Re: [PATCH v2 nf-next] netfilter: Add native tproxy support for nf_tables

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Tue, Jul 10, 2018 at 01:19:21PM +0200, Máté Eckl wrote:
> On Tue, Jul 10, 2018 at 12:54:24PM +0200, Pablo Neira Ayuso wrote:
> [...]
> > > > Please, could you describe how you have tested the nft tproxy
> > > > datapath? Did you run any example configuration to make sure things
> > > > are working? If so, please slightly describe.
> > > > 
> > > > Thanks.
> > > 
> > > I used the tcprdr [2] as a proxy software at point X, netcat (OpenBSD version
> > > that can handle IPv6) as a server at point Z, and telnet as a clinet at point Y.
> > > See the topology at [1].
> > > 
> > > The config of X was the following:
> > > 	# ip rule add fwmark 1 lookup 100
> > > 	# ip route add local 0.0.0.0/0 dev lo table 100
> > > 	# ip -6 rule add fwmark 1 lookup 100
> > > 	# ip -6 route add local ::/0 dev lo table 100
> > > 	# nft -f testrules
> > > 
> > > 	# cat testrules
> > > 		table inet x {
> > > 			chain y {
> > > 				type filter hook prerouting priority -150; policy accept;
> > > 				meta l4proto tcp socket transparent 1 mark set 0x00000001 accept
> > > 				tcp dport http tproxy to :50080 mark set 0x00000001 accept
> > > 			}
> > > 		}
> > > 
> > > 	# ./tcprdr -4 -t -T 50080 192.0.2.130 80
> > > and for ipv6
> > > 	# ./tcprdr -6 -t -T 50080 2001:db8:0:1::2 80
> > > 
> > > Commands on Z:
> > > 	# nc -l -p 80
> > > and for ipv6
> > > 	# nc -6 -l -p 80
> > > Z also had routes to Y via X.
> > > 
> > > Commands on Y:
> > > 	# telnet 192.0.2.3 80
> > > 	# telnet 2001:db8:0:0::3 80
> > > 
> > > I also tried how it works when tproxy target address is specified (tcprdr -L can
> > > be used for it) and protocol-specific cases too.
> > > 
> > > Proof at point X:
> > > 	# ss -tpn
> > > State           Recv-Q             Send-Q                          Local Address:Port                               Peer Address:Port
> > > ESTAB           0                  0                                   192.0.2.3:22                                    192.0.2.1:45006             users:(("sshd",pid=452,fd=3))
> > > ESTAB           0                  0                               [2001:db8::3]:80                                [2001:db8::1]:51900             users:(("tcprdr",pid=534,fd=4))
> > > ESTAB           0                  0                               [2001:db8::1]:51900                         [2001:db8:0:1::2]:80                users:(("tcprdr",pid=534,fd=5))
> > > 
> > > 
> > > 
> > > Regarding the code, I added some checks to during the debugging which could
> > > occur with a non-nft frontend, but now they are checked.
> > > 
> > > [1]:
> > > 		IPv4:
> > > 		         +---+ .129          .130 +---+
> > > 		 (proxy) | X |--------------------| Z | (server)
> > > 		         +---+   192.0.2.128/25   +---+
> > > 		           | .3
> > > 		           |
> > > 		           | 192.0.2.0/25
> > > 		           |
> > > 		           | .1
> > > 		         +---+
> > > 		         | Y | (client)
> > > 		         +---+
> > > 
> > > 		IPv6:
> > > 		         +---+ :1              :2 +---+
> > > 		 (proxy) | X |--------------------| Z | (server)
> > > 		         +---+  2001:db8:0:1::/64 +---+
> > > 		           | :3
> > > 		           |
> > > 		           | 2001:db8:0:0::/64
> > > 		           |
> > > 		           | :1
> > > 		         +---+
> > > 		         | Y | (client)
> > > 		         +---+
> > > 
> > > 		X and Z are VirtualBox VMs
> > > 
> > > [2]: https://git.breakpoint.cc/cgit/fw/tcprdr.git/
> > 
> > Thanks for explaining.
> > 
> > Good to know about this example BTW.
> > 
> > Probably we can add this TPROXY demo somewhere in the netfilter tree,
> > this is something that has been always missing.
> 
> I planned to add this to Documentation/networking/tproxy.txt. Should I do it in
> this commit?

Not sure.

Placing code into .txt file is strange to me, probably somewhere where
this can be handled as source code that can be easily compiled.
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Netfitler Users]     [LARTC]     [Bugtraq]     [Yosemite Forum]

  Powered by Linux