- zorp - lists.balabit.hu

Zorp installálási probléma
by REPNIK SZABOLCS 17 Mar '07

17 Mar '07

Sziasztok! Ma probáltam elöször installálni zorp-ot. Egy debian sarge alaprendszert raktam fel, majd a sources.list-ben megadtam a balabitét. Sikeresen letoltöttem, a kernel image-t és a kernel-headert is. Inditáskor a grub fel is kinálja a zorp-os kernel-t is, de ha azt szeretném betölteni, akkor ezt a hibaüzenetet kapom: id "1" respawning too fast: disabled for 5 minutes Ha a "rendes" sarge kernelt töltöm be akkor nincs hibaüzenet. Az inittab-hoz nem nyultam. Elöre is köszönöm a segitséget ____________________________________________________________ Katedra Nyelviskola - Garantáltan minőségi nyelvtanfolyamok és akkreditált nyelvvizsgák 19 nyelven 23 városban és külföldön. http://www.katedra.hu/index3.php

1 0

Can't Open policy.boot
by Matt Miller 08 Mar '07

08 Mar '07

Under debian etch I can't seem to get zorp instances to start. I see the following in syslog: Error opening policy.boot file; file='${prefix}/share/zorp/policy.boot' That error is repeated for each instance I'm trying to start. I'm using the debian packaged version, and I don't know what ${prefix} is set to, but I'm thinking that it must be either "/usr" or empty. My system does have /usr/share/zorp/policy.boot, and that file is world- readable. I tried creating /share/zorp/policy.boot as a copy of the /usr/share/zorp version, but that didn't change anything. Has anyone got the debian package of zorp running under etch? How can I find out for sure what ${prefix} is, or how can I otherwise get more detailed info about this error?

2 2

Maling List Archives
by Matt Miller 08 Mar '07

08 Mar '07

Where are the latest archives for this mailing list? The most-recent I can find are at https://lists.balabit.hu/pipermail/zorp/, and apparently these haven't been updated since August 2006.

