[tproxy] Tproxy + Squid 2.6

[Enrico Demarin (home)]

Correction, tproxy seems to return -EINVAL because rcv_saddr is 0, not 
sk->sport
 

- Enrico

Enrico Demarin (home) wrote:
> I was looking at the squid error log and at tproxy source :
>
> in iptable_tproxy_c:
>
> static int
> ip_tproxy_setsockopt_assign(struct sock *sk, int proto, struct 
> in_tproxy *itp)
> {
> ...
>        if (!sk->rcv_saddr || !sk->sport)
>                return -EINVAL;
>
>
> In the squid log :
>
> 2006/09/15 00:09:14| tproxy ip=10.0.0.200,0xc800000a,port=0 ERROR ASSIGN
> 2006/09/15 00:09:14| tproxy ip=10.0.0.200,0xc800000a,port=0 ERROR ASSIGN
>
> and in squid's src/forward.c
>
> static void
> fwdConnectStart(void *data)
> {
> ...
>            itp.op = TPROXY_ASSIGN;
>            if (setsockopt(fd, SOL_IP, IP_TPROXY, &itp, sizeof(itp)) == 
> -1) {
>                debug(20, 1) ("tproxy ip=%s,0x%x,port=%d ERROR ASSIGN\n",
>                    inet_ntoa(itp.v.addr.faddr),
>                    itp.v.addr.faddr.s_addr,
>                    itp.v.addr.fport);
>
> It seems squid sends a ftport == 0 and tproxy returns -EINVAL. I will 
> look more into it tomorrow but in the mean time, does anyone have an 
> idea why ?
>
> -  Enrico
>
>
> Enrico Demarin (home) wrote:
>>> / However Squid doesnt seem to able to spoof the original IP:
>> /
>>> tproxy needs CAP_NET_ADMIN. Which you do not have when running in 
>>> unprivileged mode. And running in privileged mode (root) is 
>>> inhibited by squid.
>>
>>> / Did any one get squid+cttproxy to work on a bridge ? What am I 
>>> missing
>> />/ ?
>> /
>>> Something that gives your squid user the CAP_NET_ADMIN capability.
>>
>> Doesnt this do it ( squid 2.6,  tools.c ) ? I added a debug message 
>> and it's printed during init however i still get the ERROR ASSIGN 
>> messages.
>>
>>
>> #if LINUX_TPROXY
>>    if (need_linux_tproxy) {
>>        cap_user_header_t head = (cap_user_header_t) xcalloc(1, 
>> sizeof(cap_user_header_t));
>>        cap_user_data_t cap = (cap_user_data_t) xcalloc(1, 
>> sizeof(cap_user_data_t));
>>
>>        head->version = _LINUX_CAPABILITY_VERSION;
>>        head->pid = 0;
>>        cap->inheritable = cap->permitted = cap->effective = (1 << 
>> CAP_NET_ADMIN) + (1 << CAP_NET_BIND_SERVICE) + (1 << CAP_NET_BROADCAST);
>>
>>
>>        if (capset(head, cap) != 0) {
>>            xfree(head);
>>            xfree(cap);
>>            fatal("Error giving up capabilities");
>>        }
>>        debug(50,0) ("Caps set to %x",cap->effective);
>>        xfree(head);
>>        xfree(cap);
>>    }
>> #endif
>>
>>
>> _______________________________________________
>> tproxy mailing list
>> tproxy at lists.balabit.hu
>> https://lists.balabit.hu/mailman/listinfo/tproxy
>>
>>
>
>
>