[zorp-hu] tproxy - iptables - zorp

2009. Sze. 30., Sze, 09:52:51 CEST

Kedves Lista!

Az augusztusi Zsiga problema, nalam nem akar megoldodni:

Telepitettem egy ubuntu 8.04.3 LTS-t,
megfoltoztam a kernelt es az iptables-t,
hasznalom az ubuntu sajat zorp csomagjat:

>uname -a
Linux ujfal 2.6.24-24-386 #1 Fri Sep 18 09:10:11 CDT 2009 i686 GNU/Linux

>iptables -V
iptables v1.4.0

>zorpctl version
Zorp 3.0.8
Revision: 
Compile-Date: Mar 21 2007 22:51:55
Config-Date: 2007/03/21
Trace: off
Debug: off
IPOptions: off
IPFilter-Tproxy: off
Netfilter-Tproxy: on
Netfilter-Linux22-Fallback: on
Linux22-Tproxy: off
Conntrack: on

Zorplib 3.0.6.4.2
Revision: devel at balabit.hu--zorp-1/zorp-lib--mainline--3.0--patch-116
Compile-Date: Jun 21 2006 01:01:55
Trace: off
MemTrace: off
Caps: on
Debug: off
StackDump: on

A README-kben talalhato egyszeru test rendszert szeretnem megvalositani:
>cat policy.py
from Zorp.Core import *
from Zorp.Http import *

Zorp.firewall_name = 'z'

InetZone("inter", "0.0.0.0/0",
	inbound_services=["io_http"],
	outbound_services=[])

InetZone("intra", "172.16.0.0/16",
	inbound_services=[],
	outbound_services=["io_http"])

class MyHttpProxy(HttpProxy):
	def config(self):
		HttpProxy.config(self)
		self.transparent_mode = 1
		log("http",2,"S: %s C: %s" % (self.session.server_address.ip_s, self.session.client_address.ip_s))

def i2o_http():
	Service("io_http", MyHttpProxy, InbandRouter())
	Listener(SockAddrInet("a.b.c.d", 50080), "io_http", transparent=TRUE)

>cat iptables.conf
*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:DIVERT - [0:0]
-A PREROUTING -p tcp -m socket -j DIVERT
-A PREROUTING -j LOG --log-prefix "TPROXY: " 
-A PREROUTING -p tcp -m tcp --dport 80 -j TPROXY --on-port 50080 --on-ip a.b.c.d --tproxy-mark 0x1/0x1 
-A DIVERT -j LOG --log-prefix "DIVERT: "
-A DIVERT -j MARK --set-mark 0x1 
-A DIVERT -j ACCEPT 
COMMIT
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -j LOG --log-prefix "INPUT: "
COMMIT

a.b.c.d a tuzfal intranet feloli ip cime.

>ip rule list
0:	from all lookup local 
32765:	from all fwmark 0x1/0x1 lookup 100 
32766:	from all lookup main 
32767:	from all lookup default 

elinditottam a zorpot:
>strace -o log -f zorpctl start i2o_http

a log socket resze:
>grep setso log
4492  setsockopt(14, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0

a zorp figyel az 50080-as porton:
>netstat -a | grep 50080
tcp        0      0 a.b.c.d:50080      *:*                     LISTEN     

elinditok egy kapcsolatot a kliensen a 80-as porton:
client>telnet x.y.z.w 80

cliensen a tcpdump:
client>tcpdump -i eth0 -vvv -t port 80
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
IP (tos 0x10, ttl 64, id 57778, offset 0, flags [DF], proto TCP (6), length 60) e.f.g.h.49665 > x.y.z.w.http: S, cksum 0x2baa (correct), 886293896:886293896(0) win 5840 <mss 1460,sackOK,timestamp 3089466 0,nop,wscale 6>
IP (tos 0x10, ttl 64, id 57779, offset 0, flags [DF], proto TCP (6), length 60) e.f.g.h.49665 > x.y.z.w.http: S, cksum 0x1ff2 (correct), 886293896:886293896(0) win 5840 <mss 1460,sackOK,timestamp 3092466 0,nop,wscale 6>
IP (tos 0x10, ttl 64, id 57780, offset 0, flags [DF], proto TCP (6), length 60) e.f.g.h.49665 > x.y.z.w.http: S, cksum 0x0882 (correct), 886293896:886293896(0) win 5840 <mss 1460,sackOK,timestamp 3098466 0,nop,wscale 6>

a serveren pedig ezt latom:
server>grep 'DPT=80' /var/log/messages
Sep 30 04:37:26 fal kernel: [ 4034.309881] TPROXY: IN=eth1 OUT= MAC=00:1f:c6:2f:66:03:00:1d:72:13:9f:46:08:00 SRC=e.f.g.h DST=x.y.z.w LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=57778 DF PROTO=TCP SPT=49665 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 
Sep 30 04:37:29 fal kernel: [ 4037.305958] TPROXY: IN=eth1 OUT= MAC=00:1f:c6:2f:66:03:00:1d:72:13:9f:46:08:00 SRC=e.f.g.h DST=x.y.z.w LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=57779 DF PROTO=TCP SPT=49665 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 
Sep 30 04:37:35 fal kernel: [ 4043.300099] TPROXY: IN=eth1 OUT= MAC=00:1f:c6:2f:66:03:00:1d:72:13:9f:46:08:00 SRC=e.f.g.h DST=x.y.z.w LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=57780 DF PROTO=TCP SPT=49665 DPT=80 WINDOW=5840 RES=0x00 SYN URGP=0 

(e.f.g.h a client ip cime, az x.y.z.w a cel gep ip cime)

azaz ugyanaz a bajom, mint Bazsinak, a zorp nem kapja meg a csomagokat, de nalam az --on-ip kapcsolo nem oldja meg a problemat.

lehet, hogy a verziok nem felcserelhetok, de ezzel kapcsolatban nem talalok semmi infot (sajnos a zorp-gpl kicsit elhanyagolt, pl: Zorp Tutorial Version 1.0.4
22th April, 2005, http://www.balabit.hu/network-security/gpl/tutorial/)

mit neztem el, mit kell valtoztatnom, hogy a csomagok megerkezzenek a
zorp-hoz?

Minden segitseget elore is koszonok,
tusi