- tproxy - lists.balabit.hu

cttproxy-2.4.21-15.tar.gz compilation error.
by Yoshioka Tsuneo 26 Jun '03

26 Jun '03

Hello I have tried to compile 2.4.21 kernel with cttproxy-2.4.21-15.tar.gz. But when I set following kernel options with TPROXY, I got compile error for prototype mismatching. [Networking Options] = [IP: Netfilter Configuration] = [Connection tracking] = [Amanda protocol support] : * = [TFTP protocol support] : * With following patch, I could compile correctly. ************************************************************************* --- linux-2.4.21/net/ipv4/netfilter/ip_nat_tftp.c-orig Thu Jun 26 15:39:08 2003 +++ linux-2.4.21/net/ipv4/netfilter/ip_nat_tftp.c Thu Jun 26 15:39:33 2003 @@ -135,7 +135,7 @@ NIPQUAD(orig->src.ip), ntohs(orig->src.u.udp.port)); } - return ip_nat_setup_info(ct,&mr,hooknum); + return ip_nat_setup_info(ct,&mr,hooknum,0); } static struct ip_nat_helper tftp[MAX_PORTS]; --- linux-2.4.21/net/ipv4/netfilter/ip_nat_amanda.c-orig Thu Jun 26 15:26:07 2003 +++ linux-2.4.21/net/ipv4/netfilter/ip_nat_amanda.c Thu Jun 26 15:26:41 2003 @@ -87,7 +87,7 @@ { htons(port) }); } - return ip_nat_setup_info(ct, &mr, hooknum); + return ip_nat_setup_info(ct, &mr, hooknum, 0); } static int amanda_data_fixup(struct ip_conntrack *ct, ************************************************************************** Thank you. --- F-Secure Japan Yoshioka Tsuneo E-MAIL: Tsuneo.Yoshioka(a)f-secure.com

1 0

Both session stealing and src spoofing.(Proxy-Firewall)
by Yoshioka Tsuneo 19 Jun '03

19 Jun '03

Hello Thank you very much for releasing nice software. I am trying to build proxy-firewall on Linux like Firewall-1. On tproxy README documents, I can read following descriptions. 1. Redirect sessions destined to the outer network to a local process using a packet filter rule. 3. Make it possible for a process to initiate a connection with a foreign address as a source. Item #1 can easiliy be done like following by using iptables NAT redirect with normal linux2.4 kernel. # iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 -j REDIRECT --to-port 3128 And, I have also confirmed #3 can be done by using tproxy like following. itp.itp_faddr = client_sin.sin_addr; itp.itp_faddr = client_sin.sin_port; setsockopt(s, SOL_IP, IP_TPROXY_ASSIGN, &itp, sizeof(itp)); setsockopt(s, SOL_IP, IP_TPROXY_FLAGS, &(flags=ITP_CONNECT), sizeof(flags)); But when I am tying to do proxy using both #1 and #3 at the same time, it does not work. After building proxy-server connection, client-proxy NAT table does not work and source port of the packet from proxy to client is not transfered. I have also tested using squid with patch(squid-2.5-tproxy-03.diff) of following URL, but the same problem was happened. http://www.scaramanga.co.uk/ I have tested with cttproxy-2.4.20-14. Is there any hint to solve this problem ? Thank you. -- Yoshioka Tsuneo E-MAIL: Tsuneo.Yoshioka(a)f-secure.com

2 3

stunnel -T (transparency mode)
by Brad Langhorst 31 May '03

31 May '03

I've patched my kernel (debian 2.4.20 pkg) with your latest tproxy patch. and have inserted your iptable_tproxy module iptable_tproxy 9760 0 (unused) iptable_nat 15800 0 [iptable_tproxy] ip_tables 11896 4 [iptable_tproxy iptable_nat] ip_conntrack 19016 1 [iptable_tproxy iptable_nat] I'm now trying to get my stunnel wrapped imapd to report remote ip addresses in the log file. stunnel with the -T switch is supposed to try to listen on a foreign IP address - but i still see May 30 03:14:18 strange imapd[1207]: login: strange[127.0.0.1] bwlang plaintext in my mail.log instead of the 192.168.0.5 that i should see. Do all have any suggestion for making this work or debugging the problem? I think I do not have to set up any sort of iptables rule - is that correct? thanks! brad

