April 2005 - zorp-hu - lists.balabit.hu

zorp 3.0.4
by Balazs Scheidler 21 Apr '05

21 Apr '05

hi, Megjelent a Zorp GPL 3.0.4-es verzioja, a valtozasok listaja a http://www.balabit.hu/products/zorp-gpl/upgrades/changelogs/NEWS_zorp-3.0.4… cimen erheto el. Egy konnyen orvosolhato forditasi problemat talaltunk benne, forditas kozben keresni fog egy "zorp/license.h" nevu filet, amit nem talal meg. Erre ket megoldas adodik: * kitorlitek a fenti hivatkozast a lib/zorp.c nevu allomanybol * letrehoztok egy ures license.h nevu allomanyt az /usr/local/include/zorp-ban Modositottunk a forditokornyezetunkon, igy az ilyen jellegu hibak a jovoben mar release kozben kiderulnek. Addig is varhato egy olyan tesztrelease kiadasa, ami a fenti problemat orvosolja. -- Bazsi

3 2

feature ötlet
by Gabor HALASZ 14 Apr '05

14 Apr '05

Nem tudnátok configtest kapcsolót gyártani az zorpctl-hez, az apachectl mintájára?! Production környezetben hasznos lenne, ha konfigurálás és újraindítás között ellenőrizni tudnám, mit gépeltem el. -- Gabor HALASZ <halasz.g(a)nns.hu>

1 0

elnezest kerek
by Kosa Attila 13 Apr '05

13 Apr '05

Hello! Valahogy lekerultem a listarol, igy nem kaptam vissza a sajat levelemet sem, ezert kuldtem el ujra. Irtam a listmaster(a)balabit.hu (visszapattant a levelem), a gyorkoz(a)balabit.hu es a major(a)balabit.hu cimekre, de sehonnan sem kaptam valaszt. Most feliratkoztam ujra. Az archivumban megtalaltam a valaszokat, koszonom szepen. Annyi gondom van, hogy nem talalok sehol 2.1.9-es zorpot (nem zorp-pro kellene, hanem a gpl-es), igy marad a kernellel valo "jatszadozas". -- Udvozlettel Zsiga

