- tproxy - lists.balabit.hu

re: Conntrack entries not decreasing
by Mohammed Riyaz 24 Jun '05

24 Jun '05

Hi, >Do you have any patches applied on 2.6.10 apart from tproxy? Vanilla >2.6.10 had a TCP connection tracking bug which caused some TCP >connections linger in the conntrack table for way too much time. Please >take a look at the original tproxy for 2.6.10 announcement in the >mailing list archives: >https://lists.balabit.hu/pipermail/tproxy/2005-February/000171.html I hadnt applied the patch you mentioned. I will try this patch and i hope that solves the problems. >lthough this value depends on your traffic pattern, I'd say 32000 is > bit too low for a dedicated squid proxy. With 512MB RAM you could >afely set that to a higher value (64k for example). and i would experiment with this too :) Thank you, Mohammed Riyaz P. -- http://www.fastmail.fm - mmm... Fastmail...

1 0

reg nat reservations
by Mohammed Riyaz 24 Jun '05

24 Jun '05

Hi, I was looking through the archives when i came across this - " NAT reservations make it possible for tproxy to fail early. If NAT reservations are enabled, tproxy registers "reservations" for foreign addresses to be used later. If such a registration fails, that means that the foreign address is already reserved for some other connection. This is why in that case even the setsockopt() call fails. This is good, since it provides you a way of detecting the error. " While i patched the kernel i applied all the four patched provided, which includes the patch for nat reservations. After reading the above paragraph, i am totally confused. Could you pl. tell when the nat reservations patch needs to be applied. I am mainly using tproxy for squid. So would nat reservations be required in this case. Thank you, Mohammed Riyaz P. -- http://www.fastmail.fm - A no graphics, no pop-ups email service

1 0

tproxy 2.6.10+
by Pásztor Lénárd Zoltán 22 Jun '05

22 Jun '05

Sziasztok! Esetleg meg tudja nekem valaki mondani mikorra varhato tproxy patch frissites? Sajnos csak 2.6.10-es patch-et talaltam de (az xen 2.0.6 miatt) nekem legalabb 2.6.11-es kernelen kene hogy mukodjon. Sajnos nem vagyok toppon C-ben igy magam nem tudom megoldani a conflict-okat. :( Esetleg latott / hallott mar valaki magasabb verzio szamu tproxy patch-rol? URL? Jol gondolom, hogy ha nekem adott 1 szolgaltatas IP es belul tobb webszerver amelyek kulonbozo domaineket szolgalnak ki es szuksegem van az eredeti kliens IP-kre az access.log-okban akkor zorp+tproxy+iptables megoldasra van szuksegem? udv, Lenard

1 0

Conntrack entries not decreasing
by Mohammed Riyaz 21 Jun '05

21 Jun '05

Hi, I am using squid (tproxy patched) on 2.6.10 (tproxy patched). The box crashed after a week of starting it, with kernel panic. I have been monitoring the box since then , and the conntrack entries are always increasing gradually. It does decrease now and then by a marginal amount. The number of entries dosent seem to decrease every during the night when there is hardly any usage. Is the is bug in tproxy patch or is this expected behavior?? If this is expected, then could some one suggest alternatives to reduce the conntrack entries to prevent server from crashing?? Thank you, Mohammed Riyaz P. -- http://www.fastmail.fm - Same, same, but different

2 3

Kernel upgrade
by Jan Engelhardt 20 Jun '05

20 Jun '05

Hello, could the tproxy developers provide a patch against 2.6.11 or .12? The 2.6.10/patch_tree/01-nat_reservations.diff does not apply very well on .11 because of changes in the expect* functions, and I got almost no clue how to fix it (_and_ have it work afterwards ;) Thank you, Jan Engelhardt -- | Gesellschaft fuer Wissenschaftliche Datenverarbeitung Goettingen, | Am Fassberg, 37077 Goettingen, www.gwdg.de

2 6

step by step actions
by Rudolf Amirjanyan 31 May '05

31 May '05

Hello List, I can see that this topic has been discussed many times, and it is possible to find some info from the archives. but maybe someone has a complete reference for doing step by step configuration for transparent proxy with CTTPORXY patch so that the client IP will be shown in web server's side instead of Proxy server's IP address. There is one README with the patch, but it is not clearly describes what to do and how to do :). I hope to get detailed reference or doc with step by step description form the list. thanks in advance. Rudolf

