Bug 1295 - [PATCH] Transparent proxy support on Linux
Summary: [PATCH] Transparent proxy support on Linux
Status: CLOSED WONTFIX
Alias: None
Product: Portable OpenSSH
Classification: Unclassified
Component: ssh (show other bugs)
Version: 4.6p1
Hardware: Other Linux
: P2 enhancement
Assignee: Assigned to nobody
URL:
Keywords:
: 2526 (view as bug list)
Depends on:
Blocks:
 
Reported: 2007-03-12 11:23 AEDT by Luca Barbieri
Modified: 2021-04-23 14:56 AEST (History)
3 users (show)

See Also:


Attachments
Patch (362.22 KB, patch)
2007-03-12 11:24 AEDT, Luca Barbieri
no flags Details | Diff
Remove auto-generated files from diff (1.24 KB, patch)
2007-03-12 13:29 AEDT, Darren Tucker
no flags Details | Diff
Move Linux code to port-linux.c, add OpenBSD pf rdr support (9.70 KB, patch)
2007-03-12 23:39 AEDT, Darren Tucker
no flags Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Luca Barbieri 2007-03-12 11:23:29 AEDT
This patch adds transparent proxy support on Linux.

You can then run `ssh -D $port` and use `iptables -t nat -A OUTPUT -p tcp -d $dest -j REDIRECT --to-ports $port` to tunnel all TCP connections to host $dest via the ssh tunnel.

Please apply, since this functionality is quite useful and cannot be efficiently obtained otherwise.
Comment 1 Luca Barbieri 2007-03-12 11:24:12 AEDT
Created attachment 1249 [details]
Patch
Comment 2 Darren Tucker 2007-03-12 13:29:54 AEDT
Created attachment 1250 [details]
Remove auto-generated files from diff

The bulk of the diff (99.7%, by my calculations :-) is noise from automatically generated files.
Comment 3 Luca Barbieri 2007-03-12 13:48:50 AEDT
Sorry, I had filtered it myself but uploaded the wrong file.
Comment 4 Darren Tucker 2007-03-12 23:39:15 AEDT
Created attachment 1251 [details]
Move Linux code to port-linux.c, add OpenBSD pf rdr support

I like this idea, and I've extended it a bit:
* added autoconf support
* moved linux/netfilter-specific code into openbsd-compat/port-linux.c
* added support for OpenBSD pf "rdr" rules
* made it easy to add new redirection interfaces.

On OpenBSD, you can use something like the following in pf.conf:

tun_net="192.168.34.0/24"
rdr pass on lo0 proto tcp from any to $tun_net -> 127.0.0.1 port 1080
pass out quick route-to (lo0 127.0.0.1) from any to $tun_net

(the route-to is needed because pf rdr rules don't apply to outbound packets, so without it you can't redirect locally originated connections).

For anyone wondering how this compares to the tun(4) interface that's already there: it's less flexible (TCP only, requires good name resolution on the client end) but doesn't require privilege on the server (or anything other than standard port forwarding) and doesn't suffer from the TCP-over-IP-over-TCP performance potential problems (ie stacked retransmits when the link experiences packet loss).

For the truly twisted: you can also achieve something similar to this patch *without* special kernel support (other than ppp/slip) if you build slirp socksified and point it to a DynamicForward.  (I've actually done this, but it turns out I wasn't the first to think of it.  I dunno if I'm disappointed or relieved :-)
Comment 5 Damien Miller 2007-03-16 00:23:41 AEDT
Nice idea, but why does this need to be in ssh (which would need to then run as root) and not some little "nat-to-socks" tool, or just as a mode to netcat? That way it would not bloat ssh, and could also be used to automatically Tor-ify applications.
Comment 6 Darren Tucker 2007-03-16 00:56:51 AEDT
(In reply to comment #5)
> Nice idea, but why does this need to be in ssh (which would need to
> then run as root)

It doesn't necessarily need to run as root.

On Linux, it doesn't require any privilege at all.