4 7

Cannot assign requested address
by Kosa Attila 11 Apr '05

11 Apr '05

Hello! 2.4.25-os kernel zorpos patch-ekkel, 2.1.8-as zorp. Gond nelkul megy. Kicsereltem a kernelt 2.4.28-ra (szinten zorpos patch-ekkel), azota mindenfele titokzatos dolgok tortennek. Harom pelda: from Zorp.Core import * from Zorp.Plug import * Zorp.firewall_name = 'zorp-winupdate(a)xxx.hu' InetZone("winupdate", "192.168.0.0/16", inbound_services=["win_update"], outbound_services=["win_update"]) InetZone("internet", "0.0.0.0/0", inbound_services=["win_update"], outbound_services=[]) class WinUpdate(PlugProxy): pass def init(name): debug(0, "Policy init, name=%s" % name) Service("win_update", WinUpdate, TransparentRouter()) Listener(SockAddrInet("192.168.1.254", 60443), "win_update") debug(0, "Policy bootstrap done..."); Eddig a winupdate zonaban nem kellett az inbound-hoz beirni a win_update reszt, ment anelkul is. A kernelcsere ota ez a hibauzenet (ha nincs bent az inbound-ban a win_update): Apr 7 07:25:04 fw zorp_winupdate[769]: (zorp-winupdate(a)xxx.hu/win_update) Starting service; name='win_update' Apr 7 07:25:04 fw zorp_winupdate[769]: (zorp-winupdate@xxx.hu/win_update:0): Starting proxy instance; client_fd='15', client_address='AF_INET(192.168.1.201:59787)', client_zone='Zone(winupdate, 192.168.0.0/16)', client_local='AF_INET(192.168.1.254:60443)' Apr 7 07:25:04 fw zorp_winupdate[769]: (zorp-winupdate@xxx.hu/win_update:0/plug): Proxy starting; class='WinUpdate', module='plug' Apr 7 07:25:05 fw zorp_winupdate[22730]: (zorp-winupdate@xxx.hu/win_update:0): Inbound service not permitted; service='win_update', zone='Zone(winupdate, 192.168.0.0/16)' Apr 7 07:25:05 fw zorp_winupdate[22730]: (zorp-winupdate@xxx.hu/win_update:0/plug): DAC policy violation; info='None' Apr 7 07:25:05 fw zorp_winupdate[22730]: (zorp-winupdate@xxx.hu/win_update:0/plug): Proxy ending; class='WinUpdate', module='plug' Masik pelda: from Zorp.Core import * from Zorp.Http import * Zorp.firewall_name = 'zorp-kintrol(a)xxx.hu' InetZone("WWW", "192.168.12.2/32", inbound_services=["id_http"], outbound_services=[]) InetZone("internet", "0.0.0.0/0", inbound_services=[], outbound_services=["id_http"]) class IDHttp(HttpProxyURIFilter): matcher=RegexpFileMatcher('/etc/zorp/http.black', '/etc/zorp/http.white') def config(self): HttpProxyURIFilter.config(self) self.transparent_mode = 1 def filterURL(self, method, url, version): log("http.info", 3, "%s: GET: %s" % (self.session.session_id, url)) def init(name): debug(0, "Policy init, name=%s" % name) Service("id_http", IDHttp, DirectedRouter(SockAddrInet("192.168.12.2", 80), forge_addr = TRUE)) Listener(SockAddrInet("193.225.188.11", 50080), "id_http") debug(0, "Policy bootstrap done..."); pr 7 13:48:23 fw zorp_kintrol[768]: (zorp-kintrol(a)xxx.hu/id_http) Starting service; name='id_http' Apr 7 13:48:23 fw zorp_kintrol[768]: (zorp-kintrol@xxx.hu/id_http:3): Starting proxy instance; client_fd='17', client_address='AF_INET(80.99.101.98:39694)', client_zone='Zone(internet, 0.0.0.0/0)', client_local='AF_INET(193.225.188.11:50080)' Apr 7 13:48:23 fw zorp_kintrol[768]: (zorp-kintrol@xxx.hu/id_http:3/http): Proxy starting; class='IDHttp', module='http' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): Accounting; command='GET', url='http://www.xxx.hu/' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): http accounting; request='GET http://www.xxx.hu/ HTTP/1.1' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): bind() failed; error='Cannot assign requested address' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): Server connection failure; server_address='AF_INET(192.168.12.2:80)', server_zone='Zone(WWW, 192.168.12.2/32)', server_local='AF_INET(80.99.101.98:0)' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): Proxy ending; class='IDHttp', module='http' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3): Ending proxy instance; Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http/client): accounting info; type='stream', duration='0', sent='853', received='391' Sima ftp proxy, 200 peldanyban futhat, mindenkit kizarok, egyetlen gepen elinditok egyetlen wget-et, es 202 proxy indul, majd kozli, hogy tul sokan futnak, varakozas jon. Persze, mert gyakorlatilag nem mukodnek a peldanyok (indulas utan leall), es szepen inditana a kovetkezot, hogy kiszolgalja a kliens kereset. Mi tortent? Hogyan lehet orvosolni a problemat? Visszaallva a regebbi kernelre a problema megszunik, ezert gondolom, hogy az uj kernelhez kapcsolhato a hiba kialakulasa. -- Udvozlettel Zsiga

