RE: transparent tcp proxy

RE: transparent tcp proxy

[George Vieira]

Hmm. I don't think bridging copies the packets MAC address over. it just copies the packet data with it's source and destination IPs.

Can I ask what the mac address is used for, or needed for? Is it for some authenticity reasons?

-----Original Message-----
From: Michael Stilmant [mailto:ml-netfilter@adtech.be]
Sent: Saturday, May 24, 2003 1:07 AM
To: netfilter@lists.netfilter.org
Subject: transparent tcp proxy


Hello,

First of all, an hello from a new user on this mailing list.

and finally my actual problem.

I'm need to make a transparent proxy for an billing application. To to
that I need to put myself in the middle point of a protocol exchange not
thinked to be easy done with a proxy.

So to do that I've done this installation:

I've have a computer where I place transparent proxy via ebtables this
is B. (no special rules : just ones to activate a transparent proxy:
                brctl addbr mybridge
                brctl addif mybridge eth0
                brctl addif mybridge eth1
                ifconfig eth0 0.0.0.0
                ifconfig eth1 0.0.0.0
                ifconfig mybridge up
                ifconfig mybridge 10.0.0.225
                route add default gw 10.0.0.254 )

A and C communicate with all normal exchange

                     10.0.0.225
                     +--------+
                     |   B    |
   +-----+           |        |          +-----+
   |  A  +-----------[ebtables]----------|  C  |
   +-----+           +--------+          +-----+
   10.0.0.3                             10.0.0.32         

I've place this Iptables rules

iptables -t nat -A PREROUTING -i eth1 -d 10.0.0.3 -p tcp --dport 3435 -j
DNAT --to-destination 10.0.0.225:3625

iptables -t nat -A POSTROUTING -o eth0 -d 10.0.0.3 -p tcp --dport 3435
-j SNAT --to-source 10.0.0.32

so with that when C want to connect the A:3435 service all traffic is
oriented to B and when B send traffic to A: A see C ip address. -> full
transparent.

But there are a big problem:

Address Mac used from B to A is not the MAC address. Not a problem since
i don't want really be transparent but other traffic form C go to A
directly with the good MAC and traffic from B to A have an other MAC. so
switch or other router in the A side see 10.0.0.32 sometime with C Mac
and other time with B MAC .. gloupspss ?? .. :-D

I need to find a way to read mac address from a connection from C and
set this MAC when I start a connection to A from B 

have you some clues ? (allready send the same question on the ebtables
ailin list .. perhaps with a function from there there are a solution
... )

thanks


Michael Stilmant

RE: transparent tcp proxy

[Michael Stilmant]

On Sat, 2003-05-24 at 04:05, George Vieira wrote:
> Hmm. I don't think bridging copies the packets MAC address over. it just copies the packet data with it's source and destination IPs.
> 
> Can I ask what the mac address is used for, or needed for? Is it for some authenticity reasons?

No, I don't need ti used the MAC Address. And actually my 
iptables filter work pretty well. But, with this, 
the MAC address of the source host change for each connection


                     10.0.0.225
                     +--------+
                     |   B    |
   +-----+           |        |          +-----+
   |  A  +-----------[ebtables]----------|  C  |
   +-----+           +--------+          +-----+
   10.0.0.3                             10.0.0.32     


Rappel:
when C send not filtered packet to A, A see the C MAC address with IP
10.0.0.32. when B send filtered TCP/IP packet to A with IP address 
10.0.0.32 A see the B MAC address. This work but it's not acceptable.
the A MAC-IP association table will change setup all the time. 


Michael

RE: transparent tcp proxy

[Joel Newkirk]

On Mon, 2003-05-26 at 04:45, Michael Stilmant wrote:
> On Sat, 2003-05-24 at 04:05, George Vieira wrote:
> > Hmm. I don't think bridging copies the packets MAC address over. it just copies the packet data with it's source and destination IPs.
> > 
> > Can I ask what the mac address is used for, or needed for? Is it for some authenticity reasons?
> 
> No, I don't need ti used the MAC Address. And actually my 
> iptables filter work pretty well. But, with this, 
> the MAC address of the source host change for each connection
> 
> 
>                      10.0.0.225
>                      +--------+
>                      |   B    |
>    +-----+           |        |          +-----+
>    |  A  +-----------[ebtables]----------|  C  |
>    +-----+           +--------+          +-----+
>    10.0.0.3                             10.0.0.32     
> 
> 
> Rappel:
> when C send not filtered packet to A, A see the C MAC address with IP
> 10.0.0.32. when B send filtered TCP/IP packet to A with IP address 
> 10.0.0.32 A see the B MAC address. This work but it's not acceptable.
> the A MAC-IP association table will change setup all the time. 
> 
> 
> Michael
> 

You'd need to handle this outside of iptables/ebtables, but it could be 
done.  If the MAC of C would be static (IE only one machine there) then 
this is pretty trivial.

