lkml.org 
[lkml]   [1997]   [Jun]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectTransparent proxy stops working in 2.0.30
Date
I have a 2.0.30 and 2.0.29 kernel with the .config and ipfwadm rules
listed below.

In 2.0.29, transparent proxy works. In 2.0.30, the transparent proxy
address translation for the host address occurs, but the port address
doesn't. Instead of redirecting TCP connections to the proxy server's
port, they are redirected to the original destination port on the proxy
machine.

Example:

123.45.67.89 and 234.56.78.90 are separated by host 192.0.2.1.
192.0.2.1 has an ipfwadm (version 2.3.0) rule that redirects forwarded
traffic to local port 100.

Correct behavior, 2.0.29: a connection from 123.45.67.89:123 to
234.56.78.90:234 is accepted by the transparent proxy server on
192.0.2.1:100 (which assumes the identity 234.56.78.89:234 after
accept()). In kernel version 2.0.30, it is redirected to 192.0.2.1:234.
If there is actually a server on the proxy machine on port 234, then
the client will be connected to that server and the connection otherwise
behaves like a transparent proxy connection (with the funny addresses on
192.0.2.1's end of the socket); otherwise it will get "Connection refused".
The real transparent proxy server on port 100 sees nothing.

.config follows:

#
# Automatically generated make config: don't edit
#

#
# Code maturity level options
#
CONFIG_EXPERIMENTAL=y

#
# Loadable module support
#
CONFIG_MODULES=y
CONFIG_MODVERSIONS=y
CONFIG_KERNELD=y

#
# General setup
#
# CONFIG_MATH_EMULATION is not set
CONFIG_NET=y
# CONFIG_MAX_16M is not set
CONFIG_PCI=y
CONFIG_PCI_OPTIMIZE=y
CONFIG_SYSVIPC=y
CONFIG_BINFMT_AOUT=y
CONFIG_BINFMT_ELF=y
# CONFIG_BINFMT_JAVA is not set
CONFIG_KERNEL_ELF=y
CONFIG_M586=y

#
# Floppy, IDE, and other block devices
#
CONFIG_BLK_DEV_FD=y
CONFIG_BLK_DEV_IDE=y

#
# Please see Documentation/ide.txt for help/info on IDE drives
#
# CONFIG_BLK_DEV_HD_IDE is not set
CONFIG_BLK_DEV_IDECD=y
# CONFIG_BLK_DEV_IDETAPE is not set
# CONFIG_BLK_DEV_IDE_PCMCIA is not set
# CONFIG_BLK_DEV_CMD640 is not set
# CONFIG_BLK_DEV_RZ1000 is not set
CONFIG_BLK_DEV_TRITON=y
# CONFIG_IDE_CHIPSETS is not set

#
# Additional Block Devices
#
CONFIG_BLK_DEV_LOOP=y
CONFIG_BLK_DEV_MD=y
CONFIG_MD_LINEAR=y
CONFIG_MD_STRIPED=y
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_BLK_DEV_XD=y
# CONFIG_BLK_DEV_HD is not set

#
# Networking options
#
CONFIG_FIREWALL=y
# CONFIG_NET_ALIAS is not set
CONFIG_INET=y
CONFIG_IP_FORWARD=y
# CONFIG_IP_MULTICAST is not set
# CONFIG_SYN_COOKIES is not set
# CONFIG_RST_COOKIES is not set
CONFIG_IP_FIREWALL=y
CONFIG_IP_FIREWALL_VERBOSE=y
# CONFIG_IP_MASQUERADE is not set
CONFIG_IP_TRANSPARENT_PROXY=y
CONFIG_IP_ALWAYS_DEFRAG=y
CONFIG_IP_ACCT=y
# CONFIG_IP_ROUTER is not set
# CONFIG_NET_IPIP is not set

#
# (it is safe to leave these untouched)
#
# CONFIG_INET_PCTCP is not set
# CONFIG_INET_RARP is not set
# CONFIG_NO_PATH_MTU_DISCOVERY is not set
CONFIG_IP_NOSR=y
CONFIG_SKB_LARGE=y

#
#
#
# CONFIG_IPX is not set
# CONFIG_ATALK is not set
# CONFIG_AX25 is not set
# CONFIG_BRIDGE is not set
# CONFIG_NETLINK is not set

#
# SCSI support
#
CONFIG_SCSI=y

#
# SCSI support type (disk, tape, CD-ROM)
#
CONFIG_BLK_DEV_SD=y
CONFIG_CHR_DEV_ST=y
CONFIG_BLK_DEV_SR=y
CONFIG_CHR_DEV_SG=y

