Transparent Proxying Patches, Take 3 - userspace
PATCH 1/1 Transparent Proxying Patches, Take 3 - userspace
Hi Patrick,
Here is the patch adding iptables components of the 'socket' match and the 'TPROXY' target. The code is pretty straightforward and basic manual pages describing what the two modules do are included in the patch.
The patch should apply cleanly to current SVN.
--- .socket-testx | 2 .tproxy-test | 2 libipt_TPROXY.c | 143 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ libipt_TPROXY.man | 32 ++++++++++++ libipt_socket.man | 1 libxt_socket.c | 58 +++++++++++++++++++++ 6 files changed, 238 insertions(+)
extensions/libipt_TPROXY.man new file +32 -0
@@ -0,0 +1,32 @@ +This target is only valid in the +.B mangle +table, in the +.B PREROUTING +chain, and user-defined chains which are only called from that chain. It +redirects the packet to a local socket without changing the packet header in +any way. It can also change the mark value which can then be used in advanced +routing rules. +It takes three options: +.TP +.BR "--on-port " "\fIport\fP" +This specifies a destination port to use. It is a required option, 0 +means the new destination port is the same as the original. This is +only valid if the rule also specifies +.B "-p tcp" +or +.BR "-p udp" . +.TP +.BR "--on-ip " "\fIaddress\fP" +This specifies a destination address to use. By default the address is +the IP address of the incoming interface. This is only valid if the +rule also specifies +.B "-p tcp" +or +.BR "-p udp" . +.TP +.BR "--tproxy-mark " "\fIvalue[/mask]\fP" +Marks packets with the given value/mask. The fwmark value set here can be used +by advanced routing. (Required for transparent proxying to work: otherwise +these packets will get forwarded, which is probably not what you want.) +.RS +.PP
extensions/libipt_TPROXY.c new file +143 -0
143 lines not on this page · raw message
extensions/.tproxy-test new file +2 -0
@@ -0,0 +1,2 @@ +#!/bin/sh +[ -f $KERNEL_DIR/include/linux/netfilter_ipv4/ipt_TPROXY.h ] && echo TPROXY
extensions/libipt_socket.man new file +1 -0
@@ -0,0 +1 @@ +This matches if an open socket can be found by doing a socket lookup on the packet.
extensions/.socket-testx new file +2 -0
@@ -0,0 +1,2 @@ +#!/bin/sh +echo socket
extensions/libxt_socket.c new file +58 -0
58 lines not on this page · raw message
Signature · 1 line
KOVACS Krisztian
Quoted 6 lines · KOVACS Krisztian
Hi Patrick,
Here is the patch adding iptables components of the 'socket' match and the 'TPROXY' target. The code is pretty straightforward and basic manual pages describing what the two modules do are included in the patch.
Hm, you asked me for my kernel patch, well you could have also asked for the iptables part :-p
Uses the kernel-level xt_TPROXY.
--- extensions/.tproxy-testx | 3 + extensions/libipt_TPROXY.man | 21 +++++++ extensions/libipt_socket.man | 2 extensions/libxt_TPROXY.c | 114 +++++++++++++++++++++++++++++++++++++++++++ extensions/libxt_socket.c | 48 ++++++++++++++++++ 5 files changed, 188 insertions(+)
extensions/.tproxy-testx new file +3 -0
@@ -0,0 +1,3 @@ +#!/bin/sh +[ -f "$KERNEL_DIR/include/linux/netfilter/xt_TPROXY.h" ] && echo TPROXY; +echo socket;
extensions/libipt_TPROXY.man new file +21 -0
@@ -0,0 +1,21 @@ +This target is only valid in the \fBmangle\fR table, in the \fBPREROUTING\fR +chain and user-defined chains which are only called from this chain. It +redirects the packet to a local socket without changing the packet header in +any way. It can also change the mark value which can then be used in advanced +routing rules. +It takes three options: +.TP +\fB--on-port\fR \fIport\fR +This specifies a destination port to use. It is a required option, 0 means the +new destination port is the same as the original. This is only valid if the +rule also specifies \fB-p tcp\fR or \fB-p udp\fR. +.TP +\fB--on-ip\fR \fIaddress\fR +This specifies a destination address to use. By default the address is the IP +address of the incoming interface. This is only valid if the rule also +specifies \fB-p tcp\fR or \fR-p udp\fR. +.TP +\fB--tproxy-mark\fR \fIvalue\fR[\fB/\fR\fImask\fR] +Marks packets with the given value/mask. The fwmark value set here can be used +by advanced routing. (Required for transparent proxying to work: otherwise +these packets will get forwarded, which is probably not what you want.)
extensions/libipt_socket.man new file +2 -0
@@ -0,0 +1,2 @@ +This matches if an open socket can be found by doing a socket lookup on the +packet.
extensions/libxt_TPROXY.c new file +114 -0
114 lines not on this page · raw message
extensions/libxt_socket.c new file +48 -0
48 lines not on this page · raw message
Hi Jan,
Quoted 8 lines · Jan Engelhardt
Quoted 6 lines · KOVACS Krisztian
Hi Patrick,
Here is the patch adding iptables components of the 'socket' match and the 'TPROXY' target. The code is pretty straightforward and basic manual pages describing what the two modules do are included in the patch.
Quoted 4 lines
Hm, you asked me for my kernel patch, well you could have also asked for the iptables part :-p
Uses the kernel-level
xt_TPROXY.