2 1

Virtual Private Connection crash kernel with tproxy
by Zhou Li 27 Aug '06

27 Aug '06

Environment: Windows 2000 <--> Linux with tproxy <--> VPN server. Linux kernel is 2.6.15 with cttproxy-2.6.15-2.0.4 all four patch. When I do Virtual Private Connectio from Win2000 to VPN server, the linux box will be crash, the following are crashing messages: Unable to handle kernel paging request at virtual address 00001a0c printing eip: *pde = 00000000 Oops: 0002 [#1] Modules linked in: ebt_vlan ebtable_broute ebtables iptable_tproxy iptable_nat iptable_mangle iptable_filter ipt_tproxy ipt_hashlimit ipt_connlimit ipt_state ipt_pkttype ipt_multiport ipt_mark ipt_length ipt_conntrack ipt_TPROXY ipt_REJECT ipt_LOG ip_queue ip_nat_snmp_basic ip_nat_pptp ip_nat_irc ip_nat_ftp ip_nat ip_conntrack_pptp ip_conntrack_irc ip_conntrack_ftp ip_conntrack nfnetlink ip_tables e100 mii bridge usbhid dm_mod isofs ide_cd cdrom ide_disk agpgart i2c_i801 uhci_hcd usbcore piix ide_core shpchp i2c_i810 i2c_algo_bit i2c_core CPU: 0 EIP: 0060:[<e09fe73d>] Not tainted VLI EFLAGS: 00010212 (2.6.15.6-3tr) EIP is at ip_nat_reserved_unregister_all+0x2c/0x6f [ip_nat] eax: d78016e8 ebx: d78016f0 ecx: 00000000 edx: 00001a08 esi: d78016f0 edi: d7801630 ebp: e08b9bc0 esp: c032dd20 ds: 007b es: 007b ss: 0068 Process swapper (pid: 0, threadinfo=c032c000 task=c02d9b00) Stack: d7801630 d7801630 d7801694 e09f3b1a d7801630 d7801630 e09f491a d7801630 d7801630 d7bee838 e09f00a0 d7801630 c011372f de46a030 00000001 00000000 c213e7dc c032e743 a658a8c0 c02f1a08 d7801694 d7bee838 c032dda8 e08b8053 Call Trace: [<e09f3b1a>] ip_ct_unlink_expect+0x34/0x3f [ip_conntrack] [<e09f491a>] ip_conntrack_unexpect_related+0xbb/0xdb [ip_conntrack] [<e09f00a0>] pptp_nat_expected+0xa0/0x153 [ip_nat_pptp] [<c011372f>] __wake_up_common+0x2b/0x47 [<c032e743>] readonly+0xd/0x17 [<e08b8053>] pptp_expectfn+0x53/0x5a [ip_conntrack_pptp] [<e09f3c65>] find_expectation+0x87/0x98 [ip_conntrack] [<e09f463b>] init_conntrack+0xf9/0x112 [ip_conntrack] [<c032e743>] readonly+0xd/0x17 [<e09f4735>] ip_conntrack_in+0xe1/0x1ea [ip_conntrack] [<e09d15f2>] br_nf_pre_routing_finish+0x0/0x2c0 [bridge] [<c0255926>] nf_iterate+0x3f/0x5f [<e09d15f2>] br_nf_pre_routing_finish+0x0/0x2c0 [bridge] [<c025598d>] nf_hook_slow+0x47/0xc4 [<e09d15f2>] br_nf_pre_routing_finish+0x0/0x2c0 [bridge] [<e09ce4ff>] br_handle_frame_finish+0x0/0xd4 [bridge] [<e09d1f34>] br_nf_pre_routing+0x37d/0x39c [bridge] [<e09d15f2>] br_nf_pre_routing_finish+0x0/0x2c0 [bridge] [<c0255926>] nf_iterate+0x3f/0x5f [<e09ce4ff>] br_handle_frame_finish+0x0/0xd4 [bridge] [<c025598d>] nf_hook_slow+0x47/0xc4 [<e09ce4ff>] br_handle_frame_finish+0x0/0xd4 [bridge] [<e09ce738>] br_handle_frame+0x165/0x1a9 [bridge] [<e09ce4ff>] br_handle_frame_finish+0x0/0xd4 [bridge] [<c0244c20>] netif_receive_skb+0x106/0x1cb [<e09da384>] e100_poll+0x1e1/0x53f [e100] [<c0244e15>] net_rx_action+0x59/0xc6 [<c01197c8>] __do_softirq+0x34/0x7d [<c0119833>] do_softirq+0x22/0x26 [<c0104e47>] do_IRQ+0x47/0x4f [<c01039ba>] common_interrupt+0x1a/0x20 [<c0101047>] default_idle+0x2b/0x53 [<c01010bc>] cpu_idle+0x39/0x4e [<c032e658>] start_kernel+0x176/0x178 Code: 56 53 b8 00 e0 ff ff 8b 7c 24 10 21 e0 81 40 14 00 01 00 00 8b 77 5c 8d 47 5c 39 c6 74 48 8d 46 f8 8b 36 8b 48 04 8b 10 8d 58 08 <89> 4a 04 89 11 c7 40 04 00 02 20 00 8b 50 08 8b 4b 04 c7 00 00 <0>Kernel panic - not syncing: Fatal exception in interrupt It is seem crash by nat reserved, so I disable NAT reservations in kernel config and recompile it then test it again, It will not be crash, but I don't konw if tproxy will work well without 01-nat_reservations? // Zhou Li

1 0

TPROXY with iptables nat??
by Jakub Bednář 04 Aug '06

04 Aug '06

Hi, I'd like to ask You a question. I'm now using tproxy aplication with my own nat inside, but I'd like to know, If I can add tproxy after normal nat from iptables? If so, can You please give me any example how to set the iptables? -A POSTROUTING with -j TPROXY is not accepted by iptables. Thank You very much. Regards, Jakub Bednar

2 2

UDP DEMO
by Jakub Bednář 22 Jul '06

22 Jul '06

Hi, I'm looking for an advise. I'm trying to build my own simple transparent proxy on 2.6.15.7 linux kernel. I was trying to run the redirect_udp_recv demo distributed with the patches and also rewrite something from zorp-3.0.9 but the messages are still not being delivered to the aplication. I think, I'm setting some options for the socket wrong. Can You please send me just a simple demo how to set the udp socket in order to be able to get the original dst address from the datagrams. I'm using only IP_RECVORIGADDRS. Thank You very mutch for Your help. I'm running out of time and the only 2.6 kernel I was able to run it was 2.6.10 with the old version of tproxy. I'm starting to feel really stupid :( With regards, Jakub Bednar.