On OpenBSD, it needs write access to /dev/pf (I asked the pf guys if there was another way to do it but there wasn't).  You could make it setgid, and you could mitigate by opening /dev/pf early then revoking privileges and keeping the descriptor open.

> and not some little "nat-to-socks" tool, or just as a
> mode to netcat? That way it would not bloat ssh, and could also be
> used to automatically Tor-ify applications.

Now that might be worth investigating.  I looked for such a tool but didn't find one (not that it means it doesn't exist, just that I didn't find it).
Comment 7 Luca Barbieri 2007-03-16 12:08:56 AEDT
Because this avoids the extra overhead and hassle of the nat-to-socks application.
Comment 8 Darren Tucker 2007-04-10 10:06:35 AEST
(In reply to comment #7)
> Because this avoids the extra overhead and hassle of the nat-to-socks
> application.

A separate nat-to-socks application does have some advantages, though.  You could open the tunnels on demand, and you could use different tunnels based on different conditions (eg: target, current location on the network).  Both of those are things that would be useful to me.

Going back to comment #6, there's another way it could be done on OpenBSD without running sshd as root: you could use a setuid/setgid helper to return an open descriptor on /dev/pf.

Comment 9 Damien Miller 2010-04-09 14:45:25 AEST
We should decide on this one way or the other:

How about we build this into a little helper program in contrib/ ? We could even link against libssh.a that way...
Comment 10 Damien Miller 2010-08-10 04:23:35 AEST
We'll look at this for the next release.
Comment 11 Damien Miller 2011-01-24 12:30:52 AEDT
Retarget unclosed bugs from 5.7=>5.8
Comment 12 Damien Miller 2011-09-06 10:34:21 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 13 Damien Miller 2011-09-06 10:36:33 AEST
Retarget unresolved bugs/features to 6.0 release
Comment 14 Damien Miller 2011-09-06 10:39:09 AEST
Retarget unresolved bugs/features to 6.0 release

(try again - bugzilla's "change several" isn't)
Comment 15 Damien Miller 2012-02-24 10:34:30 AEDT
Retarget from 6.0 to 6.1
Comment 16 Damien Miller 2012-02-24 10:38:09 AEDT
Retarget 6.0 => 6.1
Comment 17 Damien Miller 2012-07-20 11:50:06 AEST
I'd like to get this done soon, but the current patch has bitrotted - particularly in the pf department.

IMO this would be best as a helper program that:

1) accept()ed connections redirected to it by the packet filter
2) determined (by OS-specific means) the original address
3) connected to a running ssh via it's multiplexing socket and passes in the accepted fd using MUX_C_NEW_STDIO_FWD

This makes the helper really small and simple, which is nice because it looks like it will need privileges of some sort on OpenBSD at least.
Comment 18 Damien Miller 2012-09-07 11:38:20 AEST
Retarget uncompleted bugs from 6.1 => 6.2
Comment 19 Damien Miller 2012-09-07 11:40:45 AEST
Retarget bugs from 6.1 => 6.2
Comment 20 Damien Miller 2013-03-08 10:24:16 AEDT
retarget to openssh-6.3
Comment 21 Damien Miller 2013-07-25 12:18:09 AEST
Retarget to openssh-6.4
Comment 22 Damien Miller 2013-07-25 12:21:11 AEST
Retarget 6.3 -> 6.4
Comment 23 Damien Miller 2013-09-19 11:09:55 AEST
detargetting until this is rewritten as per comment #15
Comment 24 Damien Miller 2016-02-11 17:26:14 AEDT
*** Bug 2526 has been marked as a duplicate of this bug. ***
Comment 25 Darren Tucker 2019-01-23 19:44:38 AEDT
At least one implementation of this idea as an external redirect->socks server exists (http://darkk.net.ru/redsocks/) and another using LD_PRELOAD (tsocks).  I don't think we're ever going to implement this in ssh itself.
Comment 26 Damien Miller 2021-04-23 14:56:58 AEST
closing resolved bugs as of 8.6p1 release