- tproxy - lists.balabit.hu

Re: [tproxy] squid, cttproxy, and a redirector script
by Wayne Smith 06 Apr '05

06 Apr '05

Sorry for the self follow up, but a little more info The workstation that is doing the requesting ends up receiving packets with syn/ack set. The workstation that did the requesting never actually creates an initial syn packet to the apache server (squid was doing that in it's behalf after getting the response from the redirector script). What type of packet mangling is required to have the locally produced (but spoofed) syn from squid get its response to occur locally? Again, I'm hoping I have the right forum. It's a patched kernel to allow the truly transparent proxy, but it's also a hacked squid to take advantage of that functionality. As far as I can tell, squid is doing it's job making the connection to apache, but the reply ends up going out the NIC to the workstation instead of being grabbed and thrown back to squid. Any help appreciated. Wayne

2 1

RE: [tproxy] Tproxy Problem
by KOVACS Krisztian 06 Apr '05

06 Apr '05

Hi, 2005-04-06, sze keltezéssel 10.57-kor Karthika_Rallabandi ezt írta: > Thanks for the immediate response. > Yeah I applied the patch for iptables user space. > I downloaded the iptables-1.2.9 and performed the following steps as > mentioned in README > cd /usr/src/iptables-1.2.9 > cat <pathtocttproxy>/iptables/*.diff | patch -p1 > make KERNELDIR=/usr/src/linux > But I couldn't find libipt_TPROXY.so in /lib/iptables. > I tried to compile libipt_TPROXY.c in iptables/extensions/libipt_TPROXY.c > but couldn't succeed. It gave errors in .h files like INT_MIN undeclared > etc. > I tried to include kernel.h file also but of no use. Ok, then please try the following * apply the kernel patch first, and make sure you set KERNELDIR to the path of the patched source * after applying the iptables patch, make sure that extensions/.tproxy-test is executable: -- Regards, Krisztian Kovacs

1 1

Tproxy Problem
by Karthika_Rallabandi 05 Apr '05

05 Apr '05

hi, I am working on transparent proxy from code downloaded from link http://www.balabit.com/products/oss/tproxy <http://www.balabit.com/products/oss/tproxy> . I applied all the patches as given in README. But when I run iptables -t tproxy -A PREROUTING -j TPROXY --on-port 9999 it is giving following error. "iptables v1.2.7a: Unknown arg `--on-port'". The following are the options I selected in make menuconfig. [*] Network packet filtering (replaces ipchains) <*> Unix domain sockets [*] TCP/IP networking [*] IP: multicasting IP: Netfilter Configuration ---> <*> Connection tracking (required for masq/NAT) <*> IP tables support (required for filtering/masq/NAT) < > Packet filtering <*> Full NAT < > MASQUERADE target support <*> REDIRECT target support [ ] NAT of local connections (READ HELP) <M> Transparent proxying <M> TPROXY target support <M> tproxy match support <M> ARP tables support If anybody is working on this Plz help me. Thanks in advance for help. Regards, Karthika. ************************************************************************** This email (including any attachments) is intended for the sole use of the intended recipient/s and may contain material that is CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or copying or distribution or forwarding of any or all of the contents in this message is STRICTLY PROHIBITED. If you are not the intended recipient, please contact the sender by email and delete all copies; your cooperation in this regard is appreciated. **************************************************************************

