- zorp - lists.balabit.hu

Python and Policy
by Phil Moors 24 Oct '04

24 Oct '04

I'm seeing 'import site failed' messages in the log when using zorpctl to start an instance. I only have one version of python installed (2.2.3). The zorp python lib seem to be found okay and the instance does start. Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Starting up; verbose_level='100', version='2.1.8' Oct 22 15:09:10 fw1 intra[6793]: (Log thread): thread starting; Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): System dependant init; sysdep_tproxy='1' Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Start to listen; fd='11' Oct 22 15:09:10 fw1 intra[6796]: (conntrack/thread): thread starting; Oct 22 15:09:10 fw1 intra[6791]: zorp version 2.1.8 starting up Oct 22 15:09:10 fw1 intra[6793]: (Log thread): 'import site' failed; use -v for traceback Oct 22 15:09:10 fw1 intra[6793]: (Log thread): 'import site' failed; use -v for traceback Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Zone(intra): outbound service=intra_HTTP Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Zone(dmz): inbound service=intra_HTTP Oct 22 15:09:10 fw1 intra[6791]: (noname/nosession): Zone(inter): inbound service=intra_HTTP Oct 22 15:09:10 fw1 intra[6791]: (intra@zorp): Dispatcher on address; proto='1', local='AF_INET(192.168.115.45:50080)', prio='100' Oct 22 15:09:10 fw1 intra[6791]: (intra@zorp/nosession): Start to listen; fd='14' When I send an http request out, I get the, 'There was a problem connecting to the host you specified' message returned. This is a very simple policy (further below). The log reports, 'Inbound service not permitted'. When setting an outbound policy, is the return connection automatically allowed? Oct 22 15:29:38 fw2 priv[8970]: (priv@zorp/intra_HTTP:0): Starting proxy instance; client_fd='15', client_address='AF_INET(192.168.115.49:36435)', client_zone='Zone(priv, 192.168.0.0/16)', client_local='AF_INET(192.168.115.9:50080)' Oct 22 15:29:38 fw2 priv[9002]: (priv@zorp/intra_HTTP:0): Inbound service not permitted; service='intra_HTTP', zone='Zone(priv, 192.168.0.0/16)' Oct 22 15:29:38 fw2 priv[9002]: (priv@zorp/intra_HTTP:0/http): DAC policy violation; info='None' For fun, I added inbound_services(["*"]) to the zone and got the following repeated in the logs. Indeed, there were a lot of processes running on the system. Oct 22 15:24:26 fw2 priv[8739]: (priv@zorp/intra_HTTP:98): Starting proxy instance; client_fd='407', client_address='AF_INET(192.168.115.9:33167)', client_zone='Zone(priv, 192.168.0.0/16)', client_local='AF_INET(192.168.115.9:50080)' Oct 22 15:24:26 fw2 priv[8739]: (priv@zorp/nosession): Too many running threads, waiting for one to become free; num_threads='100', max_threads='100' Oct 22 15:24:26 fw2 priv[8869]: (priv@zorp/intra_HTTP:97/http): Server connection established; server_fd='406', server_address='AF_INET(192.168.115.9:50080)', server_zone='Zone(priv, 192.168.0.0/16)', server_local='AF_INET(192.168.115.9:33167)' Policy.py from Zorp.Core import * from Zorp.Http import * InetZone('priv', '192.168.0.0/16', outbound_services=['intra_HTTP']) InetZone('dmz', '172.17.1.0/24', inbound_services=[]) InetZone('public', '0.0.0.0/0', inbound_services=["*"]) def priv(): Service('intra_HTTP', HttpProxy) Listener(SockAddrInet('192.168.115.9', 50080), 'intra_HTTP') def dmz(): pass def public(): pass instances.conf priv -v3 -p /usr/local/etc/zorp/policy.py --autobind-ip 1.2.3.4 public -v3 -p /usr/local/etc/zorp/policy.py --autobind-ip 1.2.3.4 dmz -v3 -p /usr/local/etc/zorp/policy.py --autobind-ip 1.2.3.4 Thanks, Phil

2 1

Which GPL Kernel
by Phil Moors 21 Oct '04

21 Oct '04

Which GPL zorp should I run? I've tried 2.1.8 and I'm getting kernel panics after running an HTTP session or two through a transparent proxy. Or, maybe I should get non Redhat kernel source from kernel.org. The patch and rebuild worked without errors on the RH sources, though. Are others running 2.1.8 without problems? zorp 2.1.8 libzorpll-2.1.12.5-1 kernel 2.4.22-1.2199.nptlcustom Thanks, Phil

2 3

Building Zorp with profiling in mind
by Peter Meekel 06 Sep '04

06 Sep '04

I am looking for guidance in adding profiling support to the GPL version of Zorp. Ideally, I would like to add the ability to build zorp with or without profiling based on a build time option, but don't have access to the Makefile.ac files used to generate the distributed files. Any pointers on how to approach this are greatly appreciated. Regards, Peter Meekel Xambala, Inc.

