- tproxy - lists.balabit.hu

tproxy on 2.6?
by Lennert Buytenhek 05 Jan '04

05 Jan '04

Hi, What would be needed to get the tproxy stuff to work on 2.6? thanks, Lennert

2 4

Difficulty in installing Zorp!
by Elwin Eliazer 30 Dec '03

30 Dec '03

Hi, I am trying to install Zorp in my Compaq desktop, running RedHat 9.0. Recently i upgraded the kernel to 2.4.22, from 2.4.20-6, to be able to use the TPROXY. I got most of the steps through. But i am stuck in getting the Python Ext class 1.2 installed, since there appears to be some compatibility issues, in the thread.h file. RedHat 9 comes with Python 2.2, whereas the Zorp INSTALL file suggests Python 1.5 or 2.1. Can i assume 2.2 is ok for Zorp? RedHat 9 does not come with PythonExtClass. So i downloaded the SRPM from rpmfind.net, for python-extclass-1.2_1. I am getting build problems around the ThreadLock.c and thread.h file. I also see a ThreadLock.c.orig file, and the difference between the two is the way in which thread.h is included, and some definitions. I tried copying the orig file back to .c and then also i continue to get compilation errors. Your suggestions and help will be appreciated. cheers, Elwin. ===== __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/

1 0

Re: [tproxy] tproxy on 2.6?
by KOVACS Krisztian 19 Dec '03

19 Dec '03

Hi, 2003-12-19, p keltezéssel 13:31-kor Peter Busser ezt írta: > > Not much, at least in theory. 1.2.0 should be nonlinear skb > > compatible, and Netfilter has not changed much. However, sockopt numbers > > used by tproxy has been officially allocated to the in-kernel IPSEC, so > > tproxy for 2.6 won't be binary compatible with current versions... :( > > Can't you change the sockopt numbers in the 2.4 patch, to make it binary > compatible with 2.6? Being stuck to one kernel version because of tproxy stuff > is not really a good thing IMHO. Yes, it is a really bad thing. However, we can't do much about that. We should change the sockopt numbers sooner-or-later, even in the 2.4 patch. But this breaks binary compatibility for binaries using these sockopts which were compiled for the old interface. Also note, that some software using tproxy (Zorp, for example) has its own copy of ip_tproxy.h. This is necessary to be able to compile Zorp (with transparent proxying support) even on machines which were not patched with the tproxy patch. When changing those numbers, these distributions need to be updated as well. So, welcome to binary incompatibility hell. :( > Also note that the latest Debian unstable 2.4 kernels contain a backport of > the 2.6 IPSEC stack. Does it v1.2.0 conflict with the sockopt numbers in that > kernel too? Yes, I know that. And yes, of course it means it conflicts with those kernels, too... :( -- Regards, Krisztian KOVACS

1 0

Need TPROXY for 2.4.20-6 kernel
by Elwin Eliazer 18 Dec '03

18 Dec '03

Hi all: I am trying to install Zorp in my Linux desktop PC, running RedHat 9.0, which has Linux kernel 2.4.20-6. This requires installation of TPROXY, but i could not find a compatible version of TPROXY in the following link. The old link, shows only 2.4.20.12, etc. But could not find any 2.4.20-6 there. http://www.balabit.com/downloads/tproxy/linux-2.4/ I am not planning to upgrade my linux kernel to a newer version as of now, and your suggestions would be appreciated. cheers, Elwin. ===== __________________________________ Do you Yahoo!? New Yahoo! Photos - easier uploading and sharing. http://photos.yahoo.com/

3 2

tproxy 1.2.0 for Linux 2.4.22
by KOVACS Krisztian 10 Dec '03

10 Dec '03

Hi, I've created a tproxy 1.2.0 release for Linux 2.4.22. It's almost the same as the 2.4.23 patch released yesterday, the only changes are a few extra lines of code in conjunction with the NAT core changes between 2.4.22 and 2.4.23. As always, the tarball is available from: http://www.balabit.com/downloads/tproxy/linux-2.4/ MD5 checksum of cttproxy-2.4.22-1.2.0.tar.gz: c44929bb23fd87a7b4ad4072708a46c6 -- Regards, Krisztian KOVACS

1 0

tproxy version 1.2.0 released
by KOVACS Krisztian 09 Dec '03

09 Dec '03

Hi, TProxy 1.2.0 has been released. This is the first the release of the 1.2 stable branch, with substantial changes since 0.25. From the API standpoint, it is compatible with 0.25. There are no new features, only bugfixes and internal changes. More important internal changes: - new connection tracking entry deletion code, which does not require scanning the whole connection tracking hash - a completely rewritten /proc/net/tproxy interface - hooks into the network stack at more appropriate points (right after TCP/UDP unhash) NOTE: this release is strictly for Linux 2.4.23, it is _not_ compatible with 2.4.22 (and earlier). Even though the patch may apply without problems, it _will_not_work_. If you really need it, please let me know. The experimental NAT entry reuse patch is also in the package, however, please do not use it unless you really have to. (You may try it if you have a lot of TCP traffic and you see "failed to apply NAT mapping" messages. It causes the NAT core drop clashing transparently proxied TCP connections in the TIME_WAIT state, which may help a lot in certain cases.) As always, the package is available from http://www.balabit.com/downloads/tproxy/linux-2.4/ MD5 checksum of cttproxy-2.4.23-1.2.0.tar.gz: 12e8730a95640be3b73f0a05758f08c0 -- Regards, Krisztian KOVACS