2 1

squid, cttproxy, and a redirector script
by Wayne Smith 05 Apr '05

05 Apr '05

I'm not sure what the best list for this issue is, so I'm starting here. If I got it wrong, please point me in the right direction after your done flaming ;) Background: ---------------- Fedora FC2 box, kernel 2.6.10 with AC and tproxy patches applied Squid 2.5 Stable 5, transparent proxy patch applied. ebtables and iptables All the above is working just fine and transparent redirection is happening without issue. The origin webserver sees the IP address of the client and life is pretty happy. Upon noticing that Microsoft is making it, shall we say hard?, to cache windowsupdates, I stumbled across http://www.glob.com.au/windowsupdate_cache/ It's a set of three perl scripts. It basically will wget a windows patch, store it on a local server, and then in the future rewrite the requests from squid so that the content is pulled locally. redir.pl does the redirection part. redir.pl is working and kicks out the right URL /usr/local/bin/redir.pl download.microsoft.com/download/1/2/a/12a31f29-2fa9-4f50-b95d-e45ef7013f87/… 192.168.1.1 bob GET get's rewrote to http://127.0.0.1/cache/store/download.microsoft.com/download/1/2/a/12a31f29… The problem is the file never comes down. I've also tried redir.pl rewriting the URI to use the boxes legitimate IP. Same thing. Eventually you get the squid timeout. the ebtables and iptables rules in use --------------------------------------- ebtables -t broute -A BROUTING -i eth1 -p IPv4 --ip-protocol 6 --ip-destination-port 80 --ip-source $1 --ip-destination ! x.x.x.0/24 -j redirect --redirect-target ACCEPT iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 -s $1 -d ! x.x.x.0/24 -j REDIRECT --to-port 3128 Pretty straight forward... if it's IP and destined for TCP port 80, let IPTABLES see it (unless it's aimed for a local network). Iptables takes it and ships it to port 3128 for squid to party. This is working great for 'just' going through the proxy and hitting remote webservers. While working on getting the redirector script and everything to work, I was for some reason able to push a few files out (not sure how in testing they got wedged into working). Here's where 2003 sp1 gets redirected and pulled redir.pl's log --------------- [Tue Apr 5 09:00:32 2005] cachehit 345322744 download.microsoft.com/download/1/2/7/127c5938-d36a-4405-9df1-f00d57495652/… tethereal -i lo -------------------- Capturing on lo 0.000000 127.0.0.1 -> 127.0.0.1 TCP 46624 > 46623 [PSH, ACK] Seq=0 Ack=0 Win=8192 Len=147 TSV=2861348298 TSER=2858781735 0.016805 127.0.0.1 -> 127.0.0.1 TCP 46623 > 46624 [PSH, ACK] Seq=0 Ack=147 Win=8192 Len=147 TSV=2861348315 TSER=2861348298 0.016830 127.0.0.1 -> 127.0.0.1 TCP 46624 > 46623 [ACK] Seq=147 Ack=147 Win=8192 Len=0 TSV=2861348315 TSER=2861348315 and the file comes down at a health 7 MB/second. Here's the same info with the process breaking. In this case, a copy of Media Player 10 0.000000 127.0.0.1 -> 127.0.0.1 TCP 46624 > 46623 [PSH, ACK] Seq=0 Ack=0 Win=8192 Len=118 TSV=2861551908 TSER=2861348315 0.000357 127.0.0.1 -> 127.0.0.1 TCP 46623 > 46624 [PSH, ACK] Seq=0 Ack=118 Win=8192 Len=118 TSV=2861551909 TSER=2861551908 0.000378 127.0.0.1 -> 127.0.0.1 TCP 46624 > 46623 [ACK] Seq=118 Ack=118 Win=8192 Len=0 TSV=2861551909 TSER=2861551909 0.000656 x.x.x.98 -> 127.0.0.1 TCP 56643 > http [SYN] Seq=0 Ack=0 Win=32767 Len=0 MSS=16396 TSV=2861551909 TSER=0 WS=2 3.000252 x.x.x.98 -> 127.0.0.1 TCP 56643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861554909 TSER=0 WS=2 8.999440 x.x.x.98 -> 127.0.0.1 TCP 56643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861560909 TSER=0 WS=2 20.997818 x.x.x.98 -> 127.0.0.1 TCP 56643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861572909 TSER=0 WS=2 44.993570 x.x.x.98 -> 127.0.0.1 TCP 56643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861596909 TSER=0 WS=2 59.107596 x.x.x.98 -> 127.0.0.1 TCP 57640 > http [SYN] Seq=0 Ack=0 Win=32767 Len=0 MSS=16396 TSV=2861611025 TSER=0 WS=2 62.107252 x.x.x.98 -> 127.0.0.1 TCP 57640 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861614025 TSER=0 WS=2 68.106443 x.x.x.98 -> 127.0.0.1 TCP 57640 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861620025 TSER=0 WS=2 80.104816 x.x.x.98 -> 127.0.0.1 TCP 57640 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861632025 TSER=0 WS=2 104.100569 x.x.x.98 -> 127.0.0.1 TCP 57640 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861656025 TSER=0 WS=2 119.118652 x.x.x.98 -> 127.0.0.1 TCP 58643 > http [SYN] Seq=0 Ack=0 Win=32767 Len=0 MSS=16396 TSV=2861671045 TSER=0 WS=2 122.118137 x.x.x.98 -> 127.0.0.1 TCP 58643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861674045 TSER=0 WS=2 128.117322 x.x.x.98 -> 127.0.0.1 TCP 58643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861680045 TSER=0 WS=2 140.115697 x.x.x.98 -> 127.0.0.1 TCP 58643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861692045 TSER=0 WS=2 164.111456 x.x.x.98 -> 127.0.0.1 TCP 58643 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2861716045 TSER=0 WS=2 redir.pl's log entry [Tue Apr 5 09:03:55 2005] cachehit 12754672 download.microsoft.com/download/1/2/a/12a31f29-2fa9-4f50-b95d-e45ef7013f87/… Squid's error "ERROR The requested URL could not be retrieved -------------------------------------------------------------------------------- While trying to retrieve the URL: http://127.0.0.1/cache/store/download.microsoft.com/download/1/2/a/12a31f29… The following error was encountered: Connection Failed The system returned: (110) Connection timed out" here's that same failed request with the redir.pl giving the external IP tethereal -i lo Capturing on lo 0.000000 127.0.0.1 -> 127.0.0.1 TCP 37898 > 37897 [PSH, ACK] Seq=0 Ack=0 Win=8192 Len=118 TSV=2862173433 TSER=2862151017 0.001160 127.0.0.1 -> 127.0.0.1 TCP 37897 > 37898 [ACK] Seq=0 Ack=118 Win=8192 Len=0 TSV=2862173434 TSER=2862173433 0.001559 127.0.0.1 -> 127.0.0.1 TCP 37897 > 37898 [PSH, ACK] Seq=0 Ack=118 Win=8192 Len=121 TSV=2862173434 TSER=2862173433 0.001569 127.0.0.1 -> 127.0.0.1 TCP 37898 > 37897 [ACK] Seq=118 Ack=121 Win=8192 Len=0 TSV=2862173434 TSER=2862173434 0.001950 x.x.x.98 -> x.x.y.7 TCP 38323 > http [SYN] Seq=0 Ack=0 Win=32767 Len=0 MSS=16396 TSV=2862173435 TSER=0 WS=2 3.002299 x.x.x.98 -> x.x.y.7 TCP 38323 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2862176435 TSER=0 WS=2 9.001486 x.x.x.98 -> x.x.y.7 TCP 38323 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2862182435 TSER=0 WS=2 20.998860 x.x.x.98 -> x.x.y.7 TCP 38323 > http [SYN] Seq=0 Ack=0 Win=131068 Len=0 MSS=16396 TSV=2862194435 TSER=0 WS=2 It's like the socket isn't happening for some reason. The connection never happens and the process times out with the same squid error (only now with the external IP in the unable to retrieve URL). The apache webserver logs don't show anything for the sessions that timeout. The client can pull up the apache webpage when directly typed in. Any thoughts on how to get this process to cooperate or how to continue troubleshooting would be appreciated! I've been staring at it a bit and I'm stumped. Wayne