2 1

Kernel Initrd
by Phil Moors 23 Aug '04

23 Aug '04

I have installed woody and have run an apt-get dist-upgrade against your repository. Whenever I install one of you kernels however, I get this on boot: RAMDISK: cramfs filesystem found at block 0 RAMDISK: Loading 2116 blocks [1 disk] into ramdisk... done. Freeing initrd memory: 2116k freed sh-2021: reiserfs_read_super: cannot find reiserfs on ramdisk(1,0) Kernel panic: VFS: unable to mount rootfs on 03:02 All I can do here is hit the power switch. I've tried: kernel-image-2.4.25-zorpos-pentium kernel-image-2.4.22-zorpos-pentium /proc/cpuinfo: processor : 0 vendor_id : GenuineIntel cpu family : 6 model : 7 model name : Pentium III (Katmai) stepping : 3 cpu MHz : 498.860 cache size : 512 KB fdiv_bug : no hlt_bug : no f00f_bug : no coma_bug : no fpu : yes fpu_exception : yes cpuid level : 2 wp : yes flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 mmx fxsr sse bogomips : 996.14 /etc/lilo.conf (comments removed): lba32 boot=/dev/hda install=/boot/boot-menu.b map=/boot/map delay=200 vga=normal default=Linux prompt image=/boot/vmlinuz root=/dev/hda2 label=Linux initrd=/boot/initrd.img read-only image=/boot/vmlinuz.old root=/dev/hda2 label=LinuxOLD read-only optional Thanks, Phil

3 2

OT: Debian Install
by Phil Moors 23 Aug '04

23 Aug '04

Pardon my Debian ignorance. I've been using RH/FC for a long time. And, well, Slackware before it had SysVinit support. My questions are about getting Zorp installed the Debian way. I got zorp up and running on FC1, but decided to pave it in favor of a Debian install so I can take advantage of your .deb packages for updates. Should I start with 'stable' and a 2.4 kernel or 'testing'? Stable seems to support the Zorp python/glib requirements better than testing. After getting the correct OS installed, should I compile and install a patched kernel and then point apt to your repository and do a dist-upgrade? Or, can I just do a dist-upgrade pointed to your repository and automatically get a pre-compiled kernel? In RH/FC land, kernel upgrades automatically come when running up2date. This doesn't seem to be the default for Debian. Do new binary kernels always have to be manually retrieved and installed in Debian? I think I just need a general roadmap for getting set up to connect to your repository. Really dumb question: Tasksel keeps installing an X environment even when I forgo checking the box. Not a big deal for a development box, but I really don't want this on a production box. Is there an easy way to get a development environment without X? I imagine that you don't even use tasksel. What do you use? Thanks, Phil

2 3

Re:
by Elwinietf 20 Jul '04

20 Jul '04

1 0

pop
by zorp 05 Jul '04

05 Jul '04

Hello. I'm using GPL version of Zorp, and there are no files for pop3 support. Is it provided only with PRO version? Will be in GPL or PRO version of zorp, support for more protocols with ability to analyze stream contents? H.

1 0

BalaBit at LinuxTag
by Balazs Scheidler 20 Jun '04

20 Jun '04

Hi, This is a quick note to let you know that BalaBit will be present at this year's LinuxTag exhibition, to be held in Karlsruhe next week. We will be present at Stand A82, feel free to drop in, to have a live presentation on Zorp (or syslog-ng) and its features. You can find more information on LinuxTag at http://www.linuxtag.de/ -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

[Fwd: [tproxy] Test version 1.2.0.1 released]
by Balazs Scheidler 04 Jun '04

04 Jun '04

fyi -- Bazsi PGP info: KeyID 9AF8D0A9 Fingerprint CD27 CFB0 802C 0944 9CFD 804E C82C 8EB1

1 0

Zorp 2.1.5.5 can't handle load
by Sheldon Hearn 25 May '04

25 May '04

Hi folks, I'm worried. I'm in a situation where I've put a proxy cluster into production without adequately testing the Zorp component under load. I spent a lot of time testing load balancing, but didn't check that Zorp could cope with a large number of concurrent connections. We're running zorp-2.1.5.5 on a Linux 2.4.25 (Gentoo) kernel with glibc-2.3.2 (Gentoo r9). The http proxy dies with sig11 (all registers printed zero in the stack dump sent to syslog) when it reaches some small number of concurrent threads over 130. So we tried using just the TCP plug proxy, even for HTTP connections, but can't get a single instance using more than 1020 threads. We have 4 zorp boxes handling a 100Mbps uplink, load-balanced with LVS. LVS ipvsadm also shows that the Zorp boxes aren't handling more than about 1000 concurrent connections. The visible symptom of all this is that some connection attempts aren't even accepted, while others are accepted but not serviced. I've done a lot of Googling, and all the stuff on how to increase the number of processes allowed per process doesn't seem to apply; PTHREAD_THREADS_MAX is already large in the glibc sources, and NR_TASKS doesn't exist in the kernel source. I've bumped up ulimits for file descriptors and processes per user, but these don't help. Help. I realise I went into production prematurely, but now that I'm here, it's a horrible place and I'm worried that I overestimated Zorp's ability to cope with load. Am I expecting too much from Zorp, or is this just something that more experienced Linux folks would know about? Any ideas on how to get Zorp to handle the kind of concurrency other people on the list must be getting[1] would be greatly appreciated. Either I need to get Zorp to service a larger number of concurrent requests, or I need to know why it's not coping when it reaches the limit on concurrent requests. I tried lowering --threads to 200, but my connection attempts still either aren't accepted or time out waiting for a response. Thanks, Sheldon. [1] I base this assumption on a posting in the archives, where the poster said he needed about 4 zorp proxy hosts to handle 100Mbps.

2 17