- tproxy - lists.balabit.hu

2.0.3-for-2.6.15 compile fix
by Jan Engelhardt 15 Jan '06

15 Jan '06

Hi, this one is needed for 2.6.15-somethingafter0 diff --fast -dpru linux-2.6.15~/net/ipv4/netfilter/iptable_tproxy.c linux-2.6.15/net/ipv4/netfilter/iptable_tproxy.c --- linux-2.6.15~/net/ipv4/netfilter/iptable_tproxy.c 2006-01-15 14:30:36.565060000 +0100 +++ linux-2.6.15/net/ipv4/netfilter/iptable_tproxy.c 2006-01-15 14:32:31.795060000 +0100 @@ -735,9 +735,6 @@ ip_tproxy_setup_nat_bidir(struct ip_conn write_unlock_bh(&ip_tproxy_lock); } } - DEBUGP(KERN_DEBUG "IP_TPROXY: ip_tproxy_setup_nat(): after setupinfo, " - "%p, %p\n", info->bysource.list.prev, info->bysource.list.next); - return res; } #<<eof>> Jan Engelhardt -- | Alphagate Systems, http://alphagate.hopto.org/ | jengelh's site, http://jengelh.hopto.org/

1 0

Questions about tProxy
by rodrigo.santos＠quantiza.com 12 Jan '06

12 Jan '06

Hi all, It's my first contact with the list and would like to know if somebody can help me: I am needing a machine that works as squid transparent, where it I make all the one functions squid common, but that the solicitations leave with origin address IP of the internal customer. I found tProxy in the Net, and would like to know if somebody can help me in some questions: - tProxy necessarily needs to use the Zorp or it it works with the IPTables (since the Zorp has some rules based in the IPTables)? - what I need to install to have a functional machine of the form as I I cited previously? - it exists some good HOWTO about the tProxy installation (that is not the README of the product)? Thanks for all, -- Rodrigo Santos

1 0

Re: [tproxy] Invalid Arguement for setsockopt
by Sai Bathina 04 Jan '06

04 Jan '06

Thanks for the reply. Well the piece of code was testing for the implementation of smtp proxy. So the server has to act as a tproxy. I had resolved the issue. Actually my server is running in the bridge mode and I traced the issue to the config parameter: CONFIG_IP_NF_NAT_NRES if this is set then I am having this problem so I : # CONFIG_IP_NF_NAT_NRES is not set and it worked fine. I am not sure why it resolved but it did. Will it affect something else...I am not sure about that. Thanks Sai On 12/22/05, KOVACS Krisztian <hidden(a)sch.bme.hu> wrote: > > Hi, > > On 2005. December 20. 00.08, Sai Bathina wrote: > > I am seeing that I am getting an Invalid Arguement for setsockopt for > > TPROXY_ASSIGN. > > I have tried this compiling tproxy into the kernel as well as loading > > them as modules. > > First of all, sorry for the delayed answer. > > Obviously, compiling into the kernel and loading as a module should > give exactly the same results. > > > This is the code snippet: > > > > sock = socket(AF_INET, SOCK_STREAM, 0); > > if (sock == -1) > > { > > perror("socket"); > > return -1; > > } > > > > /* check tproxy version*/ > > itp.op = TPROXY_VERSION; > > itp.v.version = 0x02000000; > > if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) > > { > > perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); > > return -1; > > } > > > > /* bind to local address */ > > sin.sin_family = AF_INET; > > sin.sin_addr.s_addr = INADDR_ANY; > > //inet_aton(argv[1], &sin.sin_addr); > > sin.sin_port = htons(9999); > > > > if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) > > { > > perror("bind"); > > return -1; > > } > > > > listen(sock, 5); > > clilen = sizeof(cli_addr); > > newsockfd = accept(sock,(struct sockaddr *) &cli_addr,&clilen); > > if (newsockfd < 0) > > error("ERROR on accept"); > > > > printf("Here is the client: > > %s:%i\n",inet_ntoa(cli_addr.sin_addr.s_addr), > > ntohs(cli_addr.sin_port) ); > > Ok, no problems up to this point. However, the next few lines are > somewhat problematic. > > > /* assign foreign address */ > > itp.op = TPROXY_ASSIGN; > > > > memcpy( &itp.v.addr.faddr, &cli_addr.sin_addr, sizeof( struct > > in_addr ) ); > > > > itp.v.addr.fport = cli_addr.sin_port; > > > > printf("Here is the itp vals for faddr and fport > > %s:%i\n",inet_ntoa(itp.v.addr.faddr), ntohs(itp.v.addr.fport) ); > > > > if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) > > { > > perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); > > return -1; > > } > > Once you've accept()-ed the connection and have a socket, you cannot > do any assignments on the socket because it has the same local endpoint > (IP:port) as the listener socket. By the way, I don't really get what > you're trying to do, so I could probably help you more if you told us > what this piece of the program is supposed to achieve. > > -- > KOVACS Krisztian >

