- tproxy - lists.balabit.hu

TPROXY for a UDP listener
by Ramin Dousti 13 Oct '11

13 Oct '11

Hi, I have a linux router that would receive UDP packets through a GRE tunnel that is not destined for the router itself. I'm hosting a UDP listener that is supposed to intercept these UDP packets and reply to them accordingly. What I'm seeing is that the UDP replies (sent by this intercepting process) are being source by the real IP address of the linux box itself and of course the remote end just drops these replies since they do not conform to the src/dst IP and port of the originating socket. So basically my UDP listener does get the UDP requests but the replies have an incorrect src/port. I followed this documet:for the setup: http://www.mjmwired.net/kernel/Documentation/networking/tproxy.txt Can someone help please? -- Ramin

2 1

httpd-2.2.14-tproxy compile error on freebsd
by Dariush Zahedmanesh 27 Sep '11

27 Sep '11

Hello all when we patch httpd.tproxy to httpd-2.2.14, and compile it, it returns some error such as prctl(), capset() undefined reference in freebsd. os/unix/.libs/libos.a(unixd.o): In function `keep_capabilities': /root/httpd-2.2.14/os/unix/unixd.c:82: undefined reference to `prctl' os/unix/.libs/libos.a(unixd.o): In function `set_capabilities': /root/httpd-2.2.14/os/unix/unixd.c:99: undefined reference to `capset' *** Error code 1 Stop in /root/httpd-2.2.14. these two functions are linux syscall that only implements on linux! are any freebsd based of these functions? how we can compile it without any error? -- Best regards Dariush Zahedmanesh

1 0

apache-2.2.14 with httpd-2.2.14.tproxy.patch compile error on freebsd-8.2
by Dariush Zahedmanesh 26 Sep '11

26 Sep '11

Hello all I patched httpd-2.2.14.tproxy on freebsd-8.2 as bellow: 1. tar zxvf httpd-2.2.14.tar.bz2 2. cd httpd-2.2.14 3. patch -p1 < ../httpd-2.2.14.tproxy.patch Hmm... Looks like a unified diff to me... The text leading up to this was: -------------------------- |diff -ru httpd-2.2.14/modules/proxy/mod_proxy_ajp.c httpd-2.2.14.tproxy/modules/proxy/mod_proxy_ajp.c |--- httpd-2.2.14/modules/proxy/mod_proxy_ajp.c 2009-04-25 12:04:21.000000000 +0200 |+++ httpd-2.2.14.tproxy/modules/proxy/mod_proxy_ajp.c 2010-02-17 18:46:47.000000000 +0100 -------------------------- Patching file modules/proxy/mod_proxy_ajp.c using Plan A... Hunk #1 succeeded at 673. Hmm... The next patch looks like a unified diff to me... The text leading up to this was: .... .... .... it seems patch fully successful. 4. ./configure --enable-proxy --enable-proxy-http but when i try to compile it, it return error! 5. make ... /usr/local/share/apr/build-1/libtool --silent --mode=compile cc -g -O2 -I/root/httpd-2.2.14/srclib/pcre -I. -I/root/httpd-2.2.14/os/unix -I/root/httpd-2.2.14/server/mpm/prefork -I/root/httpd-2.2.14/modules/http -I/root/httpd-2.2.14/modules/filters -I/root/httpd-2.2.14/modules/proxy -I/root/httpd-2.2.14/include -I/root/httpd-2.2.14/modules/generators -I/root/httpd-2.2.14/modules/mappers -I/root/httpd-2.2.14/modules/database -I/usr/local/include/apr-1 -I/usr/local/include -I/usr/local/include/db42 -I/root/httpd-2.2.14/modules/proxy/../generators -I/root/httpd-2.2.14/modules/ssl -I/root/httpd-2.2.14/modules/dav/main -prefer-non-pic -static -c unixd.c && touch unixd.lo unixd.c: In function 'keep_capabilities': unixd.c:67: error: 'PR_SET_KEEPCAPS' undeclared (first use in this function) unixd.c:67: error: (Each undeclared identifier is reported only once unixd.c:67: error: for each function it appears in.) unixd.c: In function 'set_capabilities': unixd.c:75: error: 'cap_user_header_t' undeclared (first use in this function) unixd.c:75: error: expected ';' before 'head' unixd.c:76: error: 'cap_user_data_t' undeclared (first use in this function) unixd.c:76: error: expected ';' before 'cap' unixd.c:78: error: 'head' undeclared (first use in this function) unixd.c:78: error: '_LINUX_CAPABILITY_VERSION' undeclared (first use in this function) unixd.c:80: error: 'cap' undeclared (first use in this function) unixd.c: In function 'unixd_setup_child': unixd.c:201: error: 'CAP_NET_ADMIN' undeclared (first use in this function) *** Error code 1 ... how we can solve this error? any help would be great -- Best regards Dariush Zahedmanesh

