
by Sudhi Herle 10 Apr '06

10 Apr '06

Hello, For a variety of reasons (technical & non-technical), I have to support 2.6.12 & tproxy-2.0.2 for a customer. On a SMP machine, we are seeing a hard-kernel freeze on an incoming TCP connection when ever tproxy-tcp rules are active. I came across this bug report on the tproxy mailing lists: https://lists.balabit.hu/pipermail/tproxy/2005-November/000215.html And, a subsequent announcement for 2.0.3-2.6.14 release which fixes the bug. Unfortunately, 2.6.14 and 2.6.12 have different netfilter interfaces; so, I am unsure how to backport the fix to 2.6.12. I would very much appreciate some hints on how to resolve this on 2.0.2 and 2.6.12. Thanks in advance, -- Sudhi

1 0

Patching iptables
by Nguyen Nguyen 07 Apr '06

07 Apr '06

Q: Is patching the iptables userspace necessary if I just want to fool around with the example programs, say foreign-tcp-connect? Thanks, N

3 7

TProxy version 2.0.4 released
by KOVACS Krisztian 10 Feb '06

10 Feb '06

Hi, TProxy version 2.0.4 has been released for Linux 2.4.32 and Linux 2.6.15. This release fixes a serious sockref corruption problem possibly leading to kernel oopses when sending broadcast packets with fake source address. The release tarballs are available here: http://www.balabit.com/downloads/tproxy/ MD5 checksums of the release tarballs: 5ffaf405beb1abedf5566def28443130 cttproxy-2.4.32-2.0.4.tar.gz d8dd1edda3b1e50ff7b795bc5521274c cttproxy-2.6.15-2.0.4.tar.gz The 2.6.15 patch is _not_ compatible with Linux 2.6.16-rc (release candidate) kernels, working with those will need further modifications. -- Regards, Krisztian Kovacs

1 0

table loading error
by Jan Engelhardt 06 Feb '06

06 Feb '06

Hi, the tproxy-2.0.3-for-2.6.15 you last sent me has the following problem with 2.6.16-rc1: 16:16 shanghai:/home/jengelh # iptables -t tproxy -L iptables v1.3.3: can't initialize iptables table `tproxy': Table does not exist (do you need to insmod?) Perhaps iptables or your kernel needs to be upgraded. 16:16 shanghai:/home/jengelh # lsmod | grep -i tprox iptable_tproxy 14340 0 ip_nat 17600 1 iptable_tproxy ip_conntrack 45516 2 iptable_tproxy,ip_nat ip_tables 9624 1 iptable_tproxy Jan Engelhardt -- | Software Engineer and Linux/Unix Network Administrator | Alphagate Systems, http://alphagate.hopto.org/ | jengelh's site, http://jengelh.hopto.org/

2 2

can't tproxying in special case
by wckwon 17 Jan '06

17 Jan '06

Hi. In special network condition, I found that TPROXY didn't work. I tried to change source ip to another using below code. ==================== CODE START ======================== itp.op = TPROXY_ASSIGN; itp.v.addr.faddr = (another); itp.v.addr.fport = htons(0); setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)); itp.op = TPROXY_FLAGS; itp.v.flags = ITP_CONNECT; setsockopt(s, SOL_IP, IP_TPROXY, &itp, sizeof(itp)); ==================== CODE END ========================== It goes well when general TCP/IP state. But in case tcp sequence number of received packet is something wierd, LINUX tcp/ip stack make be zero sequence number and ack number. And source ip address is not changed !!! Of cource other sessions's source ip address is changed very well. Especially only if I connect to windows system, this is occurred. My System Info: O S : linux-2.6.9 TRPOXY verserion : 2.0.1 ETC. : Using Bridge network Now, I am studying TCP/IP kernel stack. And My eyes and my head is very dizzy. Thanks.

1 0