1 0

Unable to insmod
by Karthika_Rallabandi 04 Apr '05

04 Apr '05

Hi, I just started using tproxy. I am still in the understanding phase of this module. I have a small doubt.. following all the steps in the readme file.. I am at a stage of inserting iptables_tproxy.o module . Its exiting with the following error. Iptables_tproxy.o : couldn't find the kernel version it is compiled for. I am running linux.2.4.24 version & had taken the same setup file . I know that the first option that comes into anyones' mind about this error , is the version of linux under which I am running. But I have checked it using ' uname -r' and it says " 2.4.24 " What could be the problem?? Could you please look into this as soon as possible. Regards, Karthika. ************************************************************************** This email (including any attachments) is intended for the sole use of the intended recipient/s and may contain material that is CONFIDENTIAL AND PRIVATE COMPANY INFORMATION. Any review or reliance by others or copying or distribution or forwarding of any or all of the contents in this message is STRICTLY PROHIBITED. If you are not the intended recipient, please contact the sender by email and delete all copies; your cooperation in this regard is appreciated. **************************************************************************

1 0

Reg installing tproxy
by Mohammed Riyaz 01 Apr '05

01 Apr '05

Hi, I was looking through the trpoxy read me file and came across To apply all patches except the 04-nat_delete: cd /usr/src/linux for i in <pathtocttproxy>/patch_tree/0{0,1,2,3}*.diff; do cat $i | patch -p1; done then enable conntrack, nat and tproxy support in your kernel config. i looked through the .config file but could not find either of these three (conntrack, nat and tproxy). Could you please tell me what the above statement means. I am trying to setup squid transparent to both the server and client. Thank you, Mohammed Riyaz P.

