Home » Mailing list archives » linux-netdev » 2007 » October » 13

[PATCH 00/14] Transparent Proxying Patches, Take 5

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: KOVACS Krisztian <hidden@...>
To: David Miller <davem@...>
Cc: Patrick McHardy <kaber@...>, <netdev@...>
Subject: [PATCH 00/14] Transparent Proxying Patches, Take 5
Date: Saturday, October 13, 2007 - 1:28 pm

Hi Dave,

This is the fifth round of transparent proxying patches following
recent discussion on netfilter-devel [1,2].

The aim of the patchset is to make non-locally bound sockets work both
for receiving and sending. The target is IPv4 TCP/UDP at the moment.

Speaking of the patches, there are two big parts:

 * Output path (patches 1-6): these modifications make it possible to
   send IPv4 datagrams with non-local source IP address by:

   - Introducing a new flowi flag (FLOWI_FLAG_ANYSRC) which disables
     source address checking in ip_route_output_slow(). This is
     also necessary for some of the tricks LVS does. [3]

   - Adding the IP_TRANSPARENT socket option (setting this requires
     CAP_NET_ADMIN to prevent source address spoofing).

   - Gluing these together across the TCP/UDP code.

 * Input path (patches 7-13): these changes add redirection support
   for TCP along with an iptables target implementing NAT-less traffic
   interception, and an iptables match to make ahead-of-time socket
   lookups on PREROUTING. These combined with a set of iptables rules
   and policy routing make non-locally bound sockets work.

   - Netfilter IPv4 defragmentation is split into a separate
     module. It's not particularly pretty but I see no other way of
     making sure the 'socket' match gets no fragmented IPv4 packets.

   - The 'socket' iptables match does a socket lookup on the
     destination address and matches if a socket was found.

   - The 'TPROXY' iptables target provides a way to intercept traffic
     without NAT -- it does an ahead-of-time socket lookup on the
     configured address and caches the socket reference in the skb.

   - IPv4 TCP and UDP input path is modified to use this stored socket
     reference if it's present.

The last patch adds a short intro on how to use it. A trivial patch
for netcat demonstrating the necessary modifications for proxies is
available separately at [4].


References:
[1] http://marc.info/?l=netfilter-devel&m=119118672703285&w=2
[2] http://marc.info/?l=netfilter-devel&m=119135774918622&w=2
[3] http://marc.info/?l=linux-netdev&m=118065358510836&w=2
[4] http://people.netfilter.org/hidden/tproxy/netcat-ip_transparent-support.patch

-- 
KOVACS Krisztian
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH 00/14] Transparent Proxying Patches, Take 5, KOVACS Krisztian, (Sat Oct 13, 1:28 pm)
Re: [PATCH 00/14] Transparent Proxying Patches, Take 5, David Miller, (Sat Oct 13, 6:44 pm)
Re: [PATCH 00/14] Transparent Proxying Patches, Take 5, KOVACS Krisztian, (Sun Oct 14, 5:05 am)
[PATCH 08/14] Split Netfilter IPv4 defragmentation into a se..., KOVACS Krisztian, (Sat Oct 13, 1:33 pm)
[PATCH 07/14] Export UDP socket lookup function, KOVACS Krisztian, (Sat Oct 13, 1:32 pm)
[PATCH 09/14] iptables tproxy core, KOVACS Krisztian, (Sat Oct 13, 1:33 pm)
[PATCH 06/14] Port redirection support for TCP, KOVACS Krisztian, (Sat Oct 13, 1:32 pm)
[PATCH 04/14] Conditionally enable transparent flow flag whe..., KOVACS Krisztian, (Sat Oct 13, 1:31 pm)
[PATCH 05/14] Handle TCP SYN+ACK/ACK/RST transparency, KOVACS Krisztian, (Sat Oct 13, 1:31 pm)
[PATCH 03/14] Allow binding to non-local addresses if IP_TRA..., KOVACS Krisztian, (Sat Oct 13, 1:30 pm)
[PATCH 02/14] Implement IP_TRANSPARENT socket option, KOVACS Krisztian, (Sat Oct 13, 1:29 pm)
[PATCH 01/14] Loosen source address check on IPv4 output, KOVACS Krisztian, (Sat Oct 13, 1:29 pm)
[PATCH 14/14] Add documentation, KOVACS Krisztian, (Sat Oct 13, 1:36 pm)
[PATCH 13/14] Don't lookup the socket if there's a socket at..., KOVACS Krisztian, (Sat Oct 13, 1:35 pm)
[PATCH 12/14] Don't lookup the socket if there's a socket at..., KOVACS Krisztian, (Sat Oct 13, 1:35 pm)
[PATCH 11/14] iptables TPROXY target, KOVACS Krisztian, (Sat Oct 13, 1:34 pm)
[PATCH 10/14] iptables socket match, KOVACS Krisztian, (Sat Oct 13, 1:34 pm)