1 0

tproxy linux-2.6.15 - bug??
by Jakub Bednář 19 Jul '06

19 Jul '06

Hi, thanks for helping with the TCP proxying problem. But I have another one. I was succesfully runing foreign-udp-recv demo on linux kernels 2.4.20, 2.4.23 and 2.4.27. Now I have downloaded kernels 2.6.15.1, 2.6.15.7 and 2.6.17 and cttproxy- 2.6.15-2.0.4 patches. I have correct the patches to apply on 2.6.17 kernel and I have compiled it correctly. On all kernels listening on foreign IP address and setting own source address works fine. But on all 2.6. Kernels the demo for foreign-udp-recv from examples is not running. I've added the rule to iptables, but it seems it doesn't work, becouse no traffic commes to my proxy. When I disable the rule for TPROXY and add only REDIRECT, the packet delivery is ok. When REDIRECT is active and TPROXY as well then no packets are delivered. So i think the TPROXY rule is hit while PREROUTING but the data are not delivered to the application. Any ideas how to fix it? I've spend nearly two days trying to make it work and I'm slowly giving up. Thanks for Your help. Jakub Bednar

1 0

Transparent proxy TCP
by Jakub Bednář 18 Jul '06

18 Jul '06

Hi, I would like to ask You if there exist a demo similar to redirect-udp-recv but for SOCK_STREAM sockets. I was trying to write it in nearly the same way as the redirect-tcp-recv, but it doesn't work correctly. Also my attempts to find the part of code in Zorp GPL wasn't succesfull becouse it's mostly written in Python. I'm using kernel 2.4.20 with netstaff patched to 2.4.23 and all the demos distributed with TPROXY-patch are running fine. Thank You for Your help. Jakub Bednar

2 1

Zorp GPL 3.0.9 has been released
by devel＠balabit.hu 22 Feb '06

22 Feb '06

------------------------------------------------------------------------------ PACKAGE : zorp VERSION : 3.0.9 SUMMARY : new stable release DATE : Feb 16, 2006 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of Zorp GPL (3.0.9) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: Core: * Fixed a race condition possibly causing abnormal program termination if the threaded parameter for one or more Listeners was enabled. * Fixed a race condition in the fastpath setup code possibly causing abnormal program termination under high load. * Added group handling to inband authentication. * Fixed a possible abnormal program termination when using inband authentication (applies to 3.0.8 only). * Fixed possible memory leak in inband authentication. * Fixed a possible memory leak when Certificate Revocation Lists were in use (requires libzorpll 3.0.6.5). * Added possibility to defer inband authentication to stacked proxies by setting the auth_inband_defer class attribute to TRUE. Ftp: * Abort the control connection if the data connection fails for some reason as this scenario might cause hangup problems for some clients/servers. UPGRADE: Upgrading using apt: ~~~~~~~~~~~~~~~~~~~~ Make sure the following line is in your /etc/apt/sources.list file: deb http://apt.balabit.com/zorp-gpl-os zorp-os-3.0/3.0 \ common-gpl zorp-gpl zorp-os zorp-os-extra then issue the following commands as root: # apt-get update; apt-get -u upgrade The latest upgrades will be downloaded and installed.

1 0

About Virus Filtering Module
by Lin, Zihui 14 Nov '05

14 Nov '05

Hi there, I'm working on my graduate paper which is on enabling AAA in Linux box using the netfilter framework. So I'm very interested in Zorp's virus filtering. As I'm taking a look at the patch tree (which is from the official unofficial site), I'm wondering if I can write my own virus filtering module. Did any of you guys tried to do this before? I am curious in the performance when we 'trickle' the application protocols. -- Best regards, Zihui

2 1