1 0

Issue with iptables for tproxy
by RDP 22 Sep '11

22 Sep '11

Hi I am trying to build tproxy support for haproxy on Ubuntu 10.04 LTS 64 bit server. The kernel has the tproxy support .config | grep -E '(NF_CONNTRACK=|TPROXY|XT_MATCH_SOCKET|XT_TARGET_TPROXY)' CONFIG_NF_CONNTRACK=m CONFIG_NETFILTER_TPROXY=m CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_NETFILTER_XT_MATCH_SOCKET=m and the iptables version is 1.4.4 Now when I execute the iptables rule iptables -t mangle -A PREROUTING -p tcp -m socket -j DIVERT iptables: No chain/target/match by that name. I get this issue. Any thought or advice will be highly appreciated. regards

1 1

tproxy patch for freebsd-8.2
by Dariush Zahedmanesh 19 Sep '11

19 Sep '11

Hello all I want to use apache tproxy for transparent proxy on freebsd-8.2. is any patch for freebsd kernel and httpd-2.2.17? how can i patch it? Any help would be great -- Best regards Dariush Zahedmanesh

2 1

Tproxy request getting timed-out
by Karthik Vembar 08 Sep '11

08 Sep '11

Hi I am running squid 3.1.15 , kernel version 2.6.32-33-server , Iptables version v1.4.4. I followed the instrcution given on When the client browse using this Squid as gateway, request are getting timed out with following in access.log 1315384947.854 60225 xx.xx.xx.xx TCP_MISS/000 0 GET http://www.google.co.in/url? - DIRECT/www.google.co.in - 1315384949.431 117995 xx.xx.xx.xx TCP_MISS/000 0 GET http://www.google.co.in/url? - DIRECT/www.google.co.in - where xx.xx.xx.xx are client Public Ips Following is the squid setup 1) Network configuration Router ---> squid (eth0 - Public IP) --> Client (Public IP) sysctl -p net.ipv4.conf.default.rp_filter = 1 net.ipv4.ip_forward = 1 cat /boot/config-2.6.32-33-server |grep -E '(NF_CONNTRACK=|TPROXY|XT_MATCH_SOCKET|XT_TARGET_TPROXY)' CONFIG_NF_CONNTRACK=m CONFIG_NETFILTER_TPROXY=m CONFIG_NETFILTER_XT_TARGET_TPROXY=m CONFIG_NETFILTER_XT_MATCH_SOCKET=m iptables -L -t mangle Chain PREROUTING (policy ACCEPT) target prot opt source destination DIVERT tcp -- anywhere anywhere socket TPROXY tcp -- anywhere anywhere tcp dpt:www TPROXY redirect 0.0.0.0:3129 mark 0x1/0x1 Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination Chain DIVERT (1 references) target prot opt source destination MARK all -- anywhere anywhere MARK xset 0x1/0xffffffff ACCEPT all -- anywhere anywhere from squid.conf http_port 3129 tproxy from dmesg [62387.197490] nf_conntrack version 0.5.0 (16384 buckets, 65536 max) [62387.197746] CONFIG_NF_CT_ACCT is deprecated and will be removed soon. Please use [62387.197749] nf_conntrack.acct=1 kernel parameter, acct=1 nf_conntrack module option or [62387.197752] sysctl net.netfilter.nf_conntrack_acct=1 to enable it. [62387.242358] NF_TPROXY: Transparent proxy support initialized, version 4.1.0 [62387.242362] NF_TPROXY: Copyright (c) 2006-2007 BalaBit IT Ltd. Browsing is happening fine in transparent mode using http_port 3128 transparent.. Please help.... -- Karthik Vembar “Condemn none: if you can stretch out a helping hand, do so. If you cannot, fold your hands, bless your brothers, and let them go their own way.” Swami Vivekananda