Thanks, but this one is old: the userspace patch I've sent has received significant updates since than.
As Attila has already done the userspace ipt->xt conversion we could update it to xt_* anytime: it's just that I don't think it's worth it -- it's heavily IPv4 dependent anyway.
The 'socket' match does not support IPv6 either, however, we could add support _without_ any changes to the userspace, so that's why it's an x_tables match.
Signature · 1 line
KOVACS Krisztian
Re: [PATCH] libxt_socket, libxt_TPROXY
In reply to KOVACS KrisztianQuoted 3 lines · KOVACS Krisztian
---
.socket-testx | 2
This test is not needed, let's just add it to the Makefile.
Quoted 1 line
.tproxy-test | 2
Patrick prefers adding the kernel headers into (/iptables/)include/netfilter/ over .*-tests.
The libxt_socket extension was simplified even more. (Patrick: Could not we extend/use libxt_standard somehow?)
Due to the rearrangement of xt_TPROXY.h, here's the userspace blob. Of course, recent. Compile-tested.libxt_socket runtime-tested.
===
--- extensions/Makefile | 2 extensions/libipt_TPROXY.man | 21 +++++ extensions/libipt_socket.man | 2 extensions/libxt_TPROXY.c | 149 ++++++++++++++++++++++++++++++++++++ extensions/libxt_socket.c | 39 +++++++++ include/linux/netfilter/xt_TPROXY.h | 16 +++ 6 files changed, 228 insertions(+), 1 deletion(-)
extensions/Makefile +1 -1
@@ -7,7 +7,7 @@ # PF_EXT_SLIB:=ah addrtype conntrack ecn icmp iprange owner policy realm recent tos ttl unclean CLUSTERIP DNAT ECN LOG MASQUERADE MIRROR NETMAP REDIRECT REJECT SAME SNAT TOS TTL ULOG PF6_EXT_SLIB:=ah dst eui64 frag hbh hl icmp6 ipv6header mh owner policy rt HL LOG REJECT -PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TRACE +PFX_EXT_SLIB:=connbytes connmark connlimit comment dccp dscp esp hashlimit helper length limit mac mark multiport physdev pkttype quota sctp socket state statistic standard string tcp tcpmss time u32 udp CLASSIFY CONNMARK DSCP MARK NFLOG NFQUEUE NOTRACK TCPMSS TPROXY TRACE PF_EXT_SELINUX_SLIB:= PF6_EXT_SELINUX_SLIB:=
extensions/libipt_TPROXY.man new file +21 -0
@@ -0,0 +1,21 @@ +This target is only valid in the \fBmangle\fR table, in the \fBPREROUTING\fR +chain and user-defined chains which are only called from this chain. It +redirects the packet to a local socket without changing the packet header in +any way. It can also change the mark value which can then be used in advanced +routing rules. +It takes three options: +.TP +\fB--on-port\fR \fIport\fR +This specifies a destination port to use. It is a required option, 0 means the +new destination port is the same as the original. This is only valid if the +rule also specifies \fB-p tcp\fR or \fB-p udp\fR. +.TP +\fB--on-ip\fR \fIaddress\fR +This specifies a destination address to use. By default the address is the IP +address of the incoming interface. This is only valid if the rule also +specifies \fB-p tcp\fR or \fR-p udp\fR. +.TP +\fB--tproxy-mark\fR \fIvalue\fR[\fB/\fR\fImask\fR] +Marks packets with the given value/mask. The fwmark value set here can be used +by advanced routing. (Required for transparent proxying to work: otherwise +these packets will get forwarded, which is probably not what you want.)
extensions/libipt_socket.man new file +2 -0
@@ -0,0 +1,2 @@ +This matches if an open socket can be found by doing a socket lookup on the +packet.
extensions/libxt_TPROXY.c new file +149 -0
149 lines not on this page · raw message
extensions/libxt_socket.c new file +39 -0
@@ -0,0 +1,39 @@ +/* +* Shared library add-on to iptables to add early socket matching support. +* +* Copyright (C) 2007 BalaBit IT Ltd. +*/ +#include <stdio.h> +#include <getopt.h> +#include <iptables.h> + +static void socket_help (void ) +{ +printf ("socket v%s has no options\n" ,IPTABLES_VERSION ); +} + +static int socket_parse (int c,char **argv,int invert,unsigned int *flags, +const void *entry,struct xt_entry_match **match) +{ +return 0 ; +} + +static void socket_check (unsigned int flags) +{ +} + +static struct xtables_match socket_reg = { + .name ="socket" , + .version =IPTABLES_VERSION , + .family =AF_INET , + .size =XT_ALIGN (0 ), + .userspacesize =XT_ALIGN (0 ), + .parse = socket_parse, + .final_check = socket_check, + .help = socket_help, +}; + +void _init (void ) +{ +xtables_register_match (&socket_reg); +}
include/linux/netfilter/xt_TPROXY.h new file +16 -0
@@ -0,0 +1,16 @@ +#ifndef _XT_TPROXY_H +#define _XT_TPROXY_H + +/* +* TPROXY target is capable of marking the packet to perform +* redirection. We can get rid of that whenever we get support for +* mutliple targets in the same rule. +*/ +struct xt_tproxy_info { +u_int32_t mark_mask; +u_int32_t mark_value; +__be32 laddr; +__be16 lport; +}; + +#endif /* _XT_TPROXY_H */