- zorp - lists.balabit.hu

Zorp GPL 3.0.8 has been released
by devel＠balabit.hu 09 Nov '05

09 Nov '05

------------------------------------------------------------------------------ PACKAGE : zorp VERSION : 3.0.8 SUMMARY : new stable release DATE : Nov 3, 2005 ------------------------------------------------------------------------------ DESCRIPTION: A new stable version of Zorp GPL (3.0.8) has been released. For latest fixes in the 3.0.x branch you are recommended to upgrade to this version. CHANGES: Core: * Fixed a possible Python traceback whenever a ZoneListener or CSZoneListener referred to a non-existant service. * Fixed a possible deadlock in processing UDP traffic. * Added round_robin parameter to FailoverChainer to make it possible to explicitly speicify round-robin and failover behaviour when establishing server connections. * Fixed umbrella behaviour for zones which had no inbound or outbound service list. zorpctl: * Fixed a possible segmentation fault in "zorpctl szig". Ftp: * Added a log message about rejected login attempts for anonymous-only FTP connections. * Fixed a possible memory leak active data connection establishment. * Fixed a possible deadlock in data session initiation. Ldap: * Fixed a possible parse error in long SEARCH requests. Pssl: * Changed all cipher suites to explicitly disallow not-authenticating algorithms such as anonymous-DH. Http: * Added countermeasures for various request/response smuggling attacks. * Fixed an interoperability problem to automatically reconnect when the server drops the connection while to proxy is waiting for the client. UPGRADE: Upgrading using apt: ~~~~~~~~~~~~~~~~~~~~ Make sure the following line is in your /etc/apt/sources.list file: deb http://apt.balabit.com/zorp-gpl-os zorp-os-3.0/3.0 \ common-gpl zorp-gpl zorp-os zorp-os-extra then issue the following commands as root: # apt-get update; apt-get -u upgrade The latest upgrades will be downloaded and installed.

2 1

SNAT
by Zhou Li 13 Oct '05

13 Oct '05

I startup five Services in my Zorp: http,ftp,telnet,finger,ssh(by plug), its work fine all, now I want to add a global SNAT rules for the five Servies but no sample I can found, how do I write my snat rules? any help will be appreciate! //ZhouLi

3 6

Zorp URL logging
by Pablo Pessolani 05 Sep '05

05 Sep '05

Hi: I want to know about the level of logging of zorp proxies. I configure instances.conf with Zhttp -- verbose 5 --policy ......... This configuration logs IP addresses, ports, bytes in, bytes out. Now, I need to know how to log the URLs that remote client visit in my web server through Zorp but I didn't find any documentation about it. Thanks in advance. PAP _________________________________________________________________ Consigue aquí las mejores y mas recientes ofertas de trabajo en América Latina y USA: http://latam.msn.com/empleos/

2 2

Zorp GPL 3.0.6 has been released
by devel＠balabit.hu 18 Aug '05

18 Aug '05

------------------------------------------------------------------------------ PACKAGE : zorp VERSION : 3.0.6 SUMMARY : new release DATE : 17 August 2005 ------------------------------------------------------------------------------ DESCRIPTION: Zorp GPL 3.0.6 has been released. CHANGES: Core: * Fixed a confusing message about an invalid ToS value when secondary sessions are used. * Fixed a possibly unhandled Python exception in FailoverChainer when no state timeout was specified. * Fixed a race condition possibly causing segmentation fault when the child proxy was communicating with its parent while that was being destroyed. The window of the race was very small, the problem occurs with large amounts of traffic only. Pssl: * Fixed a possible memory leak in Certificate Revocation List validation. Http: * Changed the default value for max_chunk_length to unlimited, as the previous limit of 256kB caused interoperability problems with various web servers/applications. * Fixed a possible problem in reconnection handling, causing data transfer timeouts for POST requests. Telnet: * Fixed a problem in processing multi-byte telnet sequences occurring on the buffer boundary. UPGRADE: Upgrading using apt: ~~~~~~~~~~~~~~~~~~~~ Add the following line to /etc/apt/sources.list: deb http://apt.balabit.com/zorp-gpl-os zorp-os-3.0/3.0 \ common-gpl zorp-gpl zorp-os zorp-os-extra then issue the following commands as root: # apt-get update; apt-get -u upgrade The latest upgrades will be downloaded and installed.