1 0

TPROXY performance on CentOSv6
by Ritter, Nicholas 09 Aug '11

09 Aug '11

I am testing TPROXY with Squid v3.1.14 on CentOS v6 and noticed several TCP-performance related problems were squid is failing due to TCP session handling issues. CentOS v6 is running a 2.6.32-71.29.1 kernel, and I saw a TPROXY listserv posting from Nov 10, 2010 about TPROXY/Kernel hanging issues and a fix that was merged in and after 2.6.37. My question is if this issue could be the root cause of the problems I am seeing, and if anyone had suggestions for further debugging and solutions. Squid is reporting a higher than normal number of 502 BAD GATEWAY errors and some websites consistently not working. I have testing the squid install without TPROXY and the errors go away, so I know it is TPROXY related. If upgrading the kernel is the way to go, that gets hairy with CentOS and I am not sure which method is the best way to go for upgrading the kernel. Any thoughts or suggestions? Nicholas

2 1

Admin interfacer por tproxy bridge
by Federico Alberto Sayd 28 Jun '11

28 Jun '11

Hello: I am setting up a tproxy on a bridge. I need to sit the tproxy in a network segment whitout public internet range to catch connections from 2 public networks that route through 2 ISP. Documentation for Tproxy4 (http://wiki.squid-cache.org/Features/Tproxy4) says I need a public addres configured on the bridge interface. Obviusly I cant assign a public addres on the bridge interface. I have another interface for administration but when I configure with public ip address, routing fails and the packets aren't redirected to Squid and connections timeouts. Documentation mentions troubles related to bridges with admin interfaces, the doc mentions extra configurations about default routes. The network configuration is the next Router ISP 1 Org net (2 public nets) == Router ==Tproxy-Bridge==Switch= == Internet Router ISP 2 ^^^^^^^^^^^^^^^^^^ Private network How I can configure a third inteface to administrate the tproxy bridge? What parameters I have to modify in order the packets to be routed correctly? Thanks, and sorry for my poor english

1 0

SCTP TPROXY patch--final
by maria isabel 16 Jun '11

16 Jun '11

Hello, I have changed nf_tproxy_core.h (like you had suggested) and xt_TPROXY.c to include SCTP.As of now it is for IPV4 alone and after it is approved I can apply the same change to IPV6. This is for our Load Balancer Network Element which handles SIP and DIAMETER requests and distributes calls to a backend CSCFserver farm for a minimum of 2 million subscribers. It will be great if this change is integrated into the future netfilter tproxy release as maintenance and legal issues will be easy from our side. Please feel free to mail me at my office ID or my personal ID with comments/feedback/suggestions. Apart from TPROXY we are also using xtables-addons (RAWNAT) and ulogd in our project delivered by your community.I don't know which mailing list to contact for these two components. Thanks and Regards, Maria

1 0

Hash locking issue in tproxy
by maria isabel 07 Jun '11

07 Jun '11

Hello, Can someone please explain the hash locking issue in TCP to me?I am facing a similar problem in sctp.I was able to extract the patch but a little help would be useful!!!! Regards, Maria

1 0