Skip to content

Transparent proxying patches, take six

KOVACS Krisztian netdev netfilter-devel 1 version Applied

Status from this message: Applied to net-next-2.6

Get series with b4
b4 am 20081001142431.4893.48078.stgit@este

Versions newest first

  1. v1 Latest16 patches 40 repliesApplied

Patches in v1 Applied

#Subject and filesSizeRepliesApplied
1/16Loosen source address check on IPv4 outputinclude/net/flow.h net/ipv4/route.c+15 -71 reply
2/16Implement IP_TRANSPARENT socket optioninclude/linux/in.h include/net/inet_sock.h include/net/inet_timewait_sock.h +2 more+20 -31 reply
3/16Allow binding to non-local addresses if IP_TRANSPARENT is setnet/ipv4/af_inet.c+1 -11 reply
4/16Make inet_sock.h independent of route.hinclude/net/inet_sock.h include/net/ip_vs.h include/net/route.h +2 more+8 -71 reply
5/16Conditionally enable transparent flow flag when connectinginclude/net/route.h+5 -11 reply
6/16Handle TCP SYN+ACK/ACK/RST transparencyinclude/net/inet_sock.h net/ipv4/tcp_ipv4.c+16 -42 replies
7/16Make Netfilter's ip_route_me_harder() non-local address compatibleinclude/net/ip.h net/ipv4/inet_connection_sock.c net/ipv4/ip_output.c +2 more+18 -11 reply
8/16Port redirection support for TCPinclude/net/inet_sock.h include/net/tcp.h net/ipv4/inet_connection_sock.c +2 more+6 -21 reply
9/16Export UDP socket lookup functioninclude/net/udp.h net/ipv4/udp.c+11 -01 reply
10/16Don't lookup the socket if there's a socket attached to the skbnet/ipv4/tcp_ipv4.c+9 -017 replies
11/16Don't lookup the socket if there's a socket attached to the skbnet/ipv4/udp.c+16 -00 replies
12/16Split Netfilter IPv4 defragmentation into a separate moduleinclude/net/netfilter/ipv4/nf_defrag_ipv4.h net/ipv4/netfilter/Kconfig net/ipv4/netfilter/Makefile +2 more+113 -531 reply
13/16iptables tproxy coreinclude/net/netfilter/nf_tproxy_core.h net/netfilter/Kconfig net/netfilter/Makefile +1 more+146 -01 reply
14/16iptables socket matchnet/netfilter/Kconfig net/netfilter/Makefile net/netfilter/xt_socket.c+198 -04 replies
15/16iptables TPROXY targetinclude/linux/netfilter/xt_TPROXY.h net/netfilter/Kconfig net/netfilter/Makefile +1 more+142 -01 reply
16/16Add documentationDocumentation/networking/tproxy.txt+85 -011 replies

Reviews trailers per patch

1 of 16 patches has a Reviewed-by or Acked-by.

PatchArnaldo Carvalho de Melo
1/16
2/16
3/16
4/16
5/16
6/16
7/16
8/16
9/16
10/16A-b A-b
11/16
12/16
13/16
14/16
15/16
16/16

Trailers given in replies are filled; those carried in the patches from earlier versions are outlined with dashes.

Read the v1 thread

Cover letter [net-next PATCH 00/16] Transparent proxying patches, take six

Hi Dave,

This is the sixth round of transparent proxying patches recently discussed on the Netfilter Workshop. Since the last incarnation [1] we've added support for related ICMP packets in the socket match. Should apply cleanly on top of net-next-2.6. Could you please apply patches 1-11 (those touching core networking parts) and I'll ask Patrick McHardy to take care of patches 12-16 (the Netfilter parts).

The aim of the patchset is to make non-locally bound sockets work both for receiving and sending. The target is IPv4 TCP/UDP at the moment.

Speaking of the patches, there are two big parts:

* Output path (patches 1-7): these modifications make it possible to send IPv4 datagrams with non-local source IP address by:

- Introducing a new flowi flag (FLOWI_FLAG_ANYSRC) which disables source address checking in ip_route_output_slow(). This is also necessary for some of the tricks LVS does. [2]

- Adding the IP_TRANSPARENT socket option (setting this requires CAP_NET_ADMIN to prevent source address spoofing).

- Gluing these together across the TCP/UDP code.

* Input path (patches 8-15): these changes add redirection support for TCP along with an iptables target implementing NAT-less traffic interception, and an iptables match to make ahead-of-time socket lookups on PREROUTING. These combined with a set of iptables rules and policy routing make non-locally bound sockets work.

- IPv4 TCP and UDP input path is modified to use this stored socket reference if it's present.

- Netfilter IPv4 defragmentation is split into a separate module. (This could make sense independently of tproxy and conntrack, for example to have a stateless firewall which still does fragment reassembly.)

- The 'socket' iptables match does a socket lookup on the destination address and matches if a socket was found.

- The 'TPROXY' iptables target provides a way to intercept traffic without NAT -- it does an ahead-of-time socket lookup on the configured address and caches the socket reference in the skb.

The last patch adds a short intro on how to use it. A trivial patch for netcat demonstrating the necessary modifications for proxies is available separately at [3]. Squid has support for it in the 3.HEAD (3.1) branch.

References:
[1] http://lwn.net/Articles/254527/
[2] http://marc.info/?l=linux-netdev&m=118065358510836&...
[3] http://people.netfilter.org/hidden/tproxy/netcat-ip_trans...

Signature · 1 line
KOVACS Krisztian

Read the cover letter in its thread