1 0

bug ?
by Zhou Li 14 Aug '05

14 Aug '05

I try to complie zorp-3.0.5.5 with libzorpll-3.1.0.0.2, and get the following error message: gcc -DHAVE_CONFIG_H -I. -I. -I.. -I/usr/src/zorp-3.0.5.5/lib -I/usr/src/zorp-3.0.5.5 -I -pthread -D_GNU_SOURCE -I/usr/include/glib-2.0 -I/usr/lib/glib-2.0/include -I/usr/local/include -I/usr/include/python2.3 -I/usr/include/python2.3/ExtensionClass -O2 -Wall -W -g -D_GNU_SOURCE -MT packstream.lo -MD -MP -MF .deps/packstream.Tpo -c packstream.c -fPIC -DPIC -o .libs/packstream.o packstream.c:47: error: redefinition of `struct _ZStreamPacket' packstream.c:56: warning: redefinition of `ZStreamPacket' /usr/local/include/zorp/stream.h:113: warning: `ZStreamPacket' previously declared here packstream.c:61: error: conflicting types for `z_stream_packet_new' /usr/local/include/zorp/stream.h:115: error: previous declaration of `z_stream_packet_new' packstream.c: In function `z_stream_packet_send': packstream.c:256: warning: implicit declaration of function `z_data_dump' packstream.c: At top level: packstream.c:751: warning: missing initializer packstream.c:751: warning: (near initialization for `z_stream_packet_funcs.set_child') packstream.c: In function `z_stream_packet_new': packstream.c:768: error: `Z_STREAM_FLAG_READ' undeclared (first use in this function) packstream.c:768: error: (Each undeclared identifier is reported only once packstream.c:768: error: for each function it appears in.) packstream.c:768: error: `Z_STREAM_FLAG_WRITE' undeclared (first use in this function) packstream.c:768: warning: passing arg 3 of `z_stream_new' makes integer from pointer without a cast packstream.c:768: error: too many arguments to function `z_stream_new' make[3]: *** [packstream.lo] Error 1 make[3]: Leaving directory `/usr/src/zorp-3.0.5.5/lib' make[2]: *** [all-recursive] Error 1 make[2]: Leaving directory `/usr/src/zorp-3.0.5.5/lib' make[1]: *** [all-recursive] Error 1 make[1]: Leaving directory `/usr/src/zorp-3.0.5.5' make: *** [all] Error 2 //Zhou Li

2 1

FYI: zorp-admin-guide 3.0.2 released
by Balazs Scheidler 22 Jul '05

22 Jul '05

Hi, A small update for those interested, we have updated Zorp Administrator's Guide, available from: http://www.balabit.com/products/docs/ Although it introduces the commercial version of Zorp, and thus focuses on the GUI based management, it contains useful insights to Zorp philosophy and thus is a recommended reading for anyone interested in Zorp. -- Bazsi

1 0

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Yeah I added the x flag as well - I got the tproxy so libraries installed through trial and error. Instead of using default make command given in the instructions, i.e. "make KERNELDIR=<path-to-kernel>" I used "make KERNEL_DIR=<path-to-kernel>" This seems to have done the trick -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Sandor Geller Sent: July 20, 2005 2:00 AM To: Zorp users mailing list Subject: RE: [zorp] tproxy problem 2005-07-20, sze keltezéssel 00.44-kor Mark Nadir ezt írta: > Hmmm - for some reason when recompiling iptables, the tproxy shared > object libraries mentioned below are NOT being compiled. > > Any thoughts on why? Did you add the executable flag to the .tproxy-test file? It has to be executable otherwise the tproxy module won't be compiled. -- Sandor Geller wildy(a)balabit.hu _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

1 0

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Hmmm - for some reason when recompiling iptables, the tproxy shared object libraries mentioned below are NOT being compiled. Any thoughts on why? -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Mark Nadir Sent: July 20, 2005 12:51 AM To: Zorp users mailing list Subject: RE: [zorp] tproxy problem Heh ok - recompiling/rebuilding everything from scratch again - let's see how it goes - actually, if you have 1.2.11, can you send me those so files? -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 20, 2005 12:16 AM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem No, I applied it to iptables 1.2.11 successfully and it work fine. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 11:49 Subject: RE: [zorp] tproxy problem Yah I traced that as the problem - I don't have either - which is strange since the kernel was compiled and built successfully. I am wondering if the cttproxy patch only applies to iptables 1.2.7 -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 11:23 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem so you got files /lib/iptables/libipt_TPROXY.so and /lib/iptables/libipt_tproxy.so in your system? I has met the same problem when I using zorp first time, and I found reason finally was missing the two files. ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 10:42 Subject: RE: [zorp] tproxy problem Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

3 2

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Heh ok - recompiling/rebuilding everything from scratch again - let's see how it goes - actually, if you have 1.2.11, can you send me those so files? -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 20, 2005 12:16 AM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem No, I applied it to iptables 1.2.11 successfully and it work fine. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 11:49 Subject: RE: [zorp] tproxy problem Yah I traced that as the problem - I don't have either - which is strange since the kernel was compiled and built successfully. I am wondering if the cttproxy patch only applies to iptables 1.2.7 -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 11:23 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem so you got files /lib/iptables/libipt_TPROXY.so and /lib/iptables/libipt_tproxy.so in your system? I has met the same problem when I using zorp first time, and I found reason finally was missing the two files. ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 10:42 Subject: RE: [zorp] tproxy problem Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

1 0

RE: [zorp] tproxy problem
by Mark Nadir 20 Jul '05

20 Jul '05

Yah I traced that as the problem - I don't have either - which is strange since the kernel was compiled and built successfully. I am wondering if the cttproxy patch only applies to iptables 1.2.7 -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 11:23 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem so you got files /lib/iptables/libipt_TPROXY.so and /lib/iptables/libipt_tproxy.so in your system? I has met the same problem when I using zorp first time, and I found reason finally was missing the two files. ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 10:42 Subject: RE: [zorp] tproxy problem Actually zhou, I got iptables-1.2.11 and applied the patch in the source of same. -----Original Message----- From: zorp-bounces(a)lists.balabit.hu [mailto:zorp-bounces@lists.balabit.hu] On Behalf Of Zhou Li Sent: July 19, 2005 10:17 PM To: Zorp users mailing list Subject: Re: [zorp] tproxy problem I think you haven't applied iptables-1.2.7a-cttproxy-04.diff for iptables, you can find it in cttproxy-2.4.30-2.0.1.tar.gz, Mark. //ZhouLi ----- Original Message ----- From: "Mark Nadir" <mnadir(a)cyrca.net> To: "Zorp users mailing list" <zorp(a)lists.balabit.hu> Sent: Wednesday, July 20, 2005 09:37 Subject: [zorp] tproxy problem Hi there I was wondering if anyone can help me figure out why tproxy doesn't seem to work. I am currently using the 2.4.31 kernel with t-proxy patch successfully applied. However, whenever I try to create an iptables statement to enable tproxy to listen on a port, I get the following messages: iptables v1.2.11: Unknown arg `--on-port' Try `iptables -h' or 'iptables --help' for more information. An lsmod reveals the following: Module Size Used by Not tainted ipt_limit 888 6 (autoclean) ipt_state 536 28 (autoclean) iptable_tproxy 13312 0 (autoclean) (unused) ipt_LOG 3968 1 (autoclean) ipt_tproxy 504 0 (unused) iptable_filter 1740 1 (autoclean) iptable_nat 21466 1 (autoclean) [iptable_tproxy] ip_conntrack 25264 0 (autoclean) [ipt_state iptable_tproxy ipt_tproxy iptable_nat] iptable_mangle 2168 0 (autoclean) (unused) ip_tables 12128 10 [ipt_limit ipt_state iptable_tproxy ipt_LOG ipt_tproxy iptable_filter iptable_nat iptable_mangle] Anyone know why my tproxy statement returns this error of unknown argument? Thanks in advance. Regards, Mark. _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp _______________________________________________ zorp mailing list zorp(a)lists.balabit.hu https://lists.balabit.hu/mailman/listinfo/zorp

2 1