How to get access to NAT info from userland

How to get access to NAT info from userland

[Brian G]

I have a socket, IPv4. It is being transparent proxied to userland via a 
REDIRECT NAT target.

Is there any getsocketopt() or any syscall so I can get the REAL 
destination address off this socket from userland?

If not, I still need to know the TRUE DESTINATION when using a 
transparent proxy so I know where to send to request. What needs to 
added to the kernel (e.g. like an iptables TARGET) to get this info.

  - Brian G

Re: How to get access to NAT info from userland

[Brian G]

On 4/2/2011 6:55 PM, Sam Roberts wrote:
> On Sat, Apr 2, 2011 at 1:23 AM, Brian G<unixman83@gmail.com>  wrote:
>> If not, I still need to know the TRUE DESTINATION when using a transparent
>> proxy so I know where to send to request. What needs to added to the kernel
>> (e.g. like an iptables TARGET) to get this info.
> Does the conntrack -L output have the info you'd like?
Probably. Too bad my distro (CentOS) doesn't seem to provide this binary.
> Sam
Brian

Re: How to get access to NAT info from userland

[Jan Engelhardt]

On Sunday 2011-04-03 02:07, Brian G wrote:

> On 4/2/2011 6:55 PM, Sam Roberts wrote:
>> On Sat, Apr 2, 2011 at 1:23 AM, Brian G<unixman83@gmail.com>  wrote:
>>> If not, I still need to know the TRUE DESTINATION when using a transparent
>>> proxy so I know where to send to request. What needs to added to the kernel
>>> (e.g. like an iptables TARGET) to get this info.
>> Does the conntrack -L output have the info you'd like?
> Probably. Too bad my distro (CentOS) doesn't seem to provide this binary.
Ye, enterprise distributions have a bad track record for shipping the 
complete NF suite. Avoid :/

Re: How to get access to NAT info from userland

[Brian G]

On 4/14/2011 2:03 AM, Jan Engelhardt wrote:
> On Sunday 2011-04-03 02:07, Brian G wrote:
>> On 4/2/2011 6:55 PM, Sam Roberts wrote:
>>> On Sat, Apr 2, 2011 at 1:23 AM, Brian G<unixman83@gmail.com>   wrote:
>>> Does the conntrack -L output have the info you'd like?
>> Probably. Too bad my distro (CentOS) doesn't seem to provide this binary.
> Ye, enterprise distributions have a bad track record for shipping the
> complete NF suite. Avoid :/

TPROXY will work, it should become commonplace by the time IPv6 gets 
going strong. Someone on stackoverflow answered my question, although he 
called tproxy a 'hack'. It will work fine so long as it doesn't hinder 
performance.

Brian G.

Re: How to get access to NAT info from userland

[Jan Engelhardt]

On Thursday 2011-04-14 09:12, Brian G wrote:

> On 4/14/2011 2:03 AM, Jan Engelhardt wrote:
>> On Sunday 2011-04-03 02:07, Brian G wrote:
>>> On 4/2/2011 6:55 PM, Sam Roberts wrote:
>>>> On Sat, Apr 2, 2011 at 1:23 AM, Brian G<unixman83@gmail.com>   wrote:
>>>> Does the conntrack -L output have the info you'd like?
>>> Probably. Too bad my distro (CentOS) doesn't seem to provide this binary.
>> Ye, enterprise distributions have a bad track record for shipping the
>> complete NF suite. Avoid :/
>
> TPROXY will work, it should become commonplace by the time IPv6 gets going
> strong. Someone on stackoverflow answered my question, although he called
> tproxy a 'hack'. It will work fine so long as it doesn't hinder performance.

Hey, if TPROXY is a hack, so is the entire NAT business in itself! :)