- tproxy - lists.balabit.hu

ACCEPT LOCAL PACKETS
by maria isabel 31 May '11

31 May '11

Hello, This sysctl parameter (accept_local) is available from kernel version 2.6.34 onwards.Is it possible to isolate it as a loadable kernel module?It affects core routing functionality and the general opinion is to extract the patch and recompile the entire kernel.The patch was under Patrick's name http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.39.y.git;a=commi… Regards, Maria

1 0

Port redirection in TCP and SCTP
by maria isabel 17 May '11

17 May '11

Hello, I was going through the historical mail archives for tproxy in tcp and I found some changed functionality related to the hash tables and port redirection when TPROXY is involved. In SCTP the flow is proceeding as follows -Socket lookup in xt_TPROXY and xt_socket modules -Store the socket reference in skb->sk and redirect the packet -In input.c in sctp the association and endpoint structures are filled but the socket is reused from skb->sk?? Is this alright? If this is not alright we can also store the entire endpoint structure reference containing the socket in skb->cb and forward it to input.c after redirection. -Now INIT-ACK comes from the TPROXY port and not from the original destination port.By looking at the tcp patches I can see that you are storing and reusing this information and also adding an entry in the hash table to get the reply from the original port and not the tproxy port. Can somebody please tell me how to go about on the port redirection part and hash table part as I have no idea? Also I'm getting confused reading the mail archives as the design for TPROXY was changed (earlier it was a bit different I presume not using the IP_TRANSPARENT and the mangle tables) If you can tell me the outline followed for TCP I can look for similar equivalent functionality in SCTP and modify. It would be a lot quicker considering the deadline I'm on. :( The background behind all of this is we are trying to build a Load Balancer which will accept and route upto 2 million connections from clients.TPROXY is the core element for this. Thanks and Regards, Maria

1 0

!!Socket getting set to NULL in TPROXY for SCTP
by maria isabel 09 May '11

09 May '11

Hello, I am able to obtain a socket reference by doing a socket look-up in the xt_socket module.After this somehow the following code gets hit if (wildcard || !transparent){ printk(KERN_INFO "Inside not transparent or wildcard xt_socket"); sk = NULL; } I am sure the socket is transparent so I am assuming it satisfies the wildcard case here. socket match: proto 132 0aff0d8c:40480 -> 0aff0d9e:3127 (orig 0aff0d9e:3127) sock (null) sk gets set to null.Can you please tell me how to resolve this? What is the flow of the TPROXY module?My understanding is as follows -When a packet comes first it hits xt_socket -When this fails it hits xt_TPROXY I am able to get this trace from xt_TPROXY when I specify a port number in the TPROXY rule. iptables -t mangle -A PREROUTING -p sctp -i bond0.110 --*dport 1500* -j TPROXY --tproxy-mark 1 --on-port 3127 I get this trace redirecting: proto 132 0aff0d9e:1500 -> 00000000:3128, mark: 1 But this never comes when I make the rule iptables -t mangle -A PREROUTING -p sctp -i bond0.110 --*dport 0* -j TPROXY --tproxy-mark 1 --on-port 3127 Can someone please explain this to me.For TCP I am able to successfuly get a socket reference socket match: proto 6 0a8e8ea6:4576 -> 0aff0d9e:22 (orig 0aff0d9e:22) sock * ffff88041d3a54c0* For SCTP my design is as follows -I do the lookup and store the TPROXY port number in skb->cb and redirect the packet -Once the packet reaches the sctp module I redo the lookup with the TPROXY port so I get a valid association/endpoint and the global structures required by the sctp module are filled. I get this error also sporadically Regards, Maria

1 0

Re: [tproxy] Sample/test code
by 文剑 08 May '11

08 May '11

Hi, * *I want to write a full transparency proxy too. Squid and haproxy are so complicated that i can't quickly understand how tproxy works. And I am new to iptables. If there is a sample peace of code which is simple, I think it would be helpful. I wrote some code which failed at initiating connections with a foreign address as a source. The reason is timeout while attempting connection. Where am I wrong? Thanks. My code: #define NON_LOCAL_IP "192.168.111.23" #define NON_LOCAL_PORT 2000 int sockfd = socket(AF_INET, SOCK_STREAM, 0); memset (&non_local_addr, 0, sizeof(non_local_addr)); non_local_addr.sin_family = AF_INET; dst_addr.sin_addr.s_addr = inet_addr(NON_LOCAL_IP); inet_pton(AF_INET, NON_LOCAL_IP, &non_local_addr.sin_addr); non_local_addr.sin_port = htons(NON_LOCAL_PORT); setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &optvalue, sizeof(optvalue)); setsockopt(sockfd, SOL_IP, IP_TRANSPARENT, &optvalue, sizeof(optvalue)); bind(sockfd, (struct sockaddr *)&non_local_addr, sizeof(non_local_addr)); memset(&dst_addr, 0, sizeof(dst_addr)); dst_addr.sin_family = AF_INET; dst_addr.sin_addr.s_addr = inet_addr("192.168.1.1"); dst_addr.sin_port = htons(80); connect(sockfd, (struct sockaddr *) &dst_addr, sizeof(dst_addr)); // ETIMEOUT

