2008年4月29日 星期二

transparent proxy for squid in bridge configuration

Squid Config Example
Fully Transparent With TPROXY

Linux: Setup a transparent proxy with Squid in three easy steps

Squid Cache, TProxy, dan Mikrotik (Alternate Configuration for Simple Networks)

Configuring a Transparent Proxy/Webcache in a Bridge using Squid and ebtables

Squid 2.6 + tproxy + bridge + gentoo

To configure a bridge interface

ifconfig eth0 0.0.0.0 promisc up
ifconfig eth1 0.0.0.0 promisc up

brctl addbr br0
brctl addif br0 eth0
brctl addif br0 eth1

ifconfig br0 200.1.2.3 netmask 255.255.255.0 up
route add default gw 200.1.2.254 dev br0


To intercept the concerned connections:

bash# ebtables -t broute -A BROUTING -p IPv4 --ip-protocol 6 \
--ip-destination-port 80 -j redirect --redirect-target ACCEPT

bash# iptables -t nat -A PREROUTING -i br0 -p tcp --dport 80 \
-j REDIRECT --to-port 3128

The first command says that packets passing through the bridge going to port 80 will be redirected to the local machine, instead of being bridged. The second uses iptables to redirect those packets to local port 3128, so squid can take care of them.

2008年4月2日 星期三

iptables TPROXY target

2007-09-30 20:51:41 GMT, KOVACS Krisztian posted a series of patchs for TPROXY: [PATCH 00/13] Transparent Proxying Patches, Take 3

2007-10-02 20:37:56 GMT, KOVACS Krisztian: Transparent proxy patches, take 4 - userspace
2007-10-02 20:39:42 GMT, KOVACS Krisztian: [PATCH 00/13] Transparent Proxying Patches, Take 4

2007-10-13 17:28:57 GMT, KOVACS Krisztian posted a series of patchs for TPROXY: [PATCH 00/14] Transparent Proxying Patches, Take 5

there is a lot of patches in http://people.netfilter.org/hidden/tproxy/

Squid (WWW Proxy Server)/TPROXY Rules

Transparent Proxy with Linux and Squid mini-HOWTO

LVS and transparent proxy

[stunnel-users] [stunnel patch] transparent proxy on linux 2.6 using cttproxy patch

fedora download


===========================================================================
RedHat EL5.0 上で kernel2.6(tproxy2.0.6パッチ付き)をビルドする方法(メモ)
Ver1.00 2007/08/31 吉岡
===========================================================================


1. Linux Kernelをkernel.orgから入手・展開
入手元: http://kernel.org/
(ここではlinux-2.6.20.18.tar.bz2を利用)
# cd /usr/src/
# wget http://kernel.org/pub/linux/kernel/v2.6/linux-2.6.20.18.tar.bz2
# tar -jxvf linux-2.6.20.18.tar.bz2

2. tproxyパッチを入手・適用
入手元: http://www.balabit.com/downloads/files/tproxy/obsolete/linux-2.6/cttproxy-2.6.20-2.0.6.tar.gz
# cd /usr/src
# wget http://www.balabit.com/downloads/files/tproxy/obsolete/linux-2.6/cttproxy-2.6.20-2.0.6.tar.gz
# tar -zxvf cttproxy-2.6.20-2.0.6.tar.gz
# mv linux-2.6.20.18 linux-2.6.20.18-tproxy
# cd linux-2.6.20.18-tproxy/
# cat ../linux-2.6.20.18-tproxy/patch_tree/* | patch -p1