1 0

TProxy packages for 2.6.10 and 2.4.29 released
by KOVACS Krisztian 03 Feb '05

03 Feb '05

Hi, TProxy tarballs for 2.6.10 and 2.4.29 are available for download on the usual page: http://www.balabit.com/downloads/tproxy/ There were no significant changes in TProxy itself, but changes in the Netfilter code supplied with these kernels made older TProxy tarballs incompatible with these versions of the Linux kernel. Please note that the vanilla 2.6.10 release contains a serious bug in the TCP connection tracking code, so if you plan to use that on production systems make sure that the appropriate patch[1] is applied. I've also updated the window tracking code for Linux 2.4 included in the 2.4 tarball for TProxy, this fixes a couple of problems found after the inclusion of the code in Linux 2.6.9. As always, 04-nat_delete.diff is completely optional, please do not apply that patch unless you _really_ know what you're doing. MD5 checksums of the two tarballs: MD5: 2c9e4da79488794cc046357e34282c47 cttproxy-2.4.29-2.0.0.tar.gz MD5: 67f2806136549972c19258ffc7fb7a08 cttproxy-2.6.10-2.0.0.tar.gz [1]: https://lists.netfilter.org/pipermail/netfilter-devel/2004-December/017908.… -- Regards, Krisztian Kovacs

1 0

Performance problem of tproxy
by Siming Li 03 Feb '05

03 Feb '05

Dear all, I test the performance of TPROXY (cttproxy-2.4.20-14) on a dual XEON, Giga-bit machine. The environment setting is: Client <-------> Proxy <---------> Server #1: With TPROXY, fully transparent (both to client and to server) #2: Without TPROXY, no transparency, client connects to proxy directly. #3: With iptables built-in REDIRECT, Half transparent (to client only) #4: With TPROXY, Half transparent (to client only) The results are: #1: 184 Mbits/s #2: 671 Mbits/s #3: 554 Mbits/s #4: 551 Mbits/s From #2 and #4, the overhead of one NAT is 120 Mbits/s. #1 (fully transparency) is too bad....It should be around 430 Mbits (671 - 120 * 2 since two NATs ) Does anyone know why the performance drops so drastically when using fully-transparency??? Thanks, Eric Li __________________________________ Do you Yahoo!? Yahoo! Mail - 250MB free storage. Do more. Manage less. http://info.mail.yahoo.com/mail_250

2 3

squid+tproxy+bridge for transparent proxying
by Eskay Lee 17 Jan '05

17 Jan '05

Hi, I setup linux+bridge+squid+tproxy to see the client IP address on Web server. As the manuals, I configured all the patches and parameters. In squid.conf, I did "linux_tproxy on" but I don't know how to set "tcp_outgoing _address". My squid box is a just bridge not Gateway. Please let me know How to set "tcp_outgoing_address" on bridge mode. Also I put the one IP address, i.e, 10..1.1.100 as tcp_outgoing_address, web server is 10.1.1.120. Then If I browse the URL on Web server, I got the error like followings: ERROR The requested URL could not be retrieved . Socket Failure (99) Cannot assign requested address How can I solve this problem? Also Can I use some gzip compression mode on Squid ? Expecting your kind response.. Eskay Lee

3 2

squid+tproxy+bridge for transparent proxying
by Eskay Lee 12 Jan '05

12 Jan '05

Hi, I setup linux+bridge+squid+tproxy to see the client IP address on Web server. As the manuals, I configured all the patches and parameters. In squid.conf, I did "linux_tproxy on" but I don't know how to set "tcp_outgoing _address". My squid box is a just bridge not Gateway. Please let me know How to set "tcp_outgoing_address" on bridge mode. Also I put the one IP address, i.e, 10..1.1.100 as tcp_outgoing_address, web server is 10.1.1.120. Then If I browse the URL on Web server, I got the error like followings: ERROR The requested URL could not be retrieved . Socket Failure (99) Cannot assign requested address How can I solve this problem? Also Can I use some gzip compression mode on Squid ? Expecting your kind response.. Eskay Lee

1 0