2 1

TProxy implementation.
by 강기호 26 Nov '03

26 Nov '03

Hello. I'm trying to make transparent proxy for controlling HTTP access to web- server. All was implemented in Kernel 2.4.19. So, I used on kernel's instead user-mode functions, tcp_setsockopt for setsockopt, sk for sock, memcpy for copy_from/to_user. Before sk->prot->connect(=tcp_v4_connect) to server setted tproxy like below : memset(itp, 0x00, sizeof(struct in_tproxy)); memcpy(&(itp->itp_faddr.s_addr), &(client->sk->daddr), sizeof(struct in_addr)); itp->itp_fport = 0; memcpy(&(server->sk->rcv_saddr), &(client->sk->saddr), sizeof(struct in_addr)); tperr = sk->prot->setsockopt(sk, SOL_IP, IP_TPROXY_ASSIGN, (char *)itp, sizeof(struct in_tproxy)); flags = ITP_CONNECT; tperr = sk->prot->setsockopt(sk, SOL_IP, IP_TPROXY_FLAGS, (char *)&flags, sizeof(int)); And after tcp_close, unsetted tproxy like below : tperr = sk->prot->setsockopt(sk, SOL_IP, IP_TPROXY_UNASSIGN, NULL, 0); And configured iptable : iptables -t nat -A PREROUTING -p tcp -d 10.1.1.10 --dport 80 -j REDIRECT -- to-port 80 I configured my transparent proxy box(has 1 network interface card) with Layer-4 switch(for Cache-Redirect). Just started, Tproxy working fine. Few minutes later, Tproxy send packet with other's foreign address to destination host irregularly. But client received response exactly. When that appeared, my reverse proxy box has 4000 established TCP server connections and hash table size was same. I don't know why that happen. Am I missed or wrong? Thanks.

3 2

tproxy development version 1.1.4
by KOVACS Krisztian 26 Nov '03

26 Nov '03

Hi, Development version 1.1.4 of tproxy has been released. Again, it has no new features, but quite important bugfixes included: - a serious deadlock problem on SMP systems is fixed - packets for which the NAT mapping failed are dropped - a conntrack hash corruption problem is hopefully fixed (1.1.3 had a workaround for it) - /proc/net/tproxy is removed, since it's known to be broken The experimental NAT entry reuse patch is still in the package, however, please do not use it unless you really have to. (You may try it if you have a lot of TCP traffic and you see "failed to apply NAT mapping" messages.) As always, the package is available from http://www.balabit.com/downloads/tproxy/linux-2.4/devel/ MD5 checksum of cttproxy-2.4.22-1.1.4.tar.gz: b9dffe816f340d0516c51db81f3c8f2a -- Regards, Krisztian KOVACS

1 0

TProxy implementation.
by 강기호 06 Nov '03

06 Nov '03

Hello. I'm trying to make transparent proxy for controlling HTTP access to web- server. All was implemented in Kernel 2.4.19 except iptables. So, I replaced set_sockopt with tcp_setsockopt, sock with sk, copy_from/to_user with memcpy. Before sk->prot->connect(=tcp_v4_connect) to server setted tproxy like below : memset(itp, 0x00, sizeof(struct in_tproxy)); memcpy(&(itp->itp_faddr.s_addr), &(client->sk->daddr), sizeof(struct in_addr)); itp->itp_fport = 0; memcpy(&(server->sk->rcv_saddr), &(client->sk->saddr), sizeof(struct in_addr)); tperr = sk->prot->setsockopt(sk, SOL_IP, IP_TPROXY_ASSIGN, (char *)itp, sizeof(struct in_tproxy)); flags = ITP_CONNECT; tperr = sk->prot->setsockopt(sk, SOL_IP, IP_TPROXY_FLAGS, (char *)&flags, sizeof(int)); And after tcp_close, unsetted tproxy like below : tperr = sk->prot->setsockopt(sk, SOL_IP, IP_TPROXY_UNASSIGN, NULL, 0); And configured iptable : iptables -t tproxy -A PREROUTING -p tcp -d 10.1.1.10 --dport 80 -j TPROXY --on-port 80 I configured my transparent proxy box with Layer-4 switch. Just started, Tproxy working fine. Few minutes later, Tproxy send packet with other's foreign address to destination host irregularly. But client received response exactly. When that appeared, my reverse proxy box has over 8000 established TCP connections and hash table size was same with number of server connections. Am I missed or wrong? Thanks.

1 0

Re: [tproxy] tproxy development version 1.1.3
by Tim Burress 06 Nov '03

06 Nov '03

Hi Krisztian, So does this interaction with the NAT tables explain why IP masquerade rules are being ignored when a connection is tproxied? I wonder if there is a good way around that? Thanks! Tim __________________________________ Do you Yahoo!? Protect your identity with Yahoo! Mail AddressGuard http://antispam.yahoo.com/whatsnewfree

3 4