1 0

Undefined symbols in patch for 2.6.14 kernel
by Yigal Rozenberg 04 Jan '06

04 Jan '06

Hi, I was trying to use the latest version of tproxy with the Linux kernel 2.6.14 After compilation when I try to load ip_nat module i got undefined symbols in the dmesg log: READ_LOCK READ_UNLOCK I assume the READ_LOCK can be replaced by ASSERT_READ_LOCK but could not find any similar UNLOCK defines.. Please advise. Cheers

2 2

Re: [tproxy] [RFE] Support for 2.6.15
by KOVACS Krisztian 24 Dec '05

24 Dec '05

Hello, On 2005. December 21. 15.41, Jan Engelhardt wrote: > It would be nice to have patches against 2.6.15-... uh, -rc6. Sorry, I'm pretty much overwhelmed with unrelated work at the moment. Hopefully we don't have to wait too long for the final 2.6.15 release, so I'll do an updated tproxy patch if 2.6.15 comes out. Does this sound acceptable? Oh, and of course Merry Christmas to all tproxy users out there! :) -- Regards, Krisztian Kovacs

2 1

Re: [tproxy] Invalid Arguement for setsockopt
by KOVACS Krisztian 23 Dec '05

23 Dec '05

Hi, On 2005. December 20. 00.08, Sai Bathina wrote: > I am seeing that I am getting an Invalid Arguement for setsockopt for > TPROXY_ASSIGN. > I have tried this compiling tproxy into the kernel as well as loading > them as modules. First of all, sorry for the delayed answer. Obviously, compiling into the kernel and loading as a module should give exactly the same results. > This is the code snippet: > > sock = socket(AF_INET, SOCK_STREAM, 0); > if (sock == -1) > { > perror("socket"); > return -1; > } > > /* check tproxy version*/ > itp.op = TPROXY_VERSION; > itp.v.version = 0x02000000; > if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) > { > perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); > return -1; > } > > /* bind to local address */ > sin.sin_family = AF_INET; > sin.sin_addr.s_addr = INADDR_ANY; > //inet_aton(argv[1], &sin.sin_addr); > sin.sin_port = htons(9999); > > if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) > { > perror("bind"); > return -1; > } > > listen(sock, 5); > clilen = sizeof(cli_addr); > newsockfd = accept(sock,(struct sockaddr *) &cli_addr,&clilen); > if (newsockfd < 0) > error("ERROR on accept"); > > printf("Here is the client: > %s:%i\n",inet_ntoa(cli_addr.sin_addr.s_addr), > ntohs(cli_addr.sin_port) ); Ok, no problems up to this point. However, the next few lines are somewhat problematic. > /* assign foreign address */ > itp.op = TPROXY_ASSIGN; > > memcpy( &itp.v.addr.faddr, &cli_addr.sin_addr, sizeof( struct > in_addr ) ); > > itp.v.addr.fport = cli_addr.sin_port; > > printf("Here is the itp vals for faddr and fport > %s:%i\n",inet_ntoa(itp.v.addr.faddr), ntohs(itp.v.addr.fport) ); > > if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) > { > perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); > return -1; > } Once you've accept()-ed the connection and have a socket, you cannot do any assignments on the socket because it has the same local endpoint (IP:port) as the listener socket. By the way, I don't really get what you're trying to do, so I could probably help you more if you told us what this piece of the program is supposed to achieve. -- Regards, Krisztian Kovacs