2 1

SSLProxy
by Tuska Viktor 08 Apr '05

08 Apr '05

Udv, felhasznaltam az archivumban levo javaslatokat, de nem tudom mukodesre birni a zorp-ot transparent https proxy-kent. Mit ronthatok el? Ime, ami a policy-ben van: class MyHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) class MyHttpsProxy(PsslProxy): def config(self): PsslProxy.config(self) self.server_need_ssl = TRUE self.client_need_ssl = TRUE self.client_cert = '/etc/zorp/myhttps.crt' self.client_key = '/etc/zorp/myhttps.key' self.client_verify_type = SSL_VERIFY_NONE self.server_verify_type = SSL_VERIFY_NONE self.shutdown_soft = TRUE self.stack_proxy = MyHttpProxy Hibauzenet: core.stderr(3): (Log thread): Traceback (most recent call last): core.stderr(3): (Log thread): File "/usr/share/zorp/pylib/Zorp/Dispatch.py", line 206, in accepted core.stderr(3): (Log thread): return session.service.startInstance(session) core.stderr(3): (Log thread): File "/usr/share/zorp/pylib/Zorp/Service.py", line 297, in startInstance core.stderr(3): (Log thread): session.client_stream.name = session.session_id + '/' + self.proxy_class.name + '/client' core.stderr(3): (Log thread): TypeError: cannot concatenate 'str' and 'NoneType' objects core.policy(1): (local@zorp@tatooine/nosession): Connection denied by policy;protocol='1',remote='AF_INET(192.168.0.1:35483)', local='AF_INET(213.253.194.2:443)', dest='AF_INET(213.253.194.2:443)' Zorp verzio: 3.0.3 Koszontem, Viktor ui: (non-transparent https proxy-kent sem ment, de gondoltam kezdjuk az egyszerubb esettel.)

