[squid-users] tproxy2 patch for squid3

Hello,

Regular client-side transparent proxying is easily accomplished by
redirecting network traffic using -j DNAT, -j REDIRECT, or -j TPROXY (I do
not know why this seems needed). However, server-side transparency requires
a little more kick.
https://lists.balabit.hu/pipermail/tproxy/2006-July/000273.html

This patch actually brew in my homemade version of squid3 and worked long
before tproxy even hit the squid2.6 scene. CAP_NET_ADMIN must be accounted for
by the user, and in my case, is easily done through the MultiAdmin linux kernel
module.

diff --fast -Ndpru squid-3.0.PRE4-20060727~/src/cf.data.pre squid-3.0.PRE4-20060727/src/cf.data.pre
--- squid-3.0.PRE4-20060727~/src/cf.data.pre 2006-07-02 18:53:46.000000000 +0200
+++ squid-3.0.PRE4-20060727/src/cf.data.pre 2006-07-28 15:56:59.629577000 +0200
@@ -2852,6 +2852,16 @@ DOC_START
         the correct result.
 DOC_END
 
+NAME: tproxy
+TYPE: onoff
+DEFAULT: off
+LOC: Config.onoff.tproxy
+DOC_START
+ If you have Linux with iptables and TPROXY2 support, you can enable
+ this option to have SQUID make outgoing connections using the original
+ IP address of the client.
+DOC_END
+
 NAME: tcp_outgoing_tos tcp_outgoing_ds tcp_outgoing_dscp
 TYPE: acl_tos
 DEFAULT: none
diff --fast -Ndpru squid-3.0.PRE4-20060727~/src/comm.cc squid-3.0.PRE4-20060727/src/comm.cc
--- squid-3.0.PRE4-20060727~/src/comm.cc 2006-05-30 23:15:58.000000000 +0200
+++ squid-3.0.PRE4-20060727/src/comm.cc 2006-07-28 15:57:02.299577000 +0200
@@ -39,8 +39,10 @@
 #include "StoreIOBuffer.h"
 #include "comm.h"
 #include "fde.h"
+#include "forward.h"
 #include "CommIO.h"
 #include "ConnectionDetail.h"
+#include "HttpRequest.h"
 #include "MemBuf.h"
 #include "pconn.h"
 #include "SquidTime.h"
@@ -52,6 +54,7 @@
 #include <netinet/tcp.h>
 #endif
 
+#include "ip_tproxy.h"
 
 class ConnectStateData
 {
@@ -66,7 +69,7 @@ public:
     char *host;
     u_short port;
 
- struct sockaddr_in S;
+ struct sockaddr_in S, src_addr;
     CallBack<CNCB> callback;
 
     struct IN_ADDR in_addr;
@@ -1150,6 +1153,26 @@ ConnectStateData::operator delete (void
     cbdataFree(address);
 }
 
+void commConnectStart2(int fd, const char *host, u_short port, CNCB *callback,
+ FwdState *fs)
+{
+ ConnectStateData *cs;
+
+ cs = new ConnectStateData;
+ cs->fd = fd;
+ cs->host = xstrdup(host);
+ cs->port = port;
+ cs->callback = CallBack<CNCB>(callback, fs);
+ if(fs->request != NULL) {
+ cs->src_addr.sin_addr = fs->request->client_addr;
+ cs->src_addr.sin_port = htons(fs->request->client_port);
+ } else {
+ memset(&cs->src_addr, 0, sizeof(cs->src_addr));
+ }
+ comm_add_close_handler(fd, commConnectFree, cs);
+ ipcache_nbgethostbyname(host, commConnectDnsHandle, cs);
+}
+
 void
 commConnectStart(int fd, const char *host, u_short port, CNCB * callback, void *data)
 {
@@ -1353,7 +1376,7 @@ ConnectStateData::connect()
     if (S.sin_addr.s_addr == 0)
         defaults();
 