If there are potentially several machines represented by 'C' then you'd 
have to have a script or program that periodically checks the MAC on  
traffic coming from C.  If you log a packet from C to A and examine the 
log entry, it includes the MAC for C...

May 27 02:09:20 janus kernel: IPT:Unhandled input from LAN:IN=eth1 OUT= 
MAC=00:02:e3:11:c2:47:00:10:7a:4e:10:3b:08:00 SRC=192.168.0.17 
DST=192.168.1.1 LEN=28 TOS=0x00 PREC=0x00 TTL=64 ID=0 DF PROTO=ICMP TYPE=8 
CODE=0 ID=9744 SEQ=0

In the above log entry the "00:02:e3:11:c2:47" is the MAC of the local
ethernet interface on the machine that logged this, my home gateway/
firewall.  "00:10:7a:4e:10:3b" is the MAC of the wireless compactflash 
card in my Zaurus.  The packet traversed a Netgear wireless AP/Router
between the two points.

You could construct a script to be run periodically by cron that would
insert a LOG rule with a distinct --log-prefix, then monitor the rule
listing (iptables -v -n -L FORWARD | grep SRC=a.b.c.d | grep "prefix")
and waits for the packet count to rise above 0, then deletes the log
rule and greps the log entry itself and extracts the MAC from it.

The problem I foresee you having is that you will need to bring the
interface down (IIRC) to change the MAC... Bridge and all...

j

RE: transparent tcp proxy

[Michael Stilmant]

On Tue, 2003-05-27 at 08:24, Joel Newkirk wrote:
> You'd need to handle this outside of iptables/ebtables, but it could be 
> done.  

Thanks to answer. but I don't understand well how to do this, but I'll
check your idea. 

And this is in fact this is how I really do the stuff.

                     10.0.0.225
                     +--------+
                     |   B    |
   +-----+           |        |          +-----+
   |  A  +-----------[ebtables]----------|  C  |
   +-----+           +--------+          +-----+
   10.0.0.3                             10.0.0.32         


I've made a C program able to update the kernel iptables. This program
read a config file where they are the remote port and the remote IP
address to listen for (address of A; A is the server for B machine to
connect on port 3435)

So when the program start, it update iptables like if you have done this
rule :

iptables -t nat -A PREROUTING -i eth1 -d 10.0.0.3 -p tcp --dport 3435 -j
DNAT --to-destination 10.0.0.225:3625

And after that the program start a tcp server on B machine to listen
routed traffic from B.

When a connection came from C to the special port on A, traffic is
routed locally to the listening TCP server. this server known now the
source IP and update iptables with this rules.

iptables -t nat -A POSTROUTING -o eth0 -d 10.0.0.3 -p tcp --dport 3435
-j SNAT --to-source 10.0.0.32

since the ip source is well known now.

after that the program open a tcp connection to A:3435.

Now I can use the B tcp server to listen and interact with the traffic
between A and C.

Now I've a connection from C to B where I can find the value of the
source IP address. I need to find a way to know also the MAC address,
perhaps with an IOCTL on the socket. and using this MIAC address to
update something somewhere to tell to the network layer wich MAC address
to use but only with the connection from B to A. and this will be great
if I can say this only for one TCP connection from B to A. Because I
want to try to be possible to put many C like machine on the right.

Best regards

Michael

RE: transparent tcp proxy

[Cedric Blancher]

Le lun 26/05/2003 à 10:45, Michael Stilmant a écrit :
> Rappel:
> when C send not filtered packet to A, A see the C MAC address with IP
> 10.0.0.32. when B send filtered TCP/IP packet to A with IP address 
> 10.0.0.32 A see the B MAC address. This work but it's not acceptable.
> the A MAC-IP association table will change setup all the time. 

What about a layer 2 SNAT on OUTPUT chain from B to A for filtered
packets ?
ebtables can achieve this.