3. Kernelを設定
# cd linux-2.6.20.18-tproxy/
# make menuconfig
以下のように設定変更
- General setup
- Local version: (-tproxy)
- Networking
- Networking options
- Network packet filtering framework (Netflter)
- Core Netfilter Configuration
(M) Netfilter connection tracking support
Netfilter connection tracking support
=> (X) "Layer 3 Dependent Connection tracking (OBSOLETE)"
- IP: Netfilter Configuration
(M) Full NAT (NEW)
(M) MASQUERADE target support
(M) REDIRECT target support
[*] NAT reservations support
(M) FTP protocol support
(M) Transparent proxying
(M) tproxy match support
(M) TPROXY target support
- Device Drivers
- Network device support
利用しているインターフェースのドライバを指定
([M]又は[*]で組み込み。)
  設定が終了したら[Exit]で終了し、設定を保存(Yes)。

4. Kernelのビルド
# make

5. Kernelのインストール
# make modules_install
# cp arch/i386/boot/bzImage /boot/vmlinuz-2.6.20.18-tproxy
# mkinitrd /boot/initrd-2.6.20.18-tproxy.img 2.6.20.18-tproxy
(上書きする場合、mkinitrdに"-f"を追加)

6. grub.confの書き換え
以下のように設定ファイルに変更します。
ファイル: /etc/grub.conf
追加内容:
===================================================
title Red Hat Enterprise Linux Server (2.6.20.18-tproxy)
root (hd0,0)
kernel /vmlinuz-2.6.20.18-tproxy ro root=/dev/VolGroup00/LogVol00 rhgb quiet
initrd /initrd-2.6.20.18-tproxy.img
===================================================

7. マシンをリブートし、ブート時にKernelとして2.6.20.18-tproxyを選択。

8. 以下のFAQに従ってtproxyを設定
■54028: 透過プロキシ型の場合にクライアントのソースIPアドレスを保持することはできますか?
(http://www.f-secure.co.jp/support/html/linux_gw_54028.html)

2008年3月26日 星期三

stunnel to establish a mutual-certificated SSL tunnel

stunnel could be used to establish SSL tunnel for non-SSL connection. The scenario looks like

AP1 <-> [stunnel client] <- SSL connection -> [stunnel server] <-> AP2

stunnel client accepts a TCP connection, establish a SSL connection to stunnel server, and exchanges data between TCP connection and SSL connection,

stunnel server accepts a SSL connection, establish a TCP connection to AP2, and exchanges data between SSL connection and TCP connection.

In general, the SSL connection could be used to protect MIB to observe/intercept/modify the data in it. And only server-side SSL certificate is verified. But it is possible to let SSL server to verify the client-side SSL certificate.

Here is the procedure:

1. create key/certificate for client.
# openssl genrsa 1024 > client-key.pem
# openssl req -new -key client-key.pem -x509 -days 3650 -out client-cert.pem

2. create key/certificate for server.
# openssl genrsa 1024 > client-key.pem
# openssl req -new -key client-key.pem -x509 -days 3650 -out client-cert.pem

3. create stunnel config file for client.
cert = client-cert.pem
key = client-key.pem
chroot = /usr/local/stunnel/
setuid = nobody
setgid = nobody
pid = /client.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
verify = 2
CApath = /client
client = yes

[ap1]
accept = 127.0.0.1:2399
connect = :2340
TIMEOUTclose = 0

4. create stunnel config file for server.
cert = server-cert.pem
key = server-key.pem
chroot = /usr/local/stunnel/
setuid = nobody
setgid = nobody
pid = /server.pid
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
verify = 2
CApath = /server

[ap2]
accept = :2340
connect = 127.0.0.1:2341
TIMEOUTclose = 0

5.
In host running ap1 and stunnel client, put client-key.pem/client-cert.pem in /usr/local/stunnel, and put server-cert.pem in /usr/local/stunnel/client. then run
# c_rehash /usr/local/stunnel/client

6.In host running ap2 and stunnel server, put server-key.pem/server-cert.pem in /usr/local/stunnel, and put client-cert.pem in /usr/local/stunnel/server. then run
# c_rehash /usr/local/stunnel/server

7. start the stunnel client/server.
In stunnel client host,
# stunnel /usr/local/stunnel/client.conf

In stunnel server host,
# stunnel /usr/local/stunnel/server.conf

2008年2月19日 星期二

open source supermarket

original


Launchpad is kinda hard to describe. When I’m asked what it is, I normally use three or more of the words “open source free software support project Q&A code registration bugs management listing bazaar planning hosting”. Most people make comparisons to Sourceforge, Savannah, Berlios and Google code hosting, and while those are useful, it’s only a part of the picture. The other part, which is perhaps not as well understood, is that it’s also a public project registration service, similar to Freshmeat. Well, except for a twist.