1 0

[RFE] Support for 2.6.15
by Jan Engelhardt 21 Dec '05

21 Dec '05

Hi, It would be nice to have patches against 2.6.15-... uh, -rc6. Jan Engelhardt -- | Alphagate Systems, http://alphagate.hopto.org/ | jengelh's site, http://jengelh.hopto.org/

1 0

Invalid Arguement for setsockopt
by Sai Bathina 20 Dec '05

20 Dec '05

I am trying to use the tproxy w/ 2.6.14 kernel w the 2.0.3 patch version. I am running one of the examples(foreign-tcp-connect.c) provided with patch and test the tproxy. I am seeing that I am getting an Invalid Arguement for setsockopt for TPROXY_ASSIGN. I have tried this compiling tproxy into the kernel as well as loading them as modules. This is the code snippet: sock = socket(AF_INET, SOCK_STREAM, 0); if (sock == -1) { perror("socket"); return -1; } /* check tproxy version*/ itp.op = TPROXY_VERSION; itp.v.version = 0x02000000; if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_VERSION)"); return -1; } /* bind to local address */ sin.sin_family = AF_INET; sin.sin_addr.s_addr = INADDR_ANY; //inet_aton(argv[1], &sin.sin_addr); sin.sin_port = htons(9999); if (bind(sock, (struct sockaddr *) &sin, sizeof(sin)) == -1) { perror("bind"); return -1; } listen(sock, 5); clilen = sizeof(cli_addr); newsockfd = accept(sock,(struct sockaddr *) &cli_addr,&clilen); if (newsockfd < 0) error("ERROR on accept"); printf("Here is the client: %s:%i\n",inet_ntoa(cli_addr.sin_addr.s_addr), ntohs(cli_addr.sin_port) ); /* assign foreign address */ itp.op = TPROXY_ASSIGN; memcpy( &itp.v.addr.faddr, &cli_addr.sin_addr, sizeof( struct in_addr ) ); /* Tried with hardcoding foreign ip, did not work inet_aton("172.16.66.127", (struct in_addr *) &itp.v.addr.faddr); */ /*itp.v.addr.fport = htons(2000);*/ itp.v.addr.fport = cli_addr.sin_port; printf("Here is the itp vals for faddr and fport %s:%i\n",inet_ntoa(itp.v.addr.faddr), ntohs(itp.v.addr.fport) ); if (setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == -1) { perror("setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN)"); return -1; } When I run the server with the above code in full and try to connect with a client it gives me the following output. ./fserver Here is the client: 172.16.66.127:41458 Here is the itp vals for faddr and fport 172.16.66.127:41458 setsockopt(SOL_IP, IP_TPROXY, TPROXY_ASSIGN): Invalid argument I am not able to figure out what the issue is here. Any help in this regards will be greatly appreciated. Thanks

1 0

Connction failed
by Jan Engelhardt 12 Dec '05

12 Dec '05

Hi, I am repeatedly getting this in syslog: Dec 9 11:07:54 soko squid[9703]: TCP connection to masterproxy.site/3128 failed HTTP connections do work however. I think this was already mentioned. Using Linux 2.6.13 and tproxy ... 2.6.12 1/2 (the last thing you sent me) Jan Engelhardt --

2 1

TProxy version 2.0.3 for Linux 2.6.14 released
by KOVACS Krisztian 02 Nov '05

02 Nov '05

Hi, A serious bug has been found in TProxy version 2.0.2 running on Linux 2.6 kernels, which has lead to an instantaneous deadlock on SMP systems. The 2.0.2 patch for Linux 2.4 did not contain this bug, so there's no 2.0.3 release for Linux 2.4. The release also contains an updated iptables (userspace) patch contributed by Jan Engelhardt. The release tarball is available here: http://www.balabit.com/downloads/tproxy/ MD5 checksum of the release tarball: 48c4b64a73315ba58413d0f2f1f4067f cttproxy-2.6.14-2.0.3.tar.gz -- Regards, Krisztian Kovacs

1 0