#
# Some SCSI devices (e.g. CD jukebox) support multiple LUNs
#
# CONFIG_SCSI_MULTI_LUN is not set
CONFIG_SCSI_CONSTANTS=y

#
# SCSI low-level drivers
#
# CONFIG_SCSI_7000FASST is not set
# CONFIG_SCSI_AHA152X is not set
# CONFIG_SCSI_AHA1542 is not set
# CONFIG_SCSI_AHA1740 is not set
# CONFIG_SCSI_AIC7XXX is not set
# CONFIG_SCSI_ADVANSYS is not set
# CONFIG_SCSI_IN2000 is not set
# CONFIG_SCSI_AM53C974 is not set
# CONFIG_SCSI_BUSLOGIC is not set
# CONFIG_SCSI_DTC3280 is not set
# CONFIG_SCSI_EATA_DMA is not set
# CONFIG_SCSI_EATA_PIO is not set
# CONFIG_SCSI_EATA is not set
# CONFIG_SCSI_FUTURE_DOMAIN is not set
# CONFIG_SCSI_GENERIC_NCR5380 is not set
# CONFIG_SCSI_NCR53C406A is not set
# CONFIG_SCSI_NCR53C7xx is not set
CONFIG_SCSI_NCR53C8XX=y
CONFIG_SCSI_NCR53C8XX_TAGGED_QUEUE=y
# CONFIG_SCSI_NCR53C8XX_IOMAPPED is not set
# CONFIG_SCSI_NCR53C8XX_NO_DISCONNECT is not set
# CONFIG_SCSI_NCR53C8XX_FORCE_ASYNCHRONOUS is not set
# CONFIG_SCSI_NCR53C8XX_FORCE_SYNC_NEGO is not set
# CONFIG_SCSI_NCR53C8XX_DISABLE_MPARITY_CHECK is not set
# CONFIG_SCSI_NCR53C8XX_DISABLE_PARITY_CHECK is not set
# CONFIG_SCSI_PPA is not set
# CONFIG_SCSI_PAS16 is not set
# CONFIG_SCSI_QLOGIC_FAS is not set
# CONFIG_SCSI_QLOGIC_ISP is not set
# CONFIG_SCSI_SEAGATE is not set
# CONFIG_SCSI_T128 is not set
# CONFIG_SCSI_U14_34F is not set
# CONFIG_SCSI_ULTRASTOR is not set

#
# Network device support
#
CONFIG_NETDEVICES=y
CONFIG_DUMMY=y
# CONFIG_EQUALIZER is not set
# CONFIG_DLCI is not set
# CONFIG_PLIP is not set
CONFIG_PPP=y

#
# CCP compressors for PPP are only built as modules.
#
# CONFIG_SLIP is not set
# CONFIG_NET_RADIO is not set
CONFIG_NET_ETHERNET=y
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_LANCE is not set
CONFIG_NET_VENDOR_SMC=y
CONFIG_WD80x3=y
CONFIG_ULTRA=y
# CONFIG_SMC9194 is not set
# CONFIG_NET_ISA is not set
# CONFIG_NET_EISA is not set
# CONFIG_NET_POCKET is not set
# CONFIG_TR is not set
# CONFIG_FDDI is not set
# CONFIG_ARCNET is not set

#
# ISDN subsystem
#
# CONFIG_ISDN is not set

#
# CD-ROM drivers (not for SCSI or IDE/ATAPI drives)
#
# CONFIG_CD_NO_IDESCSI is not set

#
# Filesystems
#
CONFIG_QUOTA=y
CONFIG_LOCK_MANDATORY=y
# CONFIG_MINIX_FS is not set
# CONFIG_EXT_FS is not set
CONFIG_EXT2_FS=y
# CONFIG_XIA_FS is not set
CONFIG_FAT_FS=y
CONFIG_MSDOS_FS=y
CONFIG_VFAT_FS=y
CONFIG_UMSDOS_FS=y
CONFIG_PROC_FS=y
# CONFIG_NFS_FS is not set
# CONFIG_SMB_FS is not set
CONFIG_ISO9660_FS=y
# CONFIG_HPFS_FS is not set
# CONFIG_SYSV_FS is not set
# CONFIG_AFFS_FS is not set
# CONFIG_UFS_FS is not set