- switch (comm_connect_addr(fd, &S)) {
+ switch (comm_connect_addr(fd, &S, &src_addr)) {
 
     case COMM_INPROGRESS:
         debug(5, 5) ("ConnectStateData::connect: FD %d: COMM_INPROGRESS\n", fd);
@@ -1406,9 +1429,45 @@ commSetTimeout(int fd, int timeout, PF *
     return F->timeout;
 }
 
-int
+static void do_tproxy(int sock, const struct sockaddr_in *src,
+ const struct sockaddr_in *dest)
+{
+ struct in_tproxy itp;
+ int ret;
 
-comm_connect_addr(int sock, const struct sockaddr_in *address)
+ memset(&itp, 0, sizeof(itp));
+ itp.v.addr.faddr = src->sin_addr; // fix endianness
+ itp.v.addr.fport = 0; //src->sin_port;
+ itp.op = TPROXY_ASSIGN;
+
+ if((ret = setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp))) != 0) {
+ debug(5, 3) ("setsockopt IP_TPROXY/TPROXY_ASSIGN failed\n");
+ return;
+ }
+
+ memset(&itp, 0, sizeof(itp));
+ itp.v.addr.faddr = dest->sin_addr;
+ itp.v.addr.fport = dest->sin_port;
+ itp.op = TPROXY_CONNECT;
+ if((ret = setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp))) != 0) {
+ debug(5, 3) ("setsockopt IP_TPROXY/TPROXY_CONNECT failed\n");
+ return;
+ }
+
+ memset(&itp, 0, sizeof(itp));
+ itp.v.flags = ITP_CONNECT;
+ itp.op = TPROXY_FLAGS;
+ if((ret = setsockopt(sock, SOL_IP, IP_TPROXY, &itp, sizeof(itp))) != 0) {
+ debug(5, 3) ("setsockopt IP_TPROXY/TPROXY_FLAGS failed\n");
+ return;
+ }
+
+ return;
+}
+
+int
+comm_connect_addr(int sock, const struct sockaddr_in *address,
+ const struct sockaddr_in *src)
 {
     comm_err_t status = COMM_OK;
     fde *F = &fd_table[sock];
@@ -1425,6 +1484,10 @@ comm_connect_addr(int sock, const struct
         F->flags.called_connect = 1;
         statCounter.syscalls.sock.connects++;
 
+ if(Config.onoff.tproxy && src != NULL && src->sin_addr.s_addr != 0 &&
+ ((ntohl(src->sin_addr.s_addr) >> 24) & 0xFF) != 0x7F)
+ do_tproxy(sock, src, address);
+
         x = connect(sock, (struct sockaddr *) address, sizeof(*address));
 
         if (x < 0)
diff --fast -Ndpru squid-3.0.PRE4-20060727~/src/forward.cc squid-3.0.PRE4-20060727/src/forward.cc
--- squid-3.0.PRE4-20060727~/src/forward.cc 2006-06-20 00:49:59.000000000 +0200
+++ squid-3.0.PRE4-20060727/src/forward.cc 2006-07-28 15:56:59.629577000 +0200
@@ -811,7 +811,7 @@ FwdState::connectStart()
     else
         hierarchyNote(&request->hier, fs->code, request->host);
 
- commConnectStart(fd, host, port, fwdConnectDoneWrapper, this);
+ commConnectStart2(fd, host, port, fwdConnectDoneWrapper, this);
 }
 