1 0

foreign-tcp-connect times out...
by Ben Pfountz 26 Apr '05

26 Apr '05

Hi, I am trying to write a patch for stunnel to support tproxy, but I am having difficulty getting tproxy configured correctly. I compiled and run the foreign-tcp-connect test program, but after waiting a minute or two, I get the error message: 'connect: connection timed out'. I have the following IP addresses defined in the program: /* an IP address bound to one of the local interfaces */ #define LOCAL_IP "192.168.14.1" /* the IP address to use as source address */ #define FOREIGN_IP "128.173.94.148" /* IP address to connect to */ #define DEST_IP "192.168.14.1" While the program is running, my netstat looks like this: Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 192.168.14.1:80 128.173.94.148:2000 SYN_RECV tcp 0 0 192.168.14.1:22 192.168.14.168:32962 ESTABLISHED tcp 0 1 192.168.14.1:9999 192.168.14.1:80 SYN_SENT tcp 0 0 192.168.14.1:22 192.168.14.168:32973 ESTABLISHED I am using the Linux 2.4.29 kernel, and patch version cttproxy-2.4.29-2.0.0.tar.gz. The kernel and iptables have both been patched and installed. I'm not sure what the problem is, does anyone have any advice? Thanks for your time. Ben

1 0

tproxy query
by spshahnawaz hussain 19 Apr '05

19 Apr '05

Hi all, After applying patches, I am able to divert the packets destined to server to local process on gateway. I have some queries in tproxy. What the patches are exactly doing? or What is exactly being done to make local process bound to local IP to listen to foreign IP(Servers IP)? How this change of IP address is done? or Is it that the destination IP of incoming packets destined to server is replaced with that of our local process IP? Hope I will get my answers. thanks, Shahnawaz. __________________________________ Do you Yahoo!? Plan great trips with Yahoo! Travel: Now over 17,000 guides! http://travel.yahoo.com/p-travelguide

1 0

TProxy version 2.0.1 released
by KOVACS Krisztian 15 Apr '05

15 Apr '05

Hi, Version 2.0.1 of TProxy has been released for Linux 2.4.30 and Linux 2.6.10. This release incorporates fixes for a couple of bug found since the release of version 2.0.0. Please note that due to extensive changes in the Netfilter NAT subsystem of Linux there is no TProxy patch for 2.6.11 yet, this will be released at a later (still unknown) time. The most important bugfix in this release is the addition of another unhash hook to the TCP code; former releases could leak sockrefs under special circumstances. These leaked sockrefs could later lead to 'socket already assigned' warning messages. Besides bugfixes, this release contains a complete, working example of a transparent proxy software using the TProxy patches. This example software, called skaidrus, was kindly contributed by Lennert Buytenhek. Many thanks Lennert! The release tarballs are available at the usual location: http://www.balabit.com/downloads/tproxy/ MD5 checksums of the release tarballs: 3bfc4662f74f876440d0ad33220170fa cttproxy-2.6.10-2.0.1.tar.gz 87d4bd8513a4683f5b74f0dee7919253 cttproxy-2.4.30-2.0.1.tar.gz -- Regards, Krisztian Kovacs

1 0

Re: [tproxy] squid, cttproxy, and a redirector script
by Wayne Smith 11 Apr '05

11 Apr '05

> This seems to be the effect of a limitation of the tproxy kernel >patch: source address faking does not work for traffic sent to >localhost. Unfortunately I don't know of any quick fix for that problem, >so you're left with two choices: > > * you try to configure Squid so that it doesn't try to fake the > source address when connecting to the apache running on > localhost > * you move the apache serving the cached update files to a > separate machine > > I don't know whether or not the first option can be done with the >current Squid patch, but it would be a useful feature to avoid problems >like this one. > >-- > Regards, > Krisztian Kovacs Krisztian While I started coding C about 12 years ago, that was on DOS and it didn't involve TCP sockets ;) If I had more time and a more capable background, I'd probably try to hack squid to not spoof the IP when using the redirector, but... I couldn't (easily or cost effectively) have the apache server outside the squid box. So, after racking my brain (and before getting responses from the folks on the list), came up with a simple solution in the redir.pl script "301:" by the URL... yep, a simple object moved. This gets back to the client allowing it to make the necessary incoming connection. So, if you are doing the truly transparent proxy thing and looking to use windowsupdate_cache script, you might want to modify redir.pl to include 301: with the response it gives to squid. After around 15 hours or solve of tracking and troubleshooting, a copy of vi and about 10 keystrokes would have covered it. If I ever don't have enough sleep (and therefore forget what's currently impossible with my (lack of) coding skills), I might give making a patch for squid a try. Thanks for all the replies back. I hope my answer in the archives helps somebody else out. If it does, I'd love an email to here how other folks are fairing with squid and tproxy. Wayne, fugitive from the cubile police

1 0