- zorp - lists.balabit.hu

Zorp sourceforge project
by Magosányi Árpád 05 Nov '03

05 Nov '03

Hi! You can find some zorp related info at http://zorp-unoff.sourceforge.net/ This is under construction. All comments are welcome. -- GNU GPL: csak tiszta forrásból

1 0

RE: [zorp] Policy.py gives errors
by Matt Hackett 02 Jul '03

02 Jul '03

Ah, thanks for the flag to give a traceback of the error. After running with the "-l" flag I found several errors in my policy.py: in three places I had Listen(...) instead of Listener(...), and there was a type mismatch because I used quotes around port numbers in many places. Now that I've fixed these, Zorp is working fine. It would be nice in future versions to have zorp/zorpctl give an error message such as "Parse error in policy file: /etc/zorp/policy.py:8: <error message here>", such as Apache and other config-file based daemons do, to make debugging bad policy files less complicated. Thanks for the help, Matt Hackett Research Associate MixZon Inc. 1033 SW Yamhill St. Portland, OR 97201 (503) 222-1022 -----Original Message----- From: SZALAY Attila [mailto:sasa@balabit.hu] Sent: Wednesday, July 02, 2003 11:14 AM To: zorp(a)lists.balabit.hu Subject: Re: [zorp] Policy.py gives errors Hi All! On 2003 Jul 02, Matt Hackett wrote: > > I've been trying to get Zorp working for several days now and have run > into a variety of problems. After struggling to get the last source > version from the site properly compiled (we use a PaX-patched kernel and > it took a while to get Zorp to compile with completely PIC) I've finally > got a running zorp executable. Except that it chokes on my policy file. > I've gone through the indentation and such, so to really test what was > going on I set PYTHONPATH to the zorp/pylib directory and ran "python > policy.py" which returned this: C part of Zorp export some class and function to python level. Because of this you get problems when you try to run policy.py outside of Zorp. > Shouldn't these be coming from the Python 'socket' anyways? No. It's coming from codes written in C. Try to run zorp like this: /usr/lib/zorp/zorp --as internal_out --policy /etc/zorp/policy.py -v3 -l Of course change the path of zorp and policy.py to correct value. And send result to me please. -- Szalay Attila BalaBit IT Biztonságtechnikai Kft. tel:(36-1)-371-05-40 1116 Bp. Csurgoi ut 20/b fax:(36-1)-208-08-75 http://www.balabit.hu/ _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu http://lists.balabit.hu/mailman/listinfo/zorp

1 0

Policy.py gives errors
by Matt Hackett 02 Jul '03

02 Jul '03

Hi- I've been trying to get Zorp working for several days now and have run into a variety of problems. After struggling to get the last source version from the site properly compiled (we use a PaX-patched kernel and it took a while to get Zorp to compile with completely PIC) I've finally got a running zorp executable. Except that it chokes on my policy file. I've gone through the indentation and such, so to really test what was going on I set PYTHONPATH to the zorp/pylib directory and ran "python policy.py" which returned this: Traceback (most recent call last): File "policy.py", line 1, in ? from Zorp.Core import * File "/usr/local/share/zorp/pylib/Zorp/Core.py", line 31, in ? from Zone import InetZone File "/usr/local/share/zorp/pylib/Zorp/Zone.py", line 36, in ? from Domain import InetDomain, Inet6Domain File "/usr/local/share/zorp/pylib/Zorp/Domain.py", line 37, in ? from SockAddr import SockAddrInet, inet_ntoa, inet_aton, htonl, ntohl ImportError: cannot import name htonl Shouldn't these be coming from the Python 'socket' anyways? When edited Domain.py to import everything by ScokAddrInet from socket, then ran it again I get this error: Traceback (most recent call last): File "policy.py", line 1, in ? from Zorp.Core import * File "/usr/local/share/zorp/pylib/Zorp/Core.py", line 32, in ? from Service import Service File "/usr/local/share/zorp/pylib/Zorp/Service.py", line 53, in ? from Router import TransparentRouter File "/usr/local/share/zorp/pylib/Zorp/Router.py", line 36, in ? from Zorp import setupDirectedRouter ImportError: cannot import name setupDirectedRouter With grep I can't find "setupDirectedRouter" being defined anywhere in the Python files. And of course Zorp still won't start, with the error "Error loading initial policy, exiting;" Was I correct to make the first change? How can I get rid of these errors and get Zorp running. (My policy.py is attached, just in case that's the problem). Matt Hackett Research Associate MixZon Inc. 1033 SW Yamhill St. Portland, OR 97201 (503) 222-1022