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

RE: transparent tcp proxy

[Michael Stilmant]

On Tue, 2003-05-27 at 10:34, Cedric Blancher wrote:
> What about a layer 2 SNAT on OUTPUT chain from B to A for filtered
> packets ?
> ebtables can achieve this.

Well, I'll look in this solution. Thanks ...  so you say it's possible
to make a filter in ebtables where I can say for all frame for ip:A port
X from port Y replace MAC with the #C value ?

Michael

RE: transparent tcp proxy

[Cedric Blancher]

Le mar 27/05/2003 à 11:49, Michael Stilmant a écrit :
> On Tue, 2003-05-27 at 10:34, Cedric Blancher wrote:
> > What about a layer 2 SNAT on OUTPUT chain from B to A for filtered
> > packets ?
> > ebtables can achieve this.
> Well, I'll look in this solution. Thanks ...  so you say it's possible
> to make a filter in ebtables where I can say for all frame for ip:A port
> X from port Y replace MAC with the #C value ?

Not directly, because ebtables cannot match TCP fields. But it must be
possible using fwmark propagation.

	iptables -t mangle -A OUTPUT -p tcp --sport Y -d A --dport X \
		-j MARK --set-mark 0x01

Then, you SNAT in POSTROUTING using ebtables marked packets :

	ebtables -t nat -A POSTROUTING -m mark_m --mark 0x01 \
		-j snat --to-source C_MAC

I must admit I did not tried this, but I do think it should work, as
long as output interface is a bridge (if not, packet won't go through
ebtables framework). You didn't get any other answer for this on
ebtables-user list ?


I Cc ebtables-user, so one can confirm what I said below ;)

-- 
Cédric Blancher  <blancher=cPThYx3uDionEikN29/hQkZa+K1vlBrA@public.gmane.org>
IT systems and networks security - Cartel Sécurité
Phone : +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE


-------------------------------------------------------
This SF.net email is sponsored by: ObjectStore.
If flattening out C++ or Java code to make your application fit in a
relational database is painful, don't do it! Check out ObjectStore.
Now part of Progress Software. http://www.objectstore.net/sourceforge

RE: transparent tcp proxy

[Michael Stilmant]

On Tue, 2003-05-27 at 12:49, Cedric Blancher wrote:

> [...] possible using fwmark propagation.
> 
>       iptables -t mangle -A OUTPUT -p tcp --sport Y -d A --dport X \
>               -j MARK --set-mark 0x01
> 
> Then, you SNAT in POSTROUTING using ebtables marked packets :
> 
>       ebtables -t nat -A POSTROUTING -m mark_m --mark 0x01 \
>               -j snat --to-source C_MAC
> 

wow this sound not pretty bad .. thanks I'll test this in some times
(need to finish one work before, so I'll tell you if this work) but if
other have others solutions (in case)

Merci ;-)


> You didn't get any other answer for this on
> ebtables-user list ?

no except your other one :-) (which tell me to read features page, :-D )
but I was testing if there are some potentials solution only with
iptables ... and one another solution is perhaps (perhaps !) to have
some IOCTL command on socket to force by this channel to use a specific
MAC address .. 


Best regards

Michael

RE: transparent tcp proxy

[Cedric Blancher]

Le mar 27/05/2003 à 13:48, Michael Stilmant a écrit :
> wow this sound not pretty bad .. thanks I'll test this in some times
> (need to finish one work before, so I'll tell you if this work) but if
> other have others solutions (in case)

OK.
Other solution would be transparent routing, operating DNAT at bridge
level on interesting packets, but as you seem to need some TCP layer
informations, ebtables won't provide you valuable help on this.

> no except your other one :-) (which tell me to read features page, :-D )

;)

-- 
Cédric Blancher  <blancher@cartel-securite.fr>
Consultant en sécurité des systèmes et réseaux - Cartel Sécurité
Tél: +33 (0)1 44 06 97 87 - Fax: +33 (0)1 44 06 97 99
PGP KeyID:157E98EE  FingerPrint:FA62226DA9E72FA8AECAA240008B480E157E98EE

About Mexico

[Leandro]

Hi everybody!!!!

I know that my doubt isn´t about iptables, but I need this information as
soon as possible.
What is the organization, in Mexico, responsible for registering new
domains?
I´ve found www.nic.mx, is that correct?

[]´s

Chuck