#
# Character devices
#
CONFIG_SERIAL=y
# CONFIG_DIGI is not set
# CONFIG_CYCLADES is not set
# CONFIG_STALDRV is not set
# CONFIG_RISCOM8 is not set
CONFIG_PRINTER=y
# CONFIG_MOUSE is not set
# CONFIG_UMISC is not set
# CONFIG_QIC02_TAPE is not set
# CONFIG_FTAPE is not set
# CONFIG_APM is not set
CONFIG_WATCHDOG=y
CONFIG_WATCHDOG_NOWAYOUT=y
# CONFIG_WDT is not set
CONFIG_SOFT_WATCHDOG=y
# CONFIG_PCWATCHDOG is not set
CONFIG_RTC=y

#
# Sound
#
CONFIG_SOUND=y
# CONFIG_PAS is not set
# CONFIG_SB is not set
# CONFIG_ADLIB is not set
CONFIG_GUS=y
# CONFIG_MPU401 is not set
# CONFIG_UART6850 is not set
# CONFIG_PSS is not set
# CONFIG_GUS16 is not set
CONFIG_GUSMAX=y
# CONFIG_MSS is not set
# CONFIG_SSCAPE is not set
# CONFIG_TRIX is not set
# CONFIG_MAD16 is not set
# CONFIG_CS4232 is not set
# CONFIG_MAUI is not set
CONFIG_AUDIO=y
CONFIG_MIDI=y
CONFIG_YM3812=y
GUS_BASE=220
GUS_IRQ=11
GUS_DMA=6
GUS_DMA2=7
DSP_BUFFSIZE=65536
# CONFIG_LOWLEVEL_SOUND is not set

#
# Kernel hacking
#
# CONFIG_PROFILE is not set

ipfwadm rules:

IP firewall input rules, default policy: deny
pkts bytes type prot opt tosa tosx ifname ifaddress source destination ports
0 0 rej tcp ---- 0xFF 0x00 * 127.0.0.1 0.0.0.0/0 0.0.0.0/0 * -> 100
0 0 rej udp ---- 0xFF 0x00 * 127.0.0.1 0.0.0.0/0 0.0.0.0/0 * -> 100
1101 937K acc all ---- 0xFF 0x00 * 127.0.0.1 127.0.0.1 127.0.0.1 n/a
0 0 acc all ---- 0xFF 0x00 * 127.0.0.1 10.0.0.11 10.0.0.11 n/a
66 5016 acc all ---- 0xFF 0x00 * 127.0.0.1 10.0.0.11 10.255.255.255 n/a
0 0 acc all ---- 0xFF 0x00 * 127.0.0.1 10.0.0.11 127.255.255.255 n/a
0 0 deny all b--o 0xFF 0x00 * 0.0.0.0 127.0.0.0/8 0.0.0.0/0 n/a
0 0 deny all ---o 0xFF 0x00 * 127.0.0.1 0.0.0.0/0 0.0.0.0/0 n/a
70 5320 acc all ---- 0xFF 0x00 eth0 0.0.0.0 10.0.0.0/8 10.0.0.0/8 n/a
0 0 acc/r tcp ---- 0xFF 0x00 eth0 0.0.0.0 10.0.0.0/8 0.0.0.0/0 768:65535 -> * => 100
0 0 acc/r udp ---- 0xFF 0x00 eth0 0.0.0.0 10.0.0.0/8 0.0.0.0/0 768:65535 -> * => 100
0 0 deny all ---o 0xFF 0x00 eth0 0.0.0.0 0.0.0.0/0 0.0.0.0/0 n/a
3160 4300K acc tcp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 * -> 22
5 213 acc tcp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 * -> 113
0 0 deny tcp --yo 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 0.0.0.0/0 * -> *
4 1374 acc udp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 53 -> 53
114 8664 acc udp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 123 -> 123
0 0 deny udp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 * -> 514
2228 1654K acc tcp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 * -> 768:65535
4 304 acc udp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 * -> 768:65535
210 17640 acc icmp ---- 0xFF 0x00 ppp0 0.0.0.0 0.0.0.0/0 206.47.216.37 *
0 0 deny all ---o 0xFF 0x00 * 0.0.0.0 0.0.0.0/0 0.0.0.0/0 n/a
--
Microsoft Magic Line, The: n; the curve on a price-performance chart defined by
the set of current shipping MS products. New MS products shift the MML upward.
Competitive products that fall below the MML become unmarketable and disappear.
Hence, Microsoft is always the worst marketable solution for any real problem.

\
 
 \ /
  Last update: 2005-03-22 13:39    [W:0.042 / U:0.032 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site