Launchpad’s source code directory

In addition to providing a project registration service open to the public for free (with probably the best Google juice out there; this has caught some people off-guard before!), Launchpad takes this to a next step, and actually provides a unified interface for interacting with each project registered. The most obvious unified service that you can use today is our code directory, which I want to introduce here.

Now Launchpad provides some key features related to source code for free software projects:

  • Project registration: you can register any free software project on Launchpad (and separately, of course, have it hosted here — if you own it and want to).
  • Bazaar hosting: you can host Bazaar branches for any project, and you can fetch code using the bzr client.
  • Code imports: we allow you to request code imports for any externally-hosted project that uses CVS or Subversion.

There’s a really cool thing that falls out of the combination of code imports, branch mirrors and Bazaar: you can use bzr and Launchpad to fetch any piece of software we have registered code for. And Bazaar even provides a little shortcut that makes it even easier to grab the default branch for any project: bzr branch lp:.

An open source supermarket

The effect is that you can, right now, pull a /lot/ of software in less than 30 keystrokes, without knowing or caring about what its native version-control system is, or where it’s hosted. Want to grab the Python source code? Just do bzr branch lp:python. How about Storm? bzr branch lp:storm. In fact, there are thousands of native Bazaar branches and over one thousand imported branches. Here are just a few examples of major projects you can pull right now:

  • Ruby on Rails:
    bzr branch lp:rails
  • Blender:
    bzr branch lp:blender
  • F-Spot:
    bzr branch lp:f-spot
  • Grub:
    bzr branch lp:grub
  • Twisted:
    bzr branch lp:twisted
  • Bazaar itself:
    bzr branch lp:bzr
  • GCC:
    bzr branch lp:gcc

Couldn’t find a branch listed for the project you want? We can sort this out for you, too. If it’s in CVS or Subversion elsewhere, you can just follow the instructions for setting up an import. If it’s a Bazaar branch, just register it and we’ll hook it up with the project’s mainline series record.

More on project branches

If you visit https://code.launchpad.net/ you’ll notice that it has an abbreviated project cloud, which lists all the projects with branches in Launchpad. The project’s name is rendered in different sizes and intensities according to how active the actual project is; the size of the name in the cloud is defined by the number of branches that the project has, and the intensity of the tag in the cloud is determined by how recent the last commit to any active branch is. And green indicates that there’s a default branch for the project, which means that the bzr branch lp:foo abbreviation works for it. There’s a also a page with the full code cloud.

So each of those projects has active source code branches that you can pull from Launchpad using Bazaar. For instance, to check the source code for Apport, you could click on its entry in the listing and getting there you could inspect the branches available and select one of them for pulling. For instance, if you chose Will Woods’ Fedora support branch you get instructions on how to pull it: bzr branch http://bazaar.launchpad.net/~wwoods/apport/fedora or even just
bzr branch lp:~wwoods/apport/fedora

Imports and today’s deliveries

Import requests are handled in a queue by Launchpad code ninjas; normally this it Michael Hudson’s responsibility but starting today I’ll be helping out too. Of the import requests I handled today, the following succeeded and are ready for grabbing in the great bzr-get-lp-colon fashion:

I’ll keep you posted on new imports as they come online. Meanwhile, go grab some branches and post some comments telling me what you think. If you have any problems or questions about our code hosting service, feel free to ask on the Launchpad code section in answers.launchpad.net.

