[zorp-hu] tproxy 4.1.0 + iptables szabalyok + zorp 3.1

[Kosa Attila]

On Fri, Jul 31, 2009 at 11:10:41AM +0200, Balazs Scheidler wrote:
> On Thu, 2009-07-30 at 12:26 +0200, Kosa Attila wrote:
> > 
> > Igy inditottam:
> > # strace -f -o /tmp/zorp.log /etc/init.d/zorp start
> > # grep -i transpa /tmp/zorp.log
> > # grep -i setsock /tmp/zorp.log
> > 2396  setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\3\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available)
> > 2396  setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\2\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available)
> > 2396  setsockopt(12, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
> > 
> > Az latszik, hogy a zorp listenel a megfelelo interfeszen, azonban
> > a csomagok nem kerulnek fel hozza.

# grep -i transpa /tmp/zorp.log
# grep -i setsock /tmp/zorp.log
11195 setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\3\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available)
11195 setsockopt(10, SOL_IP, 0x2c0a /* IP_??? */, "\0\0\0\0\0\0\0\2\0\0\0\0"..., 12) = -1 ENOPROTOOPT (Protocol not available)
11195 setsockopt(12, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
11195 setsockopt(12, SOL_IP, 0x13 /* IP_??? */, [1], 4) = 0

# cat /etc/zorp/policy-http.py
from Zorp.Core import *
from Zorp.Http import *

Zorp.firewall_name = 'zorp-http at x.hu'

InetZone("webezes", "10.10.10.0/24",
    inbound_services=[],
    outbound_services=["intra_http"])

InetZone("internet", "0.0.0.0/0",
    inbound_services=["intra_http"],
    outbound_services=[])

class IntraHttp(HttpProxy):
    def config(self):
	HttpProxy.config(self)
	self.transparent_mode = 1

def zorp_http():
	Service("intra_http", IntraHttp, InbandRouter())

	Listener(SockAddrInet("10.10.10.10", 50080), "intra_http", transparent=TRUE)

> ez az uzenet startup-kor jon -v6 -os loglevelen. mi jon ki itt:
> 
>   z_log(NULL, CORE_DEBUG, 6, "System dependant init; sysdep_tproxy='%s'", sysdep_tproxy_str[sysdep_tproxy]);

Aug  4 10:22:12 gplzorp-lenny zorp/zorp_http[11195]: (nosession): System dependant init; sysdep_tproxy='tproxy40'

# ip rule list
0:	from all lookup local 
32765:	from all fwmark 0x1 lookup 100 
32766:	from all lookup main 
32767:	from all lookup default 

# cat /etc/iptables.conf.in
*mangle
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:DIVERT -
-A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
-A PREROUTING -p tcp -m socket -j LOG --log-prefix "SOCKET forgalom: "
-A PREROUTING -p tcp -m socket -j DIVERT
-A PREROUTING -p tcp --dport 80 -j LOG --log-prefix "PREROUTING forgalom: "
-A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080
-A DIVERT -j LOG --log-prefix "DIVERT forgalom: "
-A DIVERT -j MARK --set-mark 1
-A DIVERT -j ACCEPT
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j LOG --log-prefix "INPUT forgalom: "
COMMIT

A tcpdump szerint csak a SYN-es csomag jut el a tuzfalig, es
semmi nem megy vissza a klienshez.

A tproxy-s szabaly szamlaloi emelkednek, de a divert chain
szamlaloi nem.

# grep forgalom /var/log/syslog
Aug  4 10:54:43 gplzorp-lenny kernel: [427773.913935] INPUT forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=10.10.10.10 LEN=54 TOS=0x00 PREC=0x00 TTL=64 ID=19689 DF PROTO=UDP SPT=32770 DPT=53 LEN=34 
Aug  4 10:54:43 gplzorp-lenny kernel: [427773.915082] INPUT forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=10.10.10.10 LEN=66 TOS=0x00 PREC=0x00 TTL=64 ID=19689 DF PROTO=UDP SPT=32770 DPT=53 LEN=46 
Aug  4 10:54:43 gplzorp-lenny kernel: [427773.915842] INPUT forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=10.10.10.10 LEN=54 TOS=0x00 PREC=0x00 TTL=64 ID=19690 DF PROTO=UDP SPT=32770 DPT=53 LEN=34 
Aug  4 10:54:43 gplzorp-lenny kernel: [427773.925156] PREROUTING forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=217.20.130.97 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60218 DF PROTO=TCP SPT=35813 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 
Aug  4 10:54:46 gplzorp-lenny kernel: [427776.920697] PREROUTING forgalom: IN=eth1 OUT= MAC=00:0c:29:c1:1a:35:00:0c:29:9b:d1:7e:08:00 SRC=10.10.10.100 DST=217.20.130.97 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=60219 DF PROTO=TCP SPT=35813 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 

-- 
		Udvozlettel
				    Zsiga