2 1

Zorp and gzip
by Philippe Lucas 16 Jun '03

16 Jun '03

I add -lz but, now I have a new error : Jun 13 07:49:13 bridge zorp_http[12247]: (zorp@site/intra_http:0/http): Signal (11) received, stackdump follows; Jun 13 07:49:13 bridge zorp_http[12247]: (zorp@site/intra_http:0/http): Fatal signal occurred, dumping stack; eax='00000000', ebx='00000000', ecx='00000000', edx='00000000', esi='00000000', edi='00000000', eip='00000000' Jun 13 07:49:13 bridge zorp_http[12247]: (zorp@site/intra_http:0/http): retaddr=0x0, ebp=0x0 Jun 13 07:49:13 bridge zorp_http[12247]: (zorp@site/intra_http:0/http): 08048000-0804b000 r-xp 00000000 03:42 288358 /usr/local/lib/zorp/zorp Jun 13 07:49:13 bridge zorp_http[12247]: (zorp@site/intra_http:0/http): 0804b000-0804c000 rw-p 00002000 03:42 288358 /usr/local/lib/zorp/zorp How can I have a better error message ? Philippe Lucas

2 1

Zorp and gzip
by Philippe Lucas 13 Jun '03

13 Jun '03

To use libz functions, I add : #include <zlib.h> #include <zutil.h> in http.c But it doesn't work! There seems to be a problem with the zlib function "deflate" My logs : Jun 12 09:41:41 bridge zorp_http[13743]: (zorp@site/intra_http:1/http): Proxy starting; class='IntraHttp', module='http' Jun 12 09:41:41 bridge zorp_http[13743]: (noname/nosession): Module loading failed; module='http', file='/usr/local/lib/zorp/libhttp.so', error='/usr/local/lib/zorp/libhttp.so: undefined symbol: deflate' Jun 12 09:41:41 bridge zorp_http[13743]: (noname/nosession): Cannot find proxy module; module='http' type='1' Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): Traceback (most recent call last): Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): File "/usr/local/share/zorp/pylib/Zorp/Dispatch.py", line 173, in accepted Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): return session.service.startInstance(session) Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): File "/usr/local/share/zorp/pylib/Zorp/Service.py", line 258, in startInstance Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): proxy = self.proxy_class(ss) Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): File "/usr/local/share/zorp/pylib/Zorp/Http.py", line 582, in __init__ Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): Proxy.__init__(self, session) Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): File "/usr/local/share/zorp/pylib/Zorp/Proxy.py", line 96, in __init__ Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): ZorpProxy.__init__(self, self.name, session.session_id, session.client_stream) Jun 12 09:41:41 bridge zorp_http[13745]: (Log thread): RuntimeError: Error loading proxy module.

2 1

Re: [zorp] Zorp and gzip
by Philippe Lucas 11 Jun '03

11 Jun '03

> On Thu, Jun 05, 2003 at 05:05:51PM -0400, Philippe Lucas wrote: > >/ You told me that a snapshot of the GPLd version now in development > would / > >/ be soon available, if it is now, could you tell me where I can find it > />/ please ? / > > I've opened the GPLd branch, our release manager will release the GPLd > version shortly. > Could you send me an email when it is ready ?

1 0

Zorp and gzip
by Philippe Lucas 06 Jun '03

06 Jun '03

You told me that a snapshot of the GPLd version now in development would be soon available, if it is now, could you tell me where I can find it please ? I'd like to develop the gzip module, but concerning performances, I'd rather develop it in C. Could you explain me how to retrieve the http data flow in the code to compress it ? Philippe Lucas

2 2

Zorp and Traffic Control
by Philippe Lucas 27 May '03

27 May '03

> you'd need a release from the development version which allows you to > stack > proxies within HTTP. This means that another proxy module receives the > data > portion of each HTTP request. What do you want to change in the HTTP body? > > It is currently not possible with plain 2.0. I'll schedule a release > if you > are interested. I'm actually interested in compressing the HTTP data flow. Could you send me the development version so that I can start working on it? When did you plan on releasing the new version? Philippe Lucas