2 6

Cannot assign requested address
by Kosa Attila 07 Apr '05

07 Apr '05

Hello! 2.4.25-os kernel zorpos patch-ekkel, 2.1.8-as zorp. Gond nelkul megy. Kicsereltem a kernelt 2.4.28-ra (szinten zorpos patch-ekkel), azota mindenfele titokzatos dolgok tortennek. Harom pelda: from Zorp.Core import * from Zorp.Plug import * Zorp.firewall_name = 'zorp-winupdate(a)xxx.hu' InetZone("winupdate", "192.168.0.0/16", inbound_services=["win_update"], outbound_services=["win_update"]) InetZone("internet", "0.0.0.0/0", inbound_services=["win_update"], outbound_services=[]) class WinUpdate(PlugProxy): pass def init(name): debug(0, "Policy init, name=%s" % name) Service("win_update", WinUpdate, TransparentRouter()) Listener(SockAddrInet("192.168.1.254", 60443), "win_update") debug(0, "Policy bootstrap done..."); Eddig a winupdate zonaban nem kellett az inbound-hoz beirni a win_update reszt, ment anelkul is. A kernelcsere ota ez a hibauzenet (ha nincs bent az inbound-ban a win_update): Apr 7 07:25:04 fw zorp_winupdate[769]: (zorp-winupdate(a)xxx.hu/win_update) Starting service; name='win_update' Apr 7 07:25:04 fw zorp_winupdate[769]: (zorp-winupdate@xxx.hu/win_update:0): Starting proxy instance; client_fd='15', client_address='AF_INET(192.168.1.201:59787)', client_zone='Zone(winupdate, 192.168.0.0/16)', client_local='AF_INET(192.168.1.254:60443)' Apr 7 07:25:04 fw zorp_winupdate[769]: (zorp-winupdate@xxx.hu/win_update:0/plug): Proxy starting; class='WinUpdate', module='plug' Apr 7 07:25:05 fw zorp_winupdate[22730]: (zorp-winupdate@xxx.hu/win_update:0): Inbound service not permitted; service='win_update', zone='Zone(winupdate, 192.168.0.0/16)' Apr 7 07:25:05 fw zorp_winupdate[22730]: (zorp-winupdate@xxx.hu/win_update:0/plug): DAC policy violation; info='None' Apr 7 07:25:05 fw zorp_winupdate[22730]: (zorp-winupdate@xxx.hu/win_update:0/plug): Proxy ending; class='WinUpdate', module='plug' Masik pelda: from Zorp.Core import * from Zorp.Http import * from Zorp.Plug import * Zorp.firewall_name = 'zorp-kintrol(a)xxx.hu' InetZone("WWW", "192.168.12.2/32", inbound_services=["id_http"], outbound_services=[]) InetZone("internet", "0.0.0.0/0", inbound_services=[], outbound_services=["id_http"]) class IDHttp(HttpProxyURIFilter): matcher=RegexpFileMatcher('/etc/zorp/http.black', '/etc/zorp/http.white') def config(self): HttpProxyURIFilter.config(self) self.transparent_mode = 1 def filterURL(self, method, url, version): log("http.info", 3, "%s: GET: %s" % (self.session.session_id, url)) def init(name): debug(0, "Policy init, name=%s" % name) Service("id_http", IDHttp, DirectedRouter(SockAddrInet("192.168.12.2", 80), forge_addr = TRUE)) Listener(SockAddrInet("193.225.188.11", 50080), "id_http") debug(0, "Policy bootstrap done..."); pr 7 13:48:23 fw zorp_kintrol[768]: (zorp-kintrol(a)xxx.hu/id_http) Starting service; name='id_http' Apr 7 13:48:23 fw zorp_kintrol[768]: (zorp-kintrol@xxx.hu/id_http:3): Starting proxy instance; client_fd='17', client_address='AF_INET(80.99.101.98:39694)', client_zone='Zone(internet, 0.0.0.0/0)', client_local='AF_INET(193.225.188.11:50080)' Apr 7 13:48:23 fw zorp_kintrol[768]: (zorp-kintrol@xxx.hu/id_http:3/http): Proxy starting; class='IDHttp', module='http' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): Accounting; command='GET', url='http://www.xxx.hu/' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): http accounting; request='GET http://www.xxx.hu/ HTTP/1.1' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): bind() failed; error='Cannot assign requested address' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): Server connection failure; server_address='AF_INET(192.168.12.2:80)', server_zone='Zone(WWW, 192.168.12.2/32)', server_local='AF_INET(80.99.101.98:0)' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http): Proxy ending; class='IDHttp', module='http' Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3): Ending proxy instance; Apr 7 13:48:23 fw zorp_kintrol[1044]: (zorp-kintrol@xxx.hu/id_http:3/http/client): accounting info; type='stream', duration='0', sent='853', received='391' Sima ftp proxy, 200 peldanyban futhat, mindenkit kizarok, egyetlen gepen elinditok egyetlen wget-et, es 202 proxy indul, majd kozli, hogy tul sokan futnak, varakozas jon. Felemeltem 500-ra, ekkor meg ezt uzeni a syslog-ba: GLib-ERROR **: Cannot create pipe main loop wake-up: Too many open files (process:30557): Zorp-INFO (recursed): (zorp-ftp@xxx.hu/intra_ftp:252/ftp): Signal received, stackdump follows; signo='6' # zorpctl status Instance zorp_ftp: stale pidfile. Mi tortent? Hogyan lehet orvosolni a problemat? -- Udvozlettel Zsiga

2 1

GPL Zorp.3 P4 fagyogatas
by Tuska Viktor 06 Apr '05

06 Apr '05

Udv, Eppen egy Zorp verziot installalgatok egy P4-es gepre, amin erdekes modon a regi zorp(zorpos 1.x, kernel 2.2.21) ugy nez ki jol mukodik, azonban az ujabb zorp(debian, zorp-gpl 3.0.3, kernel 2.4.29+grsecurity+tproxy patch) viszont par ora utan merevre fagy. Valaki talalkozott mar ehhez hasonloval? Esetleg letezik valamilyen kernelbeallitas ami szukseges/nem szukseges? (Hyperthreading/SMP, APIC?) Koszontem, Viktor

2 3