2 1

tproxy #14 released
by Balazs Scheidler 26 May '03

26 May '03

Hi, I have released the latest version of our transparent proxying patches. It adds checks for conntrack collisions, that is existing entries in the conntrack table are removed in order to make a successful NAT setup when the connection finally comes in. Earlier it was possible to register a tproxy mapping which could not be fulfilled. The patch is available at http://www.balabit.com/downloads/tproxy/linux-2.4/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Question about tproxy "connection source addres..."
by Tomasz Wrona 19 May '03

19 May '03

Hello, Is it possible that tproxy works in following scheme: a) client_request goes from IP_Client -> b) tproxy/iptables intercept it and redirect it to proxy_server [ie. Squid] binded on IP_Proxy c) proxy sends request for client to reqested_addres but source IP isn't IP_Proxy but is [converted to] IP_Client. Reply is intercepted again and refined inversely... Could it be done in some way? Regards, tw -- PS. Please CC me in reply as I am not a list member. ---------------- ck.eter.tym.pl "Never let shooling disturb Your education"

2 1

TPROXY USAGE
by Dileep Kumar 08 May '03

08 May '03

Hello Bazis, A few questions for you: The IP table entry (iptables -t tproxy -A PREROUTING -dest server_addr -j TPROXY --on-port ) is sending all connections to the proxy. Is this true that I don't need to set any IP table entry, if I am interested only in connections on specific port? In our experiment with TPROXY, one thing that we discovered was that if we are interested only in connections on a specific port, we don't need to set any IP table entry at all. By using setsockopt IP_TPROXY_ASSIGN and IP_TPROXY_FLAGS we could intercept the packet and listen on foreign address and source a foreign address. For PASV FTP, I can bind the port for listen that was sent to the client. I am not sure when will I need to add IP table entry. Second question was when I want to create a connection with foreign address as source address, I need to bind to the local address with a local port. Doing so creates a port management problem? I noticed in your Zorp code in tpsocket file, the autobind function sends zero port. I am assuming, in this case Kernel picks the port. Is this valid usage? Or do I need to manage the ports? Third, I did not see any proxy using the API defined in tpsocket. Do you have any example of a full proxy that is using TPROXY? Thanks Dileep

2 3

TPROXY Usage
by Dileep Kumar 01 May '03

01 May '03

Hello Bazis, A few questions for you: The IP table entry (iptables -t tproxy -A PREROUTING -dest server_addr -j TPROXY --on-port ) is sending all connections to the proxy. Is this true that I don't need set any IP table entry, if I am interested only in connections on specific port? In our experiment with TPROXY, one thing that we discovered was that if we are interested only in connections on a specific port, we don't need to set any IP table entry at all. By using setsockopt IP_TPROXY_ASSIGN and IP_TPROXY_FLAGS we could intercept the packet and listen on foreign address and source a foreign address. For PASV FTP, I can bind the port for listen that was sent to the client. I am not sure when will I need to add IP table entry. Second question was when I want to create a connection with foreign address as source address, I need to bind to the local address with a port. Doing so creates a port management problem? I noticed in your Zorp code in tpsocket file, the autobind function sends zero port. I am assuming, in this case Kernel picks the port. Is this valid usage? Or do I need to manage the ports? Third, I did not see any proxy using the API defined in tpsocket. Do you have any example of a full proxy that is using TPROXY? Thanks Dileep

1 0

Re: installation info
by Balazs Scheidler 25 Apr '03

25 Apr '03

On Wed, Apr 23, 2003 at 08:19:01PM -0700, nitin panjwani wrote: > HI Bazis, > I am trying to install tproxy on 2.4.20. > I am getting some compilation errors when I am trying > to add patch to iptables.(following the instructions > given in README). I am not able to send you snaphot > right now(its in my lab). there is some error in > ../extension/ipt_ECN. I will send you this later today > or tomorrow. my patch does not touch ipt_ECN, so it must be an unrelated problem > > > One more question. Do I need to compile > patched-IPTABLES before compiling kernel or after ?? I > think it should be before... but I am not very sure > and its not clear in README. Can you please clearify > this. it does not matter, all that matters is to tell iptables where to find the patched kernel-tree: # make KERNEL_DIR=/usr/src/linux-2.4.20-tproxy/ (and check whether extensions/.tproxy-test has executable permissions) -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

2 3