2 2

Zorp and Traffic Control
by Philippe Lucas 27 May '03

27 May '03

> Hmm. The log snippet above shows that a client was connected from > 192.168.100.199:2092, with a destination address 192.168.0.251:80 and Zorp > wanted to connect to the same server using the local address > 192.168.0.134:42488. This means that it did not even try to use the forged > address... > > Please try using ForgeClientSourceNAT as SNAT instead of the forge_addr > parameter, like: > > def zorp_http(): > Service("intra_http", HttpProxy, router=TransparentRouter(), > snat=ForgeClientSourceNAT()) > .... > > (ForgeClientSourceNAT was the previous way to specify address forging) > > If this does work, then there's some problem in forge_addr, if it doesn't > I'd suspect some problems with the --autobind-ip arguments. It's working! My instances.conf : zorp_http --autobind-ip 192.168.100.135 --verbose=5 --policy /etc/zorp/policy.py My policy.py : def zorp_http(): Service("intra_http", IntraHttp,router=TransparentRouter(),snat=ForgeClientSourceNAT()) Listener(SockAddrInet("192.168.100.135", 50080), "intra_http") I'm very happy, thank you :o) I'd now like to modify a body data of a http transfert. how can I do that? Philippe Lucas

2 1

Zorp and Traffic Control
by Philippe Lucas 20 May '03

20 May '03

My instances.conf : zorp_http --autobind-ip '192.168.100.135' --verbose=5 --policy /etc/zorp/policy.py I don't think you completly understood my request: The system works fine. The client receives data from the server through the proxy zorp. The client doesn't see zorp in the packets (source IP) but the serveur does see zorp. I'd like zorp bee completly transparent. My Logs : May 20 06:01:40 bridge zorp_http[9677]: (noname/nosession): Verbosity level: 5 May 20 06:01:41 bridge zorp_http[9677]: zorp version 2.0.2 starting up May 20 06:01:41 bridge zorp_http[9677]: (noname/nosession): Zone(site-net): outbound service=intra_http May 20 06:01:41 bridge zorp_http[9677]: (noname/nosession): Zone(local): inbound service=* May 20 06:01:41 bridge zorp_http[9677]: (noname/nosession): Zone(internet): inbound service=* May 20 06:01:45 bridge zorp_http[9677]: (zorp@site/intra_http): Starting service; name='intra_http' May 20 06:01:45 bridge zorp_http[9677]: (zorp@site/intra_http:0): Starting proxy instance; client_fd='16', client_address='AF_INET(192.168.100.199:2092)', client_zone='Zone(site-net, 192.168.100.0/24)', client_local='AF_INET(192.168.0.251:80)' May 20 06:01:45 bridge zorp_http[9677]: (zorp@site/intra_http:0/http): Proxy starting; class='IntraHttp', module='http' May 20 06:01:45 bridge zorp_http[9683]: (zorp@site/intra_http:0/http): Server connection established; server_fd='17', server_address='AF_INET(192.168.0.251:80)', server_zone='Zone(internet, 0.0.0.0/0)', server_local='AF_INET(192.168.0.134:42488)' May 20 06:01:45 bridge zorp_http[9677]: (zorp@site/intra_http): Starting service; name='intra_http' May 20 06:01:45 bridge zorp_http[9677]: (zorp@site/intra_http:1): Starting proxy instance; client_fd='18', client_address='AF_INET(192.168.100.199:2093)', client_zone='Zone(site-net, 192.168.100.0/24)', client_local='AF_INET(192.168.0.251:80)' May 20 06:01:45 bridge zorp_http[9677]: (zorp@site/intra_http:1/http): Proxy starting; class='IntraHttp', module='http' May 20 06:01:45 bridge zorp_http[9684]: (zorp@site/intra_http:1/http): Server connection established; server_fd='19', server_address='AF_INET(192.168.0.251:80)', server_zone='Zone(internet, 0.0.0.0/0)', server_local='AF_INET(192.168.0.134:42489)' > On Fri, May 09, 2003 at 04:22:49PM -0400, Philippe Lucas wrote: >> >> I would like make a transparent proxy, transparent for both the client and >> the server. >> But my problem is that the transparency works for the client but not for >> the server. >> >> Could you please help me ? > > you probably did not create a dummy interface which is used for 'forging' > addresses. > > Please check the log messages that Zorp emits at startup. It should state > something like: > > z_log(NULL, CORE_ERROR, 3, "Binding to dummy interface failed, please create one and pass --autobind-ip parameter; autobind='%s'", auto_bind_ip); > > The default IP of the dummy interface is '1.2.3.4' but you can change this > using the --autobind-ip command line argument in your instances.conf file. >

2 1