- zorp - lists.balabit.hu

running policy.py error
by 조성우 04 Apr '08

04 Apr '08

Now, I’m trying to study your tremendous job, zorp. So, first of all, thank you for your sharing such a good proxy source. Anyway, I have some problem with running zorp. Please see the stack dump log below. Apr 04 21:54:06 (nosession): Starting up; verbose_level='5', version='3.1.12', startup_id='1207313646' [New Thread -1208752368 (LWP 31777)] [Detaching after fork from child process 31780. (Try `set detach-on-fork off'.)] [New Thread -1208755312 (LWP 31782)] Apr 04 21:54:06 (nosession): Outbound service; zone='site-net', service='intra_http' Apr 04 21:54:06 (nosession): Outbound service; zone='site-net', service='intra_ftp' Apr 04 21:54:06 (nosession): Outbound service; zone='site-net', service='intra_cvs' Apr 04 21:54:06 (nosession): Inbound service; zone='local', service='*' Apr 04 21:54:06 (nosession): Inbound service; zone='internet', service='*' *** glibc detected *** /home2/zorp/zorptest: munmap_chunk(): invalid pointer: 0xb7e7e350 *** warning: Missing the separate debug info file: /usr/lib/debug/.build- id/db/8cb95645d5df469d4aece301cdb5e60087be21.debug ======= Backtrace: ========= /lib/libc.so.6(cfree+0x1bb)[0x50221b] /usr/local/lib/libzorp.so.0[0x1417bc] /usr/lib/libpython2.5.so.1.0[0x619361d] /usr/lib/libpython2.5.so.1.0(PyEval_EvalFrameEx+0x316b)[0x61c95db] /usr/lib/libpython2.5.so.1.0(PyEval_EvalCodeEx+0x7ef)[0x61cd69f] /usr/lib/libpython2.5.so.1.0[0x616c1ea] /usr/lib/libpython2.5.so.1.0(PyObject_Call+0x37)[0x614d137] /usr/lib/libpython2.5.so.1.0[0x614e423] /usr/lib/libpython2.5.so.1.0(PyObject_CallFunction+0x3f)[0x614e70f] /usr/local/lib/libzorp.so.0(z_policy_init+0x89)[0x123a8a] /usr/local/lib/libzorp.so.0(z_load_policy+0xbf)[0x12579f] /usr/local/lib/libzorp.so.0(z_main_loop+0x24)[0x125919] /home2/zorp/zorptest[0x804a682] /lib/libc.so.6(__libc_start_main+0xe0)[0x4ab390] Actually I can not found DNS.py which is imported in “Matcher.py” So, I download it from “ <http://pydns.sourceforge.net/index.html> http://pydns.sourceforge.net/index.html” but there is no method called “DiscoverNameServers” So I remarked the line of calling “DiscoverNameServers” and then got the python error posted above. I guess there are two possibilities, the first is using wrong “policy.py” and the other is using wrong “DNS.py”. Please give a direction. Thanks.

2 1

problem with apt-get update on debian sarge
by Tom Carbert-Allen 22 Feb '08

22 Feb '08

Sorry for double post but only just got accepted to list so if you have replied to list only already please re-send This email may contain confidential and privileged material for the sole use of the intended recipient(s). Any review, use, discussion or disclosure by others is strictly prohibited. If you are not the intended recipient of this email, please contact the sender by return email and delete all copies of this email and its attachments, if any.

