March 2011 - zorp-hu - lists.balabit.hu

Zorp 3.9 release
by Szilárd Pfeiffer 13 Apr '11

13 Apr '11

Kedves Listatagok! Megjelent a Zorp GPL 3.9-es verziója, melynek forrása az alábbi linken érhető el. http://www.balabit.com/hu/downloads/files?path=/zorp/3.9.0/source A legfontosabb fejlesztés az előző, 3.3R6-os verzióhoz képest, hogy az új SSL framework révén minden proxy alkalmassá válik titkosított forgalom kezelésére stackelés nélkül, beleértve az automatikus kulcsgenerálást (keybridge) is, ami eddig csak a Zorp Pro verziókban volt elérhető. A konfigurálás részleteiről az következő dokumentumokban lehet olvasni: http://www.balabit.com/support/documentation/zorp-gateway-v3.3FR1-tutorial-… http://www.balabit.com/support/documentation/zorp-gateway-v3.3FR1-tutorial-… Fontos, bár nem kód szintű változás, hogy a GPL kiadásai a tervek szerint ezentúl rendszeresebben, előre láthatólag 4-5 havonta követik majd egymást. Proxyk tekintetében is várható érdemi bővülés, de ez egyelőre legyen a következő release-ek meglepetése. Üdvözlettel, a Zorp csapat

6 14

zorp 3.3.6 + libzorpll 3.3.0.12 + Debian 6.0 ujra
by Nyika Csaba 11 Mar '11

11 Mar '11

Sziasztok! A fenti felallast szerttem volna kiprobalni - Barina Tamas utan szabadon -, de elakadtam. A csomagokat feltettem, azutan en is belefutottam a python-os hibaba, amit A Kovacs Krisztian altal publikalt patch megoldott. Szoval zorp el is indul a transparent http proxy hasit, de a https-el nem boldogulok. A konfigjaim a kovetkezoek: ip + iptables: ip rule add fwmark 1 lookup 100 ip route add local 0.0.0.0/0 dev lo table 100 iptables -t mangle -N DIVERT iptables -t mangle -A PREROUTING -p tcp -m socket --dport 433 -j DIVERT iptables -t mangle -A PREROUTING -p tcp -m tcp --dport 443 -j TPROXY --on-port 50443 --on-ip 172.16.16.1 --tproxy-mark 0x1/0x1 iptables -t mangle -A DIVERT -j MARK --set-xmark 0x1/0xffffffff iptables -t mangle -A DIVERT -j ACCEPT policy.py from Zorp.Core import * from Zorp.Http import * from Zorp.Pssl import * # defining the intranet zone, we only allow http connection from this zone InetZone("intranet","172.16.16.0/24", outbound_services=["intra_https"], inbound_services=[]) # the internet zone, we do not allow any connection from this zone (coming "out" from this zone, # that's why outbound_services is empty) InetZone("internet","0.0.0.0/0", inbound_services=["*"], outbound_services=[]) class MyHttpsProxy(HttpProxy): def config(self): HttpProxy.config(self) self.ssl.client_verify_type = SSL_VERIFY_NONE self.ssl.client_connection_security = SSL_FORCE_SSL self.ssl.server_connection_security = SSL_FORCE_SSL self.ssl.server_ca_directory = '/etc/zorp/ca.d/' self.ssl.server_ssl_method = SSL_METHOD_ALL self.ssl.server_verify_type = SSL_VERIFY_REQUIRED_UNTRUSTED self.ssl.server_disable_proto_sslv2 = TRUE self.ssl.server_ssl_cipher = SSL_CIPHERS_HIGH self.ssl.client_key_file = '/etc/zorp/https/server.key' self.ssl.client_cert_file = '/etc/zorp/https/server.crt' self.stack_proxy = HttpProxy def zorp_https(): Service("intra_https", proxy_class=MyHttpsProxy, router=TransparentRouter(overrideable = FALSE, forge_addr = TRUE)) Listener(bindto=SockAddrInet("172.16.16.1",50443), service="intra_https", transparent=TRUE, threaded=FALSE, backlog=255) log kimenet: Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.debug(0): (nosession): Starting up; verbose_level='5', version='3.3.6', startup_id='1299657285' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.debug(5): (nosession): Outbound service; zone='intranet', service='intra_http' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.debug(5): (nosession): Outbound service; zone='intranet', service='intra_https' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.debug(5): (nosession): Inbound service; zone='internet', service='*' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface added; if_index='1', if_name='lo', if_flags='73' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface added; if_index='2', if_name='eth0', if_flags='4098' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface added; if_index='3', if_name='eth1', if_flags='4098' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface added; if_index='4', if_name='eth2', if_flags='4098' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface added; if_index='5', if_name='eth3', if_flags='4163' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface added; if_index='6', if_name='eth4', if_flags='4163' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Address added to interface; if_name='lo', if_addr='127.0.0.1' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Address added to interface; if_name='eth3', if_addr='10.10.67.1' Mar 9 08:54:45 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Address added to interface; if_name='eth4', if_addr='172.16.16.1' Mar 9 08:55:37 firewallnew zorp/zorp_https[8165]: core.info(4): (nosession): Interface info updated; if_index='6', if_name='eth4', if_flags='0x1043', if_group='0x0' Mar 9 08:55:44 firewallnew zorp/zorp_https[8165]: core.accounting(4): (szig/conn:0/stream): accounting info; type='ZStreamFD', duration='0', sent='11', received='37' Mar 9 08:55:44 firewallnew zorp/zorp_https[8165]: core.accounting(4): (szig/conn:0/stream): accounting info; type='ZStreamBuf', duration='0', sent='0', received='0' Mar 9 08:55:44 firewallnew zorp/zorp_https[8165]: core.accounting(4): (szig/conn:0/stream): accounting info; type='ZStreamLine', duration='0', sent='11', received='36' Ha barkinek van valami tippje, megkoszonom! Koszonettel: Nyika Csaba