 void
diff --fast -Ndpru squid-3.0.PRE4-20060727~/src/ip_tproxy.h squid-3.0.PRE4-20060727/src/ip_tproxy.h
--- squid-3.0.PRE4-20060727~/src/ip_tproxy.h 1970-01-01 01:00:00.000000000 +0100
+++ squid-3.0.PRE4-20060727/src/ip_tproxy.h 2006-07-28 15:56:59.639577000 +0200
@@ -0,0 +1,78 @@
+/*
+ * Transparent proxy support for Linux/iptables
+ *
+ * Copyright (c) 2002-2004 BalaBit IT Ltd.
+ * Author: Balzs Scheidler
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#ifndef _IP_TPROXY_H
+#define _IP_TPROXY_H
+
+#ifdef __KERNEL__
+#include <linux/types.h>
+#include <linux/in.h>
+#else
+#include <netinet/in.h>
+#ifndef IP_RECVORIGADDRS
+#define IP_RECVORIGADDRS 11273
+#define IP_ORIGADDRS IP_RECVORIGADDRS
+struct in_origaddrs {
+ struct in_addr ioa_srcaddr;
+ struct in_addr ioa_dstaddr;
+ unsigned short int ioa_srcport;
+ unsigned short int ioa_dstport;
+};
+#endif
+#endif
+
+/*
+ * used in setsockopt(SOL_IP, IP_TPROXY) should not collide
+ * with values in <linux/in.h>
+ */
+
+#define IP_TPROXY 11274
+
+/* tproxy operations */
+enum {
+ TPROXY_VERSION = 0,
+ TPROXY_ASSIGN,
+ TPROXY_UNASSIGN,
+ TPROXY_QUERY,
+ TPROXY_FLAGS,
+ TPROXY_ALLOC,
+ TPROXY_CONNECT
+};
+
+/* bitfields in IP_TPROXY_FLAGS */
+#define ITP_CONNECT 0x00000001
+#define ITP_LISTEN 0x00000002
+#define ITP_ESTABLISHED 0x00000004
+
+#define ITP_ONCE 0x00010000
+#define ITP_MARK 0x00020000
+#define ITP_APPLIED 0x00040000
+#define ITP_UNIDIR 0x00080000
+
+struct in_tproxy_addr{
+ struct in_addr faddr;
+ u_int16_t fport;
+};
+
+struct in_tproxy {
+ /* fixed part, should not change between versions */
+ u_int32_t op;
+ /* extensible part */
+ union _in_args {
+ u_int32_t version;
+ struct in_tproxy_addr addr;
+ u_int32_t flags;
+ } v;
+};
+
+#endif
+
diff --fast -Ndpru squid-3.0.PRE4-20060727~/src/protos.h squid-3.0.PRE4-20060727/src/protos.h
--- squid-3.0.PRE4-20060727~/src/protos.h 2006-07-02 18:53:46.000000000 +0200
+++ squid-3.0.PRE4-20060727/src/protos.h 2006-07-28 15:57:02.299577000 +0200
@@ -132,8 +132,10 @@ SQUIDCEXTERN void comm_reset_close(int f
 SQUIDCEXTERN void comm_lingering_close(int fd);
 #endif
 SQUIDCEXTERN void commConnectStart(int fd, const char *, u_short, CNCB *, void *);
+class FwdState;
+SQUIDCEXTERN void commConnectStart2(int, const char *, u_short, CNCB *, FwdState *);
 
-SQUIDCEXTERN int comm_connect_addr(int sock, const struct sockaddr_in *);
+SQUIDCEXTERN int comm_connect_addr(int sock, const struct sockaddr_in *, const struct sockaddr_in * = NULL);
 SQUIDCEXTERN void comm_init(void);
 
 SQUIDCEXTERN int comm_open(int, int, struct IN_ADDR, u_short port, int, const char *note);
@@ -256,7 +258,6 @@ SQUIDCEXTERN void fqdncache_restart(void
 SQUIDCEXTERN EVH fqdncache_purgelru;
 SQUIDCEXTERN void fqdncacheAddEntryFromHosts(char *addr, wordlist * hostnames);
 
-class FwdState;
 SQUIDCEXTERN void ftpStart(FwdState *);
 SQUIDCEXTERN char *ftpUrlWith2f(const HttpRequest *);
 
diff --fast -Ndpru squid-3.0.PRE4-20060727~/src/structs.h squid-3.0.PRE4-20060727/src/structs.h
--- squid-3.0.PRE4-20060727~/src/structs.h 2006-07-02 18:53:47.000000000 +0200
+++ squid-3.0.PRE4-20060727/src/structs.h 2006-07-28 15:57:02.309577000 +0200
@@ -559,6 +559,7 @@ struct _SquidConfig
         int emailErrData;
         int httpd_suppress_version_string;
         int global_internal_static;
+ int tproxy;
     }
 
     onoff;
#<<eof>>

Jan Engelhardt

--