2 3

missing constants and methods in pssl.py
by David Yerger 20 Feb '08

20 Feb '08

Now trying to create an https proxy for Outlook Web Access with Zorp GPL 3.1.12. 1. It looks like some of the constants are named differently than the Zorp GPL tutorial at http://www.balabit.hu/network-security/zorp-gateway/gpl/tutorial/, for example it mentions PSSL_VERIFY_NONE and PSSL_VERIFY_REQUIRED_TRUSTED in the example in section 5.6, but the code for the included Pssl.py v. 1.28 says SSL_VERIFY_NONE = 0 SSL_VERIFY_OPTIONAL = 1 SSL_VERIFY_REQUIRED_UNTRUSTED = 2 SSL_VERIFY_REQUIRED_TRUSTED = 3 (without the "P") 2. Looks like some methods and constants mentioned in the Zorp Gateway v3.1 SSL tutorial PDF aren't there, for example Methods: server_ssl_method server_disable_proto server_ssl_cipher Constants: PSSL_METHOD_SSLV23 Permit the use of SSLv2 and v3. PSSL_METHOD_SSLV2 Permit the use of SSLv2 exclusively. PSSL_METHOD_SSLV3 Permit the use of SSLv3 exclusively. PSSL_METHOD_TLSV1 Permit the use of TLSv1 exclusively. PSSL_METHOD_ALL Permit the use of all the supported (SSLv2, SSLv3, and TLSv1) protocols. Is this because these are only defined in the Pssl module for Zorp Pro? 3. Using a policy.py containing from Zorp.Core import * from Zorp.Http import * from Zorp.Plug import * from Zorp.Pssl import * def Zhttps(): Service("INhttps", INhttps, router=DirectedRouter(SockAddrInet("10.0.0.9", 80))) Listener(SockAddrInet("aaa.bbb.ccc.ddd", 50443), "INhttps") class StrongPsslProxy(PsslProxy): def config(self): PsslProxy.config(self) #docs say PSSL_VERIFY_NONE self.client_verify_type = SSL_VERIFY_NONE self.server_ca_directory = "/etc/ssl/certs/" #PDF docs want more here - #self.server_ssl_method = PSSL_METHOD_TLSV1 #self.server_disable_proto = TRUE #self.server_ssl_cipher = PSSL_CIPHERS_HIGH class INhttps(StrongPsslProxy): def config(self): StrongPsslProxy.config(self) self.server_need_ssl=FALSE self.server_keypair_files = ("/etc/ssl/certs/owa.crt", "/etc/ssl/private/owa.key") self.stack_proxy=(Z_STACK_PROXY, OWAHttpProxy) #wild guess on my part, maybe this will help self.client_need_ssl=TRUE class OWAHttpProxy(HttpProxy): def config(self): HttpProxy.config(self) self.request_header["Front-End-Https"]=(HTTP_HDR_INSERT, "on") I'm seeing in my logs stuff like Feb 17 16:09:49 localhost zorp/Zhttps[5552]: (svc/INhttps:0): Starting proxy instance; client_fd='15', client_address='AF_INET(aaa.bbb.ccc.def:3139)', client_zone='Zone(inter, 0.0.0.0/0)', client_local='AF_INET(aaa.bbb.ccc.ddd:443)', client_protocol='TCP' Feb 17 16:09:49 localhost zorp/Zhttps[5552]: (svc/INhttps:0/pssl): Server connection established; server_fd='18', server_address='AF_INET(10.0.0.9:80)', server_zone='Zone(intra, 10.0.0.0/24)', server_local='AF_INET(10.0.0.69:55718)', server_protocol='TCP' Feb 17 16:09:49 localhost zorp/Zhttps[5552]: (svc/INhttps:0/pssl): SSL handshake failed on the client side; error='error:1408A0C1:SSL routines:lib(20):SSL3_GET_CLIENT_HELLO:func(138):no shared cipher:reason(193)' Where 10.0.0.0 is the local network, aaa.bbb.ccc.ddd is my public IP, and aaa.bbb.ccc.def is the gateway address of my Snapgear (which my internal test client demaquerades as.) Looks like the protocol is defaulting to TCP instead of something sane like TLSV1, but I can't set it anywhere I can see. Is this disabled on purpose or is there something I can do to fix it? Thanks in advance! David Yerger

2 4

Problem parsing request with Zorp GPL reverse http proxy
by David Yerger 14 Feb '08

14 Feb '08

Seems that it's looking for "http://" in the "GET " part: Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http/client): data line 0x0000: 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 31 GET / HTTP/1.1 Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http): Request details; command='GET', url='/', version='HTTP/1.1' <snip> Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http): processing request and headers; Feb 14 14:37:24 localhost zorp/Zhttp[4028]: (svc/INhttp:3/http): Error parsing URL; url='/', reason='URL has no scheme, colon missing' I'm using Zorp GPL 3.1.12. Thanks in advance David Yerger

1 1

csomagok
by Balazs Scheidler 27 Nov '07

27 Nov '07

hali, a build rendszerunk frissitese miatt volt nemi kieses a weblapon levo GPL-es Zorp csomagokban, most mar elvileg mukodnie kell. Ha valami gond lenne, szoljatok. -- Bazsi