5 10

Zorp + IPV6
by Barina Tamas 02 Mar '11

02 Mar '11

Sziasztok, a GPL képes az IPV6-ra? Barina Tamás

3 3

Zorp 3.3.6 - port valasztas hostnev alapjan
by Farkas Dániel 02 Mar '11

02 Mar '11

Sziasztok! A multkor mar sikerult beuzemelni a zorpot, aminek nagyon orulok. Most vettem eszre (amikor elesben akartam hasznalni az iranyitasokat), hogy nem megy. Minden a regi config alapjan van, hibat nem dob, debugban sem latok tobbet. Esetleg valtozhatott valami a kifejezesekben, vagy valamit elirtam? Mindenkepp a belso 127.0.0.1:50080-as cimre iranyitja a kereseket, nem veszi figyelembe a hostnevenkent megadott tobbi portot. Koszi! D. ################ CONFIG : ##################### from Zorp.Core import * from Zorp.Plug import * from Zorp.Http import * from Zorp.Ftp import * Zorp.firewall_name = 'zorp@moya' InetZone("site-net", "x.y.x.y/24", # list of allowed outbound services, '*' matches anything #outbound_services=["intra_http", "intra_ftp", "intra_cvs"], outbound_services=["intra_http"], # list of allowed inbound services, '*' matches anything inbound_services=["intra_http"]) InetZone("local", "127.0.0.0/8", inbound_services=["*"], outbound_services=["*"]) InetZone("internet", "0.0.0.0/0", inbound_services=["intra_http"], outbound_services=["intra_http"]) # # Let's define a transparent http proxy, which rewrites the user_agent # header to something different. # class IntraHttp(HttpProxy): def config(self): HttpProxy.config(self) self.transparent_mode = TRUE self.request_timeout = 1800000 self.request_header["Host"] = (HTTP_HDR_POLICY, self.TargetByHostHeader) self.request["GET"] = (HTTP_REQ_POLICY, self.filterURL) self.request["POST"] = (HTTP_REQ_POLICY, self.filterURL) def filterURL(self, method, url, version): self.setRequestHeader("X_HOST", self.session.client_address.ip_s) log("http.info", 3, "%s: GET: %s" % (self.session.session_id, url)) return HTTP_REQ_ACCEPT def filterHost (self, hdr_name, hdr_value): return HTTP_HDR_ACCEPT def TargetByHostHeader(self, name, value): if(value == "domain1.hu" or value == "www.domain1.hu" or value == "www2.domain2.hu" ): self.session.server_address = SockAddrInet("127.0.0.1" ,50083) # APACHE 3 return HTTP_HDR_ACCEPT elif(value == 'domain3.hu' or value == 'domain4.hu' ): self.session.server_address = SockAddrInet("127.0.0.1" ,50081) return HTTP_HDR_ACCEPT else: self.session.server_address = SockAddrInet("127.0.0.1" ,50080) return HTTP_HDR_ACCEPT # zorp_http instance def zorp_http(): # create services Service("intra_http", IntraHttp, router=DirectedRouter(SockAddrInet("127.0.0.1", 50080))) Listener(SockAddrInet("x.y.x.y", 80), "intra_http")

6 18