2008年2月18日 星期一

pjsua as a testing client

原文, original

PJSIP: Command-Line VoIP Client for Linux

January 20, 2008 – 11:10 pm

Some time ago, I was tasked at work with finding an IP telephony client that used the SIP protocol, ran on linux, and did everything from the command line. The goal was to have a program that could be deployed at remote networks to test the quality and performance of VoIP calls between the remote site and our central Asterisk VoIP server. I thought this would be an easy task, but it turned out to be far more difficult to find a client that had all of the necessary features. There are a few command-line SIP clients for linux, and most of them are designed for testing, but paradoxically this means that their feature sets have been limited to simply making a call and playing some sort of wav file or reading text from a file. This was handy for sure, but we needed something that would for all intents and purposes be a full-fledged SIP phone that we could control remotely either with a web script or through SSH.

Yesterday I finally stumbled across a program that fit the bill. More than just a program with a static set of features, PJSIP contains a complete library of functions so that you can build your own programs based on the SIP protocol in practically any language you like. However, it does come with several example applications you can build and use on multiple platforms. The primary application is called pjsua, and contains a fully-featured, menu-based interface for the command line. This program alone did everything we needed and more.

Pjsua is incredibly easy to use. Run without any options, it presents you with a nice menu-interface where you can add accounts, add and view the status of other SIP users, make calls, transfer calls, put calls on hold, conference calls, and even pipe in audio from wav files. If you’re in a hurry, you can make a call with the following short and simple command:

pjsua sip:<user>@<domain>

Or if you know the IP address of the other user, you can do the following:

pjsua sip:<ip address>

Chances are you’ll want to have a registered account on a server running something like Asterisk. You can use command-line options to specify the account details every time, or you can put the command-line options into a config file and have pjsua load that instead using the following syntax:

pjsua –config-file=<config file>

One of the neatest features of pjsua is the ability to run it in “daemon” mode, officially called auto-answer. In this mode, pjsua sits idling, waiting for an incoming call. When it detects an incoming call, pjsua answers and can do several different things. Here is an example command:

pjsua –null-audio –play-file=data3.wav –auto-play –rec-file=call001.wav –auto-rec –auto-answer=200 –config-file=pj-config

Broken down, this command tells pjsua to run, register itself with the central server with the details provided in “pj-config”, to listen for incoming calls and automatically answer with code 200 (for those of you familiar with HTTP status codes, SIP status codes are remarkably similar), to loop data3.wav after answering the call, and to record any audio on the line (except the wav file being piped in).

Why on earth would this be useful? Say, for instance, I have a business client using my VoIP service at the other end of the state. He calls me to complain that call quality has been atrocious for the past few days. There are a few things I can do. I can take up a bunch of his time having him troubleshoot with me on the phone, I can drive all the way across the state and troubleshoot the issue myself, or I can use the web server we’ve also installed on his network to make my own test calls without ever leaving my office or tying up the client’s time or phone line. I can simply place a call to the test number and listen to the looped recording for evidence of audio quality issues. This only tells me half the story however, as often times with VoIP sessions only one side of the conversation is affected. This is where the recording comes in, as I can now download it from the remote server and analyze it for problems. This saves both time and money, and provides an easy yet effective way to track down problems.

Pjsua is a fully featured SIP client, so if you have speakers and a microphone on your system, you can use this just like you would any other soft-phone. However, given that there are several other soft-phones for linux with a nice GUI interface, one of them may be a better choice if your goal is simply to make and receive calls from your computer. But if you need something to run in a windowless environment, or you’re like me and need something lightweight to help troubleshoot VoIP issues, you can download Pjsua and the entire PJSIP library from http://www.pjsip.org.

2008年1月23日 星期三

about the bug "bad dynamic tag"

it seems the older linker may cause this problem.

gnu.utils.bug: Binutils linker bug ? states what happens.

bug in dynamic linker states how this issue is solved.


a simple work-around for my program is add '-lc' to end of the command line to avoid part of the issue.