1 0

Why client can see ip address of dummy interface
by Zhou Li 13 Jul '07

13 Jul '07

I test Zorp 3.0.14b + 2.0.6 cttproxy for kernel 2.6.17 and It work fine for me, but I found client can see ip address of dummy interface that I can't understand. client(192.168.88.166) <--> zorp(dummy ip 172.16.44.10) <--> server(192.168.88.10) # iptables -t tproxy -I PREROUTING -p tcp --dport 80 -j TPROXY --on-ip 172.16.44.10 --on-port 60080 instances.conf: http -T -v 1 -s core.error:0 -p /usr/local/etc/zorp/http.py -B 172.16.44.10 http.py: . . . def zorp(): Service("http", MyHttp, router=TransparentRouter(forge_addr=TRUE, forge_port=Z_PORT_EXACT)) Listener(SockAddrInet(172.16.44.10, 60080), "http", transparent=TRUE, mark_tproxy=TRUE) when I make a new http request from client to server and tcpdump will display the information below tcpdump on client # tcpdump | grep 172.16.44.10 16:10:57.975579 802.1Q vlan#3 P0 172.16.44.10.60080 > 192.168.88.166.2883: P 0:32(32) ack 1 win 11680 (DF) 16:10:57.975611 172.16.44.10.60080 > 192.168.88.166.2883: P 0:32(32) ack 1 win 11680 (DF) 16:10:57.975831 192.168.88.166.2883 > 172.16.44.10.60080: R 3812615646:3812615646(0) win 0 16:10:57.975860 802.1Q vlan#3 P0 192.168.88.166.2883 > 172.16.44.10.60080: R 3812615646:38126156 tcpdump on server # tcpdump | grep 172.16.44.10 16:10:57.538207 arp who-has 192.168.88.10 tell 172.16.44.10 my question is how to avoid client see dummy ip address? ZhouLi ____ KILL邮件安全网关已经扫描了这封邮件 ____

2 4

What's up with Zorp?
by Mathew Brown 09 Jul '07

09 Jul '07

Hi, I just ran into Zorp yesterday reading about in in the article "Paranoid Penguin - Application Proxying with Zorp, Part I" (http://www.linuxjournal.com/article/7296) However, when I started looking around, I ran into this mailing list which seems to have very little activity. Is Zorp dead? If not, what's the current status for both the GPL and commercial versions? Does Zorp still need the tproxy patch? Thanks for your help. -- Mathew Brown mathewbrown(a)fastmail.fm -- http://www.fastmail.fm - The professional email service

2 1

Proxy for DNS and NTP
by Matt Miller 15 Apr '07

15 Apr '07

I'm configuring a three-homed firewall, and I'm reading the official tutorial. From thatl tutorial it seems that the recommendation is to run offer intra-net clients DNS and NTP from the firewall itself. Installing all these services on the firewall seems to go against the conventional wisdom that internet-connected machines should offer as few services as possible. So, I'm wondering what the reasoning is here. I've tried using PlugProxy for DNS and NTP, and that does work. I feel more comfortable proxying this traffic instead of running the services on the firewall, but it seems that the proxied DNS is causing a considerable slow-down for web surfing from my intra-net. Is it to be expected that PlugProxy for DNS is a performance problem? If so, is this a problem with proxied UDP in general? Is this performance problem the main reason that the tutorial recommends running DNS and NTP on the firewall? Thanks for any recommendations and discussion here.

3 4

(no subject)
by Karl Heinz Wegner 28 Mar '07

28 Mar '07

-- Mit freundlichem Gruß Karl Heinz Wegner _________________________________ Korrodin GmbH & Co. KG Leitung EDV Berlichingenstraße 9 91126 Schwabach Tel: 09122/8324-37 Fax: 09122/8324-48 eMail: wegner(a)korrodin.biz URL: www.korrodin.biz Sitz in Schwabach Geschäftsführung: Karl-Heinz Gerlach, Dipl.-Betriebswirt Alexander Gerlach, MBA Steuernummer: 247/173/07409 USt-Identnummer: DE133495426 Handelsgericht: Amtsgericht Nürnberg HRA 6349 pers. haft. Verw.GmbH HRB 6876

1 0

Zorp installálási probléma (fwd)
by REPNIK SZABOLCS 17 Mar '07

17 Mar '07

Az alábbi probláma megoldodott(devfs-t kellett installálni)! Sziasztok! Ma probáltam elöször installálni zorp-ot. Egy debian sarge alaprendszert raktam fel, majd a sources.list-ben megadtam a balabitét. Sikeresen letoltöttem, a kernel image-t és a kernel-headert is. Inditáskor a grub fel is kinálja a zorp-os kernel-t is, de ha azt szeretném betölteni, akkor ezt a hibaüzenetet kapom: id "1" respawning too fast: disabled for 5 minutes Ha a "rendes" sarge kernelt töltöm be akkor nincs hibaüzenet. Az inittab-hoz nem nyultam. Elöre is köszönöm a segitséget ____________________________________________________________ Katedra Nyelviskola - Garantáltan minőségi nyelvtanfolyamok és akkreditált nyelvvizsgák 19 nyelven 23 városban és külföldön. http://www.katedra.hu/index3.php ____________________________________________________________ Katedra Nyelviskola - Garantáltan minőségi nyelvtanfolyamok és akkreditált nyelvvizsgák 19 nyelven 23 városban és külföldön. http://www.katedra.hu/index3.php

1 0