On Fri, Jul 31, 2009 at 11:10:41AM +0200, Balazs Scheidler wrote:
On Thu, 2009-07-30 at 12:26 +0200, Kosa Attila wrote:
Igy inditottam: # strace -f -o /tmp/zorp.log /etc/init.d/zorp start # grep -i transpa /tmp/zorp.log # grep -i setsock /tmp/zorp.log 2396 setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\3\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available) 2396 setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\2\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available) 2396 setsockopt(12, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
Az latszik, hogy a zorp listenel a megfelelo interfeszen, azonban a csomagok nem kerulnek fel hozza.
# grep -i transpa /tmp/zorp.log # grep -i setsock /tmp/zorp.log 11195 setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\3\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available) 11195 setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\2\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available) 11195 setsockopt(12, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0 11195 setsockopt(12, SOL_IP, 0x13 /* IP_??? */, [1], 4) = 0 # cat /etc/zorp/policy-http.py from Zorp.Core import * from Zorp.Http import * Zorp.firewall_name = 'zorp-http@x.hu' InetZone("webezes", "10.10.10.0/24", inbound_services=[], outbound_services=["intra_http"]) InetZone("internet", "0.0.0.0/0", inbound_services=["intra_http"], outbound_services=[]) class IntraHttp(HttpProxy): def config(self): HttpProxy.config(self) self.transparent_mode = 1 def zorp_http(): Service("intra_http", IntraHttp, InbandRouter()) Listener(SockAddrInet("10.10.10.10", 50080), "intra_http", transparent=TRUE)
ez az uzenet startup-kor jon -v6 -os loglevelen. mi jon ki itt:
z_log(NULL, CORE_DEBUG, 6, "System dependant init; sysdep_tproxy='%s'", sysdep_tproxy_str[sysdep_tproxy]);
Aug 4 10:22:12 gplzorp-lenny zorp/zorp_http[11195]: (nosession): System dependant init; sysdep_tproxy='tproxy40' # ip rule list 0: from all lookup local 32765: from all fwmark 0x1 lookup 100 32766: from all lookup main 32767: from all lookup default # cat /etc/iptables.conf.in *mangle :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :DIVERT - -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A PREROUTING -p tcp -m socket -j LOG --log-prefix "SOCKET forgalom: " -A PREROUTING -p tcp -m socket -j DIVERT -A PREROUTING -p tcp --dport 80 -j LOG --log-prefix "PREROUTING forgalom: " -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 -A DIVERT -j LOG --log-prefix "DIVERT forgalom: " -A DIVERT -j MARK --set-mark 1 -A DIVERT -j ACCEPT COMMIT *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -j LOG --log-prefix "INPUT forgalom: " COMMIT A tcpdump szerint csak a SYN-es csomag jut el a tuzfalig, es semmi nem megy vissza a klienshez. A tproxy-s szabaly szamlaloi emelkednek, de a divert chain szamlaloi nem. # grep forgalom /var/log/syslog Aug 4 10:54:43 gplzorp-lenny kernel: [427773.913935] INPUT forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=10.10.10.10 LEN=54 TOS=0x00 PREC=0x00 TTL=64 ID=19689 DF PROTO=UDP SPT=32770 DPT=53 LEN=34 Aug 4 10:54:43 gplzorp-lenny kernel: [427773.915082] INPUT forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=10.10.10.10 LEN=66 TOS=0x00 PREC=0x00 TTL=64 ID=19689 DF PROTO=UDP SPT=32770 DPT=53 LEN=46 Aug 4 10:54:43 gplzorp-lenny kernel: [427773.915842] INPUT forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=10.10.10.10 LEN=54 TOS=0x00 PREC=0x00 TTL=64 ID=19690 DF PROTO=UDP SPT=32770 DPT=53 LEN=34 Aug 4 10:54:43 gplzorp-lenny kernel: [427773.925156] PREROUTING forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=217.20.130.97 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60218 DF PROTO=TCP SPT=35813 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 Aug 4 10:54:46 gplzorp-lenny kernel: [427776.920697] PREROUTING forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=217.20.130.97 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60219 DF PROTO=TCP SPT=35813 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 -- Udvozlettel Zsiga