2 2

sctp module patch
by maria isabel 23 Apr '11

23 Apr '11

Hello, I have attached the sctp patch with the steal socket implementation.But I have one problem and I need your help.With this change the packet gets redirected to the TPROXY port but when it reaches the sctp module it gets dropped and an ABORT chunk is issued.What could be the reason?This does not happen in tcp and udp.Normal sctp flow is proper on other ports apart from the TPROXY port.I am able to see this trace. * * *redirecting: proto 132 0aff0d9a:1500 -> 00000000:3127, mark: 1* ** My rule is iptables -t mangle -A PREROUTING -p sctp --dport 1500 -j TPROXY --on-port 3127. Inside the sctp module when the packet is redirected the association lookup is done with port 1500 and not 3127. I think the local address is initialised that way or something.Please help me!! Regards, Maria

2 1

Sample/test code
by Sumedh Sathaye 23 Apr '11

23 Apr '11

Hello, I am a new user of TPROXY, and wonder if there is an answer to this question already. Is there a sample piece of proxy (user process) code that I can look at to quickly understand how to write such a proxy? I looked at squid, stunnel etc. codes, but deciphering those is harder than I thought. Netcat version mismatch is another story altogether. Can anyone point to sample transparent proxy code that uses the TPROXY feature? If it does not exist, then I think it should be created :-) Sumedh

2 1

Tproxy with mikrotik
by faresacmp farescamp 22 Apr '11

22 Apr '11

Hi, I ran Tproxy and and i have a mikrotik as a router ,I wanto redirect all of my lan traffice to Tproxy squid,i have mark packet all of lan traffic and route this marked packets to the squid tproxy but that's not worked for me ,can anyone help me? LAN---MIKROTIK---INTERNET | SQUID[TPROXY] Majid Mohsen Beigi.

1 0

TPROXY for SCTP diff attached
by maria isabel 31 Mar '11

31 Mar '11

Hello All, Attaching the diff file as you had requested. Thanks and Regards, Maria

1 0

sctp for tproxy
by maria isabel 20 Mar '11

20 Mar '11

Hello All, I have attached the code snippet for extending tproxy to support sctp functionality. For the socket lookup I use: struct sock *nf_tproxy_get_sock_sctp4(const struct sk_buff *skb){ struct sctp_association *asoc; union sctp_addr *saddr , *daddr; struct sctp_transport **transport; struct sctphdr *sh; struct sock *sk; void *temp; void *temp1; memset(saddr,0,sizeof(saddr)); memset(daddr,0,sizeof(daddr)); saddr->v4.sin_family = AF_INET; daddr->v4.sin_family = AF_INET; sh = sctp_hdr(skb); temp=&ip_hdr(skb)->saddr; temp1=&ip_hdr(skb)->daddr; memcpy(&saddr->v4.sin_addr.s_addr,temp, sizeof(struct in_addr)); memcpy(&daddr->v4.sin_addr.s_addr,temp1, sizeof(struct in_addr)); asoc = __sctp_get_association(saddr, daddr, transport); if (!asoc) sk=NULL; sk = asoc->base.sk; return sk; } This function I plan to invoke from both xt_TPROXY.c and xt_socket.c for sctp instead of the existing function for tcp and udp. if(iph->protocol == IPPROTO_TCP || iph->protocol == IPPROTO_UDP){ sk = nf_tproxy_get_sock_v4(dev_net(skb->dev), iph->protocol, iph->saddr, tgi->laddr ? tgi->laddr : iph->daddr, hp->source, tgi->lport ? tgi->lport : hp->dest, par->in, true); } else if(iph->protocol == IPPROTO_SCTP){ sk = nf_tproxy_get_sock_sctp4(skb); } Have I missed out any condition during the socket lookup ? What about the icmp support?Can I just reuse the existing functionality by adding sctp to the list of protocols? Thanks and Regards, Maria

2 1

please help me
by faresacmp farescamp 06 Mar '11

06 Mar '11

Hi, I setup a debian Squid server as topology as below: INTERNET---- MIKROTIK========SQUID3---CLIENTS My client connect via pppoe tunnel to the mikrotik device for some accounting issue . I ran bridge interface in debian(kernel 2.6.30 and iptables 1.4.8 ), when clients connect via pppoe tunnel to the mikrotik ,debian bidge interface cant redirect traffic to the squid and my squid server can not cache the web traffc but when i set default gateway in my client without pppoe everything works fine and the Squid caching work properly. I wanto know what should i do to redirect traffic to squid when client using pppoe connection. I researched my problem many many times in the